@jami-studio/dispatch 0.13.14

package/dist/server/lib/mcp-access-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-access-store.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAiBrE,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,KAAK;SACF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,OAAO;QACL,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACnD,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC;QAC5D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClE,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,IAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import {\r\n  getRequestOrgId,\r\n  getRequestUserEmail,\r\n} from \"@agent-native/core/server\";\r\nimport {\r\n  getOrgSetting,\r\n  getUserSetting,\r\n  putOrgSetting,\r\n  putUserSetting,\r\n} from \"@agent-native/core/settings\";\r\n\r\nexport const MCP_APP_ACCESS_SETTINGS_KEY = \"dispatch-mcp-app-access\";\r\n\r\nexport type DispatchMcpAppAccessMode = \"all-apps\" | \"selected-apps\";\r\n\r\nexport interface DispatchMcpAppAccessSettings {\r\n  mode: DispatchMcpAppAccessMode;\r\n  selectedAppIds: string[];\r\n  updatedAt?: string;\r\n  updatedBy?: string;\r\n}\r\n\r\ninterface AccessScope {\r\n  kind: \"org\" | \"user\";\r\n  id: string;\r\n  actor: string;\r\n}\r\n\r\nfunction uniqueAppIds(values: unknown): string[] {\r\n  const input = Array.isArray(values) ? values : [];\r\n  return Array.from(\r\n    new Set(\r\n      input\r\n        .filter((value): value is string => typeof value === \"string\")\r\n        .map((value) => value.trim().toLowerCase())\r\n        .filter(Boolean),\r\n    ),\r\n  );\r\n}\r\n\r\nexport function normalizeMcpAppAccessSettings(\r\n  raw: unknown,\r\n): DispatchMcpAppAccessSettings {\r\n  const record =\r\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\r\n      ? (raw as Record<string, unknown>)\r\n      : {};\r\n  const mode = record.mode === \"selected-apps\" ? \"selected-apps\" : \"all-apps\";\r\n  return {\r\n    mode,\r\n    selectedAppIds: uniqueAppIds(record.selectedAppIds),\r\n    updatedAt:\r\n      typeof record.updatedAt === \"string\" ? record.updatedAt : undefined,\r\n    updatedBy:\r\n      typeof record.updatedBy === \"string\" ? record.updatedBy : undefined,\r\n  };\r\n}\r\n\r\nfunction currentAccessScope(): AccessScope {\r\n  const actor = getRequestUserEmail();\r\n  if (!actor) throw new Error(\"no authenticated user\");\r\n  const orgId = getRequestOrgId();\r\n  if (orgId) return { kind: \"org\", id: orgId, actor };\r\n  return { kind: \"user\", id: actor, actor };\r\n}\r\n\r\nexport async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {\r\n  const scope = currentAccessScope();\r\n  const raw =\r\n    scope.kind === \"org\"\r\n      ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)\r\n      : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);\r\n  return normalizeMcpAppAccessSettings(raw);\r\n}\r\n\r\nexport async function setDispatchMcpAppAccessSettings(input: {\r\n  mode: DispatchMcpAppAccessMode;\r\n  selectedAppIds?: string[];\r\n}): Promise<DispatchMcpAppAccessSettings> {\r\n  const scope = currentAccessScope();\r\n  const next: DispatchMcpAppAccessSettings = {\r\n    mode: input.mode,\r\n    selectedAppIds: uniqueAppIds(input.selectedAppIds),\r\n    updatedAt: new Date().toISOString(),\r\n    updatedBy: scope.actor,\r\n  };\r\n  const value = next as unknown as Record<string, unknown>;\r\n  if (scope.kind === \"org\") {\r\n    await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\r\n  } else {\r\n    await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\r\n  }\r\n  return next;\r\n}\r\n\r\nexport function isAppAllowedByMcpAccess(\r\n  appId: string,\r\n  settings: DispatchMcpAppAccessSettings,\r\n): boolean {\r\n  const normalized = appId.trim().toLowerCase();\r\n  if (!normalized) return false;\r\n  if (settings.mode === \"all-apps\") return true;\r\n  return settings.selectedAppIds.includes(normalized);\r\n}\r\n"]}

package/dist/server/lib/mcp-gateway.d.ts

@@ -0,0 +1,51 @@
+import { type DispatchMcpAppAccessSettings } from "./mcp-access-store.js";
+export interface DispatchMcpAccessibleApp {
+    id: string;
+    name: string;
+    description: string;
+    url: string;
+    color: string;
+    granted: boolean;
+}
+export declare function listDispatchMcpApps(): Promise<{
+    settings: DispatchMcpAppAccessSettings;
+    apps: DispatchMcpAccessibleApp[];
+}>;
+export declare function listGrantedDispatchMcpApps(): Promise<DispatchMcpAccessibleApp[]>;
+export declare function listGrantedDispatchMcpAppOrigins(): Promise<string[]>;
+export declare function resolveGrantedDispatchMcpApp(app: string): Promise<DispatchMcpAccessibleApp>;
+export declare function askGrantedDispatchMcpApp(app: string, message: string): Promise<{
+    app: string;
+    routedVia: "a2a";
+    response: string;
+}>;
+export declare function openGrantedDispatchMcpApp(input: {
+    app: string;
+    view?: string;
+    path?: string;
+    params?: Record<string, string | number | boolean>;
+    embed?: boolean;
+    chrome?: "full" | "minimal";
+}): Promise<{
+    app: string;
+    view?: string;
+    path?: string;
+    url: string;
+    embed?: boolean;
+    chrome?: "full" | "minimal";
+    embedStartUrl?: string;
+    embedTargetPath?: string;
+    embedExpiresAt?: number;
+}>;
+export declare function createGrantedDispatchMcpEmbedSession(input: {
+    app?: string;
+    url?: string;
+    path?: string;
+    chrome?: "full" | "minimal";
+}): Promise<{
+    startUrl: string;
+    targetPath?: string;
+    expiresAt?: number;
+    app: string;
+}>;
+//# sourceMappingURL=mcp-gateway.d.ts.map

package/dist/server/lib/mcp-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AAU/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAqLD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB9D;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AA+KD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAmED"}

package/dist/server/lib/mcp-gateway.js

@@ -0,0 +1,477 @@
+import { callAgent, signA2AToken } from "@agent-native/core/a2a";
+import { buildMcpToolName, McpClientManager, } from "@agent-native/core/mcp-client";
+import { getOrgA2ASecret, getOrgDomain } from "@agent-native/core/org";
+import { buildDeepLink, buildEmbedStartPath, createEmbedSessionTicket, getRequestContext, getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
+import { discoverAgents, } from "@agent-native/core/server/agent-discovery";
+import { getDispatchMcpAppAccessSettings, isAppAllowedByMcpAccess, } from "./mcp-access-store.js";
+const DISPATCH_APP_ID = "dispatch";
+const DISPATCH_NAME = "Agent-Native Dispatch";
+const DISPATCH_DESCRIPTION = "Workspace control plane for extensions, agents, vault, integrations, approvals, and app routing.";
+const DISPATCH_COLOR = "#14B8A6";
+const TARGET_EMBED_SESSION_ATTEMPTS = 3;
+const TARGET_EMBED_SESSION_RETRY_BASE_MS = 250;
+function normalizeAppId(value) {
+    return value.trim().toLowerCase();
+}
+function normalizeBaseUrl(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return null;
+        return url.toString().replace(/\/+$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeBasePath(value) {
+    const trimmed = value?.trim();
+    if (!trimmed || trimmed === "/")
+        return "";
+    const normalized = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");
+    return normalized ? `/${normalized}` : "";
+}
+function withConfiguredBasePath(baseUrl) {
+    const basePath = normalizeBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
+    if (!basePath)
+        return baseUrl;
+    try {
+        const url = new URL(baseUrl);
+        const path = normalizeBasePath(url.pathname);
+        if (path === basePath || path.startsWith(`${basePath}/`)) {
+            return baseUrl;
+        }
+        url.pathname = path && path !== "/" ? `${basePath}${path}` : `${basePath}/`;
+        return url.toString().replace(/\/+$/, "");
+    }
+    catch {
+        return baseUrl;
+    }
+}
+function dispatchSelfBaseUrl() {
+    const requestOrigin = normalizeBaseUrl(getRequestContext()?.requestOrigin);
+    if (requestOrigin)
+        return withConfiguredBasePath(requestOrigin);
+    const configured = normalizeBaseUrl(process.env.WORKSPACE_GATEWAY_URL) ??
+        normalizeBaseUrl(process.env.APP_URL) ??
+        normalizeBaseUrl(process.env.URL) ??
+        normalizeBaseUrl(process.env.DEPLOY_URL) ??
+        normalizeBaseUrl(process.env.BETTER_AUTH_URL);
+    if (configured)
+        return withConfiguredBasePath(configured);
+    return process.env.NODE_ENV === "production"
+        ? "https://dispatch.jami.studio"
+        : "http://localhost:8092";
+}
+function dispatchSelfApp(settings) {
+    return {
+        id: DISPATCH_APP_ID,
+        name: DISPATCH_NAME,
+        description: DISPATCH_DESCRIPTION,
+        url: dispatchSelfBaseUrl(),
+        color: DISPATCH_COLOR,
+        granted: isAppAllowedByMcpAccess(DISPATCH_APP_ID, settings),
+    };
+}
+const CONTROL_CHARS = new RegExp("[\\u0000-\\u001f\\u007f]");
+function safeAppPath(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return null;
+    const value = raw.trim();
+    if (CONTROL_CHARS.test(value))
+        return null;
+    if (!value.startsWith("/"))
+        return null;
+    if (value.startsWith("//") || value.startsWith("/\\"))
+        return null;
+    if (/^\/[a-z][a-z0-9+.-]*:/i.test(value))
+        return null;
+    if (/%(?:2f|5c)/i.test(value))
+        return null;
+    const rawPath = value.split(/[?#]/, 1)[0] ?? value;
+    let parsed;
+    try {
+        parsed = new URL(value, "http://agent-native.invalid");
+    }
+    catch {
+        return null;
+    }
+    if (parsed.pathname !== rawPath)
+        return null;
+    return value;
+}
+function appendParamsToPath(path, params) {
+    if (!params || Object.keys(params).length === 0)
+        return path;
+    const url = new URL(path, "http://agent-native.invalid");
+    for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, String(value));
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+function safeAppOrigin(app) {
+    try {
+        const url = new URL(app.url);
+        return url.protocol === "http:" || url.protocol === "https:"
+            ? url.origin
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function appBaseUrl(app) {
+    return app.url.replace(/\/+$/, "");
+}
+function appBasePath(app) {
+    const pathname = new URL(appBaseUrl(app)).pathname.replace(/\/+$/, "");
+    return pathname === "/" ? "" : pathname;
+}
+function appMatchesUrlPath(app, url) {
+    const origin = safeAppOrigin(app);
+    if (!origin || url.origin !== origin)
+        return false;
+    const basePath = appBasePath(app);
+    if (!basePath)
+        return true;
+    return url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);
+}
+function appPathSpecificity(app) {
+    return appBasePath(app).length;
+}
+function appRelativePath(app, url) {
+    const basePath = appBasePath(app);
+    const path = basePath
+        ? url.pathname === basePath
+            ? "/"
+            : url.pathname.slice(basePath.length)
+        : url.pathname;
+    return `${path || "/"}${url.search}${url.hash}`;
+}
+function isDispatchControlPath(path) {
+    if (!path)
+        return false;
+    const route = path.split(/[?#]/, 1)[0] ?? path;
+    return (route === "/extensions" ||
+        route.startsWith("/extensions/") ||
+        route === "/tools" ||
+        route.startsWith("/tools/"));
+}
+function assertAppCanOpenPath(app, path) {
+    if (app.id !== DISPATCH_APP_ID && isDispatchControlPath(path)) {
+        throw new Error(`Path "${path}" belongs to Dispatch. Use app: "dispatch" for Dispatch extension and tool routes.`);
+    }
+}
+function toAccessibleApp(agent, settings) {
+    return {
+        id: agent.id,
+        name: agent.name,
+        description: agent.description,
+        url: agent.url,
+        color: agent.color,
+        granted: isAppAllowedByMcpAccess(agent.id, settings),
+    };
+}
+export async function listDispatchMcpApps() {
+    const [settings, agents] = await Promise.all([
+        getDispatchMcpAppAccessSettings(),
+        discoverAgents("dispatch"),
+    ]);
+    return {
+        settings,
+        apps: [
+            dispatchSelfApp(settings),
+            ...agents
+                .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)
+                .map((agent) => toAccessibleApp(agent, settings)),
+        ],
+    };
+}
+export async function listGrantedDispatchMcpApps() {
+    const { apps } = await listDispatchMcpApps();
+    return apps.filter((app) => app.granted && safeAppOrigin(app));
+}
+export async function listGrantedDispatchMcpAppOrigins() {
+    const apps = await listGrantedDispatchMcpApps();
+    return Array.from(new Set(apps.flatMap((app) => safeAppOrigin(app) ?? [])));
+}
+export async function resolveGrantedDispatchMcpApp(app) {
+    const target = normalizeAppId(app);
+    if (!target)
+        throw new Error("app is required");
+    const { apps } = await listDispatchMcpApps();
+    const match = apps.find((candidate) => candidate.id === target || candidate.name.toLowerCase() === target);
+    if (!match) {
+        throw new Error(`Unknown app "${app}". Call list_apps to see apps available through Dispatch MCP.`);
+    }
+    if (!match.granted) {
+        throw new Error(`Dispatch MCP access to "${match.id}" is not granted. Open Dispatch > Agents to change MCP app access.`);
+    }
+    if (!safeAppOrigin(match)) {
+        throw new Error(`Dispatch MCP app "${match.id}" has an invalid URL and cannot be opened through MCP.`);
+    }
+    return match;
+}
+export async function askGrantedDispatchMcpApp(app, message) {
+    const trimmedMessage = message.trim();
+    if (!trimmedMessage)
+        throw new Error("message is required");
+    const target = await resolveGrantedDispatchMcpApp(app);
+    const userEmail = getRequestUserEmail();
+    if (!userEmail)
+        throw new Error("no authenticated user");
+    const orgId = getRequestOrgId();
+    const [orgDomain, orgSecret] = orgId
+        ? await Promise.all([
+            getOrgDomain(orgId).catch(() => null),
+            getOrgA2ASecret(orgId).catch(() => null),
+        ])
+        : [null, null];
+    const response = await callAgent(target.url, trimmedMessage, {
+        userEmail,
+        orgDomain: orgDomain ?? undefined,
+        orgSecret: orgSecret ?? undefined,
+        timeoutMs: 5 * 60_000,
+    });
+    return { app: target.id, routedVia: "a2a", response };
+}
+export async function openGrantedDispatchMcpApp(input) {
+    const view = input.view?.trim() ?? "";
+    const hasPathInput = input.path != null;
+    const path = safeAppPath(input.path);
+    if (hasPathInput && !path) {
+        throw new Error("path must be a safe app-relative route");
+    }
+    if (!view && !path)
+        throw new Error("open_app requires view or path");
+    const target = await resolveGrantedDispatchMcpApp(input.app);
+    if (path)
+        assertAppCanOpenPath(target, path);
+    const relUrl = path
+        ? appendParamsToPath(path, input.params)
+        : buildDeepLink({
+            app: target.id,
+            view,
+            params: input.params,
+        });
+    const url = `${appBaseUrl(target)}${relUrl}`;
+    let embedSession = null;
+    if (input.embed) {
+        try {
+            embedSession = await createGrantedDispatchMcpEmbedSession({
+                app: target.id,
+                url,
+                chrome: input.chrome,
+            });
+        }
+        catch (error) {
+            console.warn(`[dispatch] Could not pre-mint MCP embed session for ${target.id}:`, error);
+        }
+    }
+    return {
+        app: target.id,
+        ...(view ? { view } : {}),
+        ...(path ? { path } : {}),
+        url,
+        ...(input.embed === true ? { embed: true } : {}),
+        ...(input.chrome ? { chrome: input.chrome } : {}),
+        ...(embedSession?.startUrl ? { embedStartUrl: embedSession.startUrl } : {}),
+        ...(embedSession?.targetPath
+            ? { embedTargetPath: embedSession.targetPath }
+            : {}),
+        ...(typeof embedSession?.expiresAt === "number"
+            ? { embedExpiresAt: embedSession.expiresAt }
+            : {}),
+    };
+}
+function parseMcpToolTextResult(result) {
+    if (result && typeof result === "object") {
+        const structured = result.structuredContent;
+        if (structured && typeof structured === "object")
+            return structured;
+        const parts = Array.isArray(result.content)
+            ? result.content
+            : [];
+        const text = parts.find((part) => part?.type === "text" && typeof part.text === "string")?.text;
+        if (typeof text === "string" && text.trim()) {
+            if (result.isError)
+                throw new Error(text.trim());
+            const parsed = JSON.parse(text);
+            if (parsed && typeof parsed === "object")
+                return parsed;
+        }
+    }
+    throw new Error("Target app did not return an embed session.");
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isRetryableTargetMcpError(error) {
+    const message = error instanceof Error
+        ? error.message
+        : typeof error === "string"
+            ? error
+            : String(error ?? "");
+    if (/rejected the request|unauthorized|forbidden|401|403|404|405|html/i.test(message)) {
+        return false;
+    }
+    return /streamable http|handshake|failed to fetch|fetch failed|networkerror|econnrefused|enotfound|timed out|timeout|502|503|504/i.test(message);
+}
+function targetMcpRetryDelay(attempt) {
+    const base = TARGET_EMBED_SESSION_RETRY_BASE_MS * Math.pow(2, Math.max(0, attempt - 1));
+    return base + Math.floor(Math.random() * 100);
+}
+async function callTargetCreateEmbedSession(input) {
+    const serverId = "target";
+    for (let attempt = 1;; attempt += 1) {
+        const manager = new McpClientManager({
+            servers: {
+                [serverId]: {
+                    type: "http",
+                    url: `${appBaseUrl(input.app)}/_agent-native/mcp`,
+                    headers: {
+                        Authorization: `Bearer ${input.token}`,
+                    },
+                },
+            },
+        });
+        try {
+            await manager.start();
+            return await manager.callTool(buildMcpToolName(serverId, "create_embed_session"), {
+                url: input.url,
+                chrome: input.chrome ?? "full",
+            });
+        }
+        catch (error) {
+            if (attempt >= TARGET_EMBED_SESSION_ATTEMPTS ||
+                !isRetryableTargetMcpError(error)) {
+                throw error;
+            }
+            await sleep(targetMcpRetryDelay(attempt));
+        }
+        finally {
+            await manager.stop().catch((stopError) => {
+                console.warn("[dispatch] Failed to stop target MCP client:", stopError);
+            });
+        }
+    }
+}
+async function resolveDispatchEmbedTarget(input) {
+    const explicitApp = input.app?.trim()
+        ? await resolveGrantedDispatchMcpApp(input.app)
+        : null;
+    if (explicitApp && input.path) {
+        const path = safeAppPath(input.path);
+        if (!path)
+            throw new Error("path must be a safe app-relative route");
+        assertAppCanOpenPath(explicitApp, path);
+        return {
+            app: explicitApp,
+            path,
+            url: `${appBaseUrl(explicitApp)}${path}`,
+        };
+    }
+    if (!input.url) {
+        throw new Error("create_embed_session requires a url or app + path.");
+    }
+    let parsed;
+    try {
+        parsed = new URL(input.url);
+    }
+    catch {
+        if (!explicitApp) {
+            throw new Error("Relative embed paths require an app id.");
+        }
+        const path = safeAppPath(input.url);
+        if (!path)
+            throw new Error("url must be a safe app route.");
+        return {
+            app: explicitApp,
+            path,
+            url: `${appBaseUrl(explicitApp)}${path}`,
+        };
+    }
+    const apps = explicitApp ? [explicitApp] : await listGrantedDispatchMcpApps();
+    const target = apps
+        .filter((app) => appMatchesUrlPath(app, parsed))
+        .sort((a, b) => appPathSpecificity(b) - appPathSpecificity(a))[0];
+    if (!target) {
+        throw new Error("Embed URL must belong to an app granted through Dispatch.");
+    }
+    const path = safeAppPath(appRelativePath(target, parsed));
+    if (!path)
+        throw new Error("Embed URL path is not safe.");
+    assertAppCanOpenPath(target, path);
+    return { app: target, path, url: `${appBaseUrl(target)}${path}` };
+}
+async function createDispatchSelfEmbedSession(input) {
+    const ticket = await createEmbedSessionTicket({
+        ownerEmail: input.ownerEmail,
+        orgId: input.orgId,
+        targetPath: input.path,
+        scope: input.chrome ?? null,
+    });
+    const startPath = buildEmbedStartPath(ticket.ticket);
+    return {
+        startUrl: new URL(startPath, input.baseUrl).toString(),
+        targetPath: input.path,
+        expiresAt: ticket.expiresAt,
+        app: DISPATCH_APP_ID,
+    };
+}
+export async function createGrantedDispatchMcpEmbedSession(input) {
+    const userEmail = getRequestUserEmail();
+    if (!userEmail)
+        throw new Error("no authenticated user");
+    const target = await resolveDispatchEmbedTarget(input);
+    const orgId = getRequestOrgId();
+    if (target.app.id === DISPATCH_APP_ID) {
+        return createDispatchSelfEmbedSession({
+            ownerEmail: userEmail,
+            orgId,
+            path: target.path,
+            baseUrl: appBaseUrl(target.app),
+            chrome: input.chrome,
+        });
+    }
+    const [orgDomain, orgSecret] = orgId
+        ? await Promise.all([
+            getOrgDomain(orgId).catch(() => null),
+            getOrgA2ASecret(orgId).catch(() => null),
+        ])
+        : [null, null];
+    const usableOrgSecret = typeof orgSecret === "string" && orgSecret.trim().length > 0;
+    const usableOrgDomain = typeof orgDomain === "string" && orgDomain.trim().length > 0;
+    const useOrgSigning = usableOrgDomain && usableOrgSecret;
+    const signedOrgDomain = usableOrgDomain ? orgDomain.trim() : undefined;
+    const token = await signA2AToken(userEmail, signedOrgDomain, useOrgSigning ? orgSecret.trim() : undefined, {
+        expiresIn: "5m",
+        // Prefer the synced org A2A secret when present because first-party
+        // production apps do not have to share the same deployment env secret.
+        // Fall back to the global A2A_SECRET for orgs that have not synced yet.
+        preferGlobalSecret: !useOrgSigning,
+    });
+    const result = await callTargetCreateEmbedSession({
+        app: target.app,
+        token,
+        url: target.url,
+        chrome: input.chrome,
+    });
+    const parsed = parseMcpToolTextResult(result);
+    if (!parsed.startUrl) {
+        throw new Error("Target app did not return an embed start URL.");
+    }
+    const output = {
+        startUrl: parsed.startUrl,
+        app: target.app.id,
+    };
+    if (parsed.targetPath)
+        output.targetPath = parsed.targetPath;
+    if (typeof parsed.expiresAt === "number")
+        output.expiresAt = parsed.expiresAt;
+    return output;
+}
+//# sourceMappingURL=mcp-gateway.js.map

package/dist/server/lib/mcp-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-gateway.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,GAEf,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,MAAM,oBAAoB,GACxB,kGAAkG,CAAC;AACrG,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAW/C,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA8B;IACtD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,aAAa,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3E,IAAI,aAAa;QAAE,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,UAAU,GACd,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,UAAU;QAAE,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC1C,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,uBAAuB,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,oBAAoB;QACjC,GAAG,EAAE,mBAAmB,EAAE;QAC1B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,uBAAuB,CAAC,eAAe,EAAE,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE7D,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACnD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAA6B;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAA6B;IAC/C,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAA6B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA6B,EAAE,GAAQ;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA6B;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,GAA6B,EAAE,GAAQ;IAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,OAAO,GAAG,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAmB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/C,OAAO,CACL,KAAK,KAAK,aAAa;QACvB,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;QAChC,KAAK,KAAK,QAAQ;QAClB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA6B,EAAE,IAAY;IACvE,IAAI,GAAG,CAAC,EAAE,KAAK,eAAe,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,oFAAoF,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAsB,EACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAIvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,+BAA+B,EAAE;QACjC,cAAc,CAAC,UAAU,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,IAAI,EAAE;YACJ,eAAe,CAAC,QAAQ,CAAC;YACzB,GAAG,MAAM;iBACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,eAAe,CAAC;iBAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAG9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,IAAI,GAAG,MAAM,0BAA0B,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACrE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,+DAA+D,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,EAAE,oEAAoE,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qBAAqB,KAAK,CAAC,EAAE,wDAAwD,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,OAAe;IAEf,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE;QAC3D,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IAWC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,aAAa,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACP,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAC7C,IAAI,YAAY,GAEL,IAAI,CAAC;IAChB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,oCAAoC,CAAC;gBACxD,GAAG,EAAE,MAAM,CAAC,EAAE;gBACd,GAAG;gBACH,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,uDAAuD,MAAM,CAAC,EAAE,GAAG,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,EAAE;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,YAAY,EAAE,UAAU;YAC1B,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,UAAU,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,YAAY,EAAE,SAAS,KAAK,QAAQ;YAC7C,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,SAAS,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,UAAU,GAAI,MAAc,CAAC,iBAAiB,CAAC;QACrD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC;YAClD,CAAC,CAAG,MAAc,CAAC,OAA0C;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACrB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CACjE,EAAE,IAAI,CAAC;QACR,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAK,MAAc,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5B,IACE,mEAAmE,CAAC,IAAI,CACtE,OAAO,CACR,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2HAA2H,CAAC,IAAI,CACrI,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GACR,kCAAkC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,OAAO,EAAE;gBACP,CAAC,QAAQ,CAAC,EAAE;oBACV,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB;oBACjD,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;qBACvC;iBACF;aACF;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAClD;gBACE,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;aAC/B,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,OAAO,IAAI,6BAA6B;gBACxC,CAAC,yBAAyB,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACvC,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,SAAS,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAIzC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,MAAM,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACrE,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,0BAA0B,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI;SAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAM7C;IAMC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QACtD,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,eAAe;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IAMC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,8BAA8B,CAAC;YACpC,UAAU,EAAE,SAAS;YACrB,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjB,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,eAAe,IAAI,eAAe,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,SAAS,EACT,eAAe,EACf,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAC5C;QACE,SAAS,EAAE,IAAI;QACf,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,kBAAkB,EAAE,CAAC,aAAa;KACnC,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAI3C,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAKR;QACF,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;KACnB,CAAC;IACF,IAAI,MAAM,CAAC,UAAU;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { callAgent, signA2AToken } from \"@agent-native/core/a2a\";\r\nimport {\r\n  buildMcpToolName,\r\n  McpClientManager,\r\n} from \"@agent-native/core/mcp-client\";\r\nimport { getOrgA2ASecret, getOrgDomain } from \"@agent-native/core/org\";\r\nimport {\r\n  buildDeepLink,\r\n  buildEmbedStartPath,\r\n  createEmbedSessionTicket,\r\n  getRequestContext,\r\n  getRequestOrgId,\r\n  getRequestUserEmail,\r\n} from \"@agent-native/core/server\";\r\nimport {\r\n  discoverAgents,\r\n  type DiscoveredAgent,\r\n} from \"@agent-native/core/server/agent-discovery\";\r\n\r\nimport {\r\n  getDispatchMcpAppAccessSettings,\r\n  isAppAllowedByMcpAccess,\r\n  type DispatchMcpAppAccessSettings,\r\n} from \"./mcp-access-store.js\";\r\n\r\nconst DISPATCH_APP_ID = \"dispatch\";\r\nconst DISPATCH_NAME = \"Agent-Native Dispatch\";\r\nconst DISPATCH_DESCRIPTION =\r\n  \"Workspace control plane for extensions, agents, vault, integrations, approvals, and app routing.\";\r\nconst DISPATCH_COLOR = \"#14B8A6\";\r\nconst TARGET_EMBED_SESSION_ATTEMPTS = 3;\r\nconst TARGET_EMBED_SESSION_RETRY_BASE_MS = 250;\r\n\r\nexport interface DispatchMcpAccessibleApp {\r\n  id: string;\r\n  name: string;\r\n  description: string;\r\n  url: string;\r\n  color: string;\r\n  granted: boolean;\r\n}\r\n\r\nfunction normalizeAppId(value: string): string {\r\n  return value.trim().toLowerCase();\r\n}\r\n\r\nfunction normalizeBaseUrl(raw: string | undefined | null): string | null {\r\n  const value = raw?.trim();\r\n  if (!value) return null;\r\n  try {\r\n    const url = new URL(value);\r\n    if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return null;\r\n    return url.toString().replace(/\\/+$/, \"\");\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nfunction normalizeBasePath(value: string | undefined): string {\r\n  const trimmed = value?.trim();\r\n  if (!trimmed || trimmed === \"/\") return \"\";\r\n  const normalized = trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\r\n  return normalized ? `/${normalized}` : \"\";\r\n}\r\n\r\nfunction withConfiguredBasePath(baseUrl: string): string {\r\n  const basePath = normalizeBasePath(\r\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\r\n  );\r\n  if (!basePath) return baseUrl;\r\n  try {\r\n    const url = new URL(baseUrl);\r\n    const path = normalizeBasePath(url.pathname);\r\n    if (path === basePath || path.startsWith(`${basePath}/`)) {\r\n      return baseUrl;\r\n    }\r\n    url.pathname = path && path !== \"/\" ? `${basePath}${path}` : `${basePath}/`;\r\n    return url.toString().replace(/\\/+$/, \"\");\r\n  } catch {\r\n    return baseUrl;\r\n  }\r\n}\r\n\r\nfunction dispatchSelfBaseUrl(): string {\r\n  const requestOrigin = normalizeBaseUrl(getRequestContext()?.requestOrigin);\r\n  if (requestOrigin) return withConfiguredBasePath(requestOrigin);\r\n\r\n  const configured =\r\n    normalizeBaseUrl(process.env.WORKSPACE_GATEWAY_URL) ??\r\n    normalizeBaseUrl(process.env.APP_URL) ??\r\n    normalizeBaseUrl(process.env.URL) ??\r\n    normalizeBaseUrl(process.env.DEPLOY_URL) ??\r\n    normalizeBaseUrl(process.env.BETTER_AUTH_URL);\r\n  if (configured) return withConfiguredBasePath(configured);\r\n\r\n  return process.env.NODE_ENV === \"production\"\r\n    ? \"https://dispatch.jami.studio\"\r\n    : \"http://localhost:8092\";\r\n}\r\n\r\nfunction dispatchSelfApp(\r\n  settings: DispatchMcpAppAccessSettings,\r\n): DispatchMcpAccessibleApp {\r\n  return {\r\n    id: DISPATCH_APP_ID,\r\n    name: DISPATCH_NAME,\r\n    description: DISPATCH_DESCRIPTION,\r\n    url: dispatchSelfBaseUrl(),\r\n    color: DISPATCH_COLOR,\r\n    granted: isAppAllowedByMcpAccess(DISPATCH_APP_ID, settings),\r\n  };\r\n}\r\n\r\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\r\n\r\nfunction safeAppPath(raw: unknown): string | null {\r\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\r\n  const value = raw.trim();\r\n  if (CONTROL_CHARS.test(value)) return null;\r\n  if (!value.startsWith(\"/\")) return null;\r\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\r\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\r\n  if (/%(?:2f|5c)/i.test(value)) return null;\r\n  const rawPath = value.split(/[?#]/, 1)[0] ?? value;\r\n  let parsed: URL;\r\n  try {\r\n    parsed = new URL(value, \"http://agent-native.invalid\");\r\n  } catch {\r\n    return null;\r\n  }\r\n  if (parsed.pathname !== rawPath) return null;\r\n  return value;\r\n}\r\n\r\nfunction appendParamsToPath(\r\n  path: string,\r\n  params: Record<string, string | number | boolean> | undefined,\r\n): string {\r\n  if (!params || Object.keys(params).length === 0) return path;\r\n  const url = new URL(path, \"http://agent-native.invalid\");\r\n  for (const [key, value] of Object.entries(params)) {\r\n    url.searchParams.set(key, String(value));\r\n  }\r\n  return `${url.pathname}${url.search}${url.hash}`;\r\n}\r\n\r\nfunction safeAppOrigin(app: DispatchMcpAccessibleApp): string | null {\r\n  try {\r\n    const url = new URL(app.url);\r\n    return url.protocol === \"http:\" || url.protocol === \"https:\"\r\n      ? url.origin\r\n      : null;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nfunction appBaseUrl(app: DispatchMcpAccessibleApp): string {\r\n  return app.url.replace(/\\/+$/, \"\");\r\n}\r\n\r\nfunction appBasePath(app: DispatchMcpAccessibleApp): string {\r\n  const pathname = new URL(appBaseUrl(app)).pathname.replace(/\\/+$/, \"\");\r\n  return pathname === \"/\" ? \"\" : pathname;\r\n}\r\n\r\nfunction appMatchesUrlPath(app: DispatchMcpAccessibleApp, url: URL): boolean {\r\n  const origin = safeAppOrigin(app);\r\n  if (!origin || url.origin !== origin) return false;\r\n  const basePath = appBasePath(app);\r\n  if (!basePath) return true;\r\n  return url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);\r\n}\r\n\r\nfunction appPathSpecificity(app: DispatchMcpAccessibleApp): number {\r\n  return appBasePath(app).length;\r\n}\r\n\r\nfunction appRelativePath(app: DispatchMcpAccessibleApp, url: URL): string {\r\n  const basePath = appBasePath(app);\r\n  const path = basePath\r\n    ? url.pathname === basePath\r\n      ? \"/\"\r\n      : url.pathname.slice(basePath.length)\r\n    : url.pathname;\r\n  return `${path || \"/\"}${url.search}${url.hash}`;\r\n}\r\n\r\nfunction isDispatchControlPath(path: string | null): boolean {\r\n  if (!path) return false;\r\n  const route = path.split(/[?#]/, 1)[0] ?? path;\r\n  return (\r\n    route === \"/extensions\" ||\r\n    route.startsWith(\"/extensions/\") ||\r\n    route === \"/tools\" ||\r\n    route.startsWith(\"/tools/\")\r\n  );\r\n}\r\n\r\nfunction assertAppCanOpenPath(app: DispatchMcpAccessibleApp, path: string) {\r\n  if (app.id !== DISPATCH_APP_ID && isDispatchControlPath(path)) {\r\n    throw new Error(\r\n      `Path \"${path}\" belongs to Dispatch. Use app: \"dispatch\" for Dispatch extension and tool routes.`,\r\n    );\r\n  }\r\n}\r\n\r\nfunction toAccessibleApp(\r\n  agent: DiscoveredAgent,\r\n  settings: DispatchMcpAppAccessSettings,\r\n): DispatchMcpAccessibleApp {\r\n  return {\r\n    id: agent.id,\r\n    name: agent.name,\r\n    description: agent.description,\r\n    url: agent.url,\r\n    color: agent.color,\r\n    granted: isAppAllowedByMcpAccess(agent.id, settings),\r\n  };\r\n}\r\n\r\nexport async function listDispatchMcpApps(): Promise<{\r\n  settings: DispatchMcpAppAccessSettings;\r\n  apps: DispatchMcpAccessibleApp[];\r\n}> {\r\n  const [settings, agents] = await Promise.all([\r\n    getDispatchMcpAppAccessSettings(),\r\n    discoverAgents(\"dispatch\"),\r\n  ]);\r\n  return {\r\n    settings,\r\n    apps: [\r\n      dispatchSelfApp(settings),\r\n      ...agents\r\n        .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)\r\n        .map((agent) => toAccessibleApp(agent, settings)),\r\n    ],\r\n  };\r\n}\r\n\r\nexport async function listGrantedDispatchMcpApps(): Promise<\r\n  DispatchMcpAccessibleApp[]\r\n> {\r\n  const { apps } = await listDispatchMcpApps();\r\n  return apps.filter((app) => app.granted && safeAppOrigin(app));\r\n}\r\n\r\nexport async function listGrantedDispatchMcpAppOrigins(): Promise<string[]> {\r\n  const apps = await listGrantedDispatchMcpApps();\r\n  return Array.from(new Set(apps.flatMap((app) => safeAppOrigin(app) ?? [])));\r\n}\r\n\r\nexport async function resolveGrantedDispatchMcpApp(\r\n  app: string,\r\n): Promise<DispatchMcpAccessibleApp> {\r\n  const target = normalizeAppId(app);\r\n  if (!target) throw new Error(\"app is required\");\r\n  const { apps } = await listDispatchMcpApps();\r\n  const match = apps.find(\r\n    (candidate) =>\r\n      candidate.id === target || candidate.name.toLowerCase() === target,\r\n  );\r\n  if (!match) {\r\n    throw new Error(\r\n      `Unknown app \"${app}\". Call list_apps to see apps available through Dispatch MCP.`,\r\n    );\r\n  }\r\n  if (!match.granted) {\r\n    throw new Error(\r\n      `Dispatch MCP access to \"${match.id}\" is not granted. Open Dispatch > Agents to change MCP app access.`,\r\n    );\r\n  }\r\n  if (!safeAppOrigin(match)) {\r\n    throw new Error(\r\n      `Dispatch MCP app \"${match.id}\" has an invalid URL and cannot be opened through MCP.`,\r\n    );\r\n  }\r\n  return match;\r\n}\r\n\r\nexport async function askGrantedDispatchMcpApp(\r\n  app: string,\r\n  message: string,\r\n): Promise<{ app: string; routedVia: \"a2a\"; response: string }> {\r\n  const trimmedMessage = message.trim();\r\n  if (!trimmedMessage) throw new Error(\"message is required\");\r\n  const target = await resolveGrantedDispatchMcpApp(app);\r\n  const userEmail = getRequestUserEmail();\r\n  if (!userEmail) throw new Error(\"no authenticated user\");\r\n\r\n  const orgId = getRequestOrgId();\r\n  const [orgDomain, orgSecret] = orgId\r\n    ? await Promise.all([\r\n        getOrgDomain(orgId).catch(() => null),\r\n        getOrgA2ASecret(orgId).catch(() => null),\r\n      ])\r\n    : [null, null];\r\n\r\n  const response = await callAgent(target.url, trimmedMessage, {\r\n    userEmail,\r\n    orgDomain: orgDomain ?? undefined,\r\n    orgSecret: orgSecret ?? undefined,\r\n    timeoutMs: 5 * 60_000,\r\n  });\r\n  return { app: target.id, routedVia: \"a2a\", response };\r\n}\r\n\r\nexport async function openGrantedDispatchMcpApp(input: {\r\n  app: string;\r\n  view?: string;\r\n  path?: string;\r\n  params?: Record<string, string | number | boolean>;\r\n  embed?: boolean;\r\n  chrome?: \"full\" | \"minimal\";\r\n}): Promise<{\r\n  app: string;\r\n  view?: string;\r\n  path?: string;\r\n  url: string;\r\n  embed?: boolean;\r\n  chrome?: \"full\" | \"minimal\";\r\n  embedStartUrl?: string;\r\n  embedTargetPath?: string;\r\n  embedExpiresAt?: number;\r\n}> {\r\n  const view = input.view?.trim() ?? \"\";\r\n  const hasPathInput = input.path != null;\r\n  const path = safeAppPath(input.path);\r\n  if (hasPathInput && !path) {\r\n    throw new Error(\"path must be a safe app-relative route\");\r\n  }\r\n  if (!view && !path) throw new Error(\"open_app requires view or path\");\r\n  const target = await resolveGrantedDispatchMcpApp(input.app);\r\n  if (path) assertAppCanOpenPath(target, path);\r\n  const relUrl = path\r\n    ? appendParamsToPath(path, input.params)\r\n    : buildDeepLink({\r\n        app: target.id,\r\n        view,\r\n        params: input.params,\r\n      });\r\n  const url = `${appBaseUrl(target)}${relUrl}`;\r\n  let embedSession: Awaited<\r\n    ReturnType<typeof createGrantedDispatchMcpEmbedSession>\r\n  > | null = null;\r\n  if (input.embed) {\r\n    try {\r\n      embedSession = await createGrantedDispatchMcpEmbedSession({\r\n        app: target.id,\r\n        url,\r\n        chrome: input.chrome,\r\n      });\r\n    } catch (error) {\r\n      console.warn(\r\n        `[dispatch] Could not pre-mint MCP embed session for ${target.id}:`,\r\n        error,\r\n      );\r\n    }\r\n  }\r\n  return {\r\n    app: target.id,\r\n    ...(view ? { view } : {}),\r\n    ...(path ? { path } : {}),\r\n    url,\r\n    ...(input.embed === true ? { embed: true } : {}),\r\n    ...(input.chrome ? { chrome: input.chrome } : {}),\r\n    ...(embedSession?.startUrl ? { embedStartUrl: embedSession.startUrl } : {}),\r\n    ...(embedSession?.targetPath\r\n      ? { embedTargetPath: embedSession.targetPath }\r\n      : {}),\r\n    ...(typeof embedSession?.expiresAt === \"number\"\r\n      ? { embedExpiresAt: embedSession.expiresAt }\r\n      : {}),\r\n  };\r\n}\r\n\r\nfunction parseMcpToolTextResult(result: unknown): Record<string, unknown> {\r\n  if (result && typeof result === \"object\") {\r\n    const structured = (result as any).structuredContent;\r\n    if (structured && typeof structured === \"object\") return structured;\r\n    const parts = Array.isArray((result as any).content)\r\n      ? ((result as any).content as Array<Record<string, unknown>>)\r\n      : [];\r\n    const text = parts.find(\r\n      (part) => part?.type === \"text\" && typeof part.text === \"string\",\r\n    )?.text;\r\n    if (typeof text === \"string\" && text.trim()) {\r\n      if ((result as any).isError) throw new Error(text.trim());\r\n      const parsed = JSON.parse(text);\r\n      if (parsed && typeof parsed === \"object\") return parsed;\r\n    }\r\n  }\r\n  throw new Error(\"Target app did not return an embed session.\");\r\n}\r\n\r\nfunction sleep(ms: number): Promise<void> {\r\n  return new Promise((resolve) => setTimeout(resolve, ms));\r\n}\r\n\r\nfunction isRetryableTargetMcpError(error: unknown): boolean {\r\n  const message =\r\n    error instanceof Error\r\n      ? error.message\r\n      : typeof error === \"string\"\r\n        ? error\r\n        : String(error ?? \"\");\r\n  if (\r\n    /rejected the request|unauthorized|forbidden|401|403|404|405|html/i.test(\r\n      message,\r\n    )\r\n  ) {\r\n    return false;\r\n  }\r\n  return /streamable http|handshake|failed to fetch|fetch failed|networkerror|econnrefused|enotfound|timed out|timeout|502|503|504/i.test(\r\n    message,\r\n  );\r\n}\r\n\r\nfunction targetMcpRetryDelay(attempt: number): number {\r\n  const base =\r\n    TARGET_EMBED_SESSION_RETRY_BASE_MS * Math.pow(2, Math.max(0, attempt - 1));\r\n  return base + Math.floor(Math.random() * 100);\r\n}\r\n\r\nasync function callTargetCreateEmbedSession(input: {\r\n  app: DispatchMcpAccessibleApp;\r\n  token: string;\r\n  url: string;\r\n  chrome?: \"full\" | \"minimal\";\r\n}): Promise<unknown> {\r\n  const serverId = \"target\";\r\n  for (let attempt = 1; ; attempt += 1) {\r\n    const manager = new McpClientManager({\r\n      servers: {\r\n        [serverId]: {\r\n          type: \"http\",\r\n          url: `${appBaseUrl(input.app)}/_agent-native/mcp`,\r\n          headers: {\r\n            Authorization: `Bearer ${input.token}`,\r\n          },\r\n        },\r\n      },\r\n    });\r\n    try {\r\n      await manager.start();\r\n      return await manager.callTool(\r\n        buildMcpToolName(serverId, \"create_embed_session\"),\r\n        {\r\n          url: input.url,\r\n          chrome: input.chrome ?? \"full\",\r\n        },\r\n      );\r\n    } catch (error) {\r\n      if (\r\n        attempt >= TARGET_EMBED_SESSION_ATTEMPTS ||\r\n        !isRetryableTargetMcpError(error)\r\n      ) {\r\n        throw error;\r\n      }\r\n      await sleep(targetMcpRetryDelay(attempt));\r\n    } finally {\r\n      await manager.stop().catch((stopError) => {\r\n        console.warn(\"[dispatch] Failed to stop target MCP client:\", stopError);\r\n      });\r\n    }\r\n  }\r\n}\r\n\r\nasync function resolveDispatchEmbedTarget(input: {\r\n  app?: string;\r\n  url?: string;\r\n  path?: string;\r\n}): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\r\n  const explicitApp = input.app?.trim()\r\n    ? await resolveGrantedDispatchMcpApp(input.app)\r\n    : null;\r\n  if (explicitApp && input.path) {\r\n    const path = safeAppPath(input.path);\r\n    if (!path) throw new Error(\"path must be a safe app-relative route\");\r\n    assertAppCanOpenPath(explicitApp, path);\r\n    return {\r\n      app: explicitApp,\r\n      path,\r\n      url: `${appBaseUrl(explicitApp)}${path}`,\r\n    };\r\n  }\r\n\r\n  if (!input.url) {\r\n    throw new Error(\"create_embed_session requires a url or app + path.\");\r\n  }\r\n\r\n  let parsed: URL;\r\n  try {\r\n    parsed = new URL(input.url);\r\n  } catch {\r\n    if (!explicitApp) {\r\n      throw new Error(\"Relative embed paths require an app id.\");\r\n    }\r\n    const path = safeAppPath(input.url);\r\n    if (!path) throw new Error(\"url must be a safe app route.\");\r\n    return {\r\n      app: explicitApp,\r\n      path,\r\n      url: `${appBaseUrl(explicitApp)}${path}`,\r\n    };\r\n  }\r\n\r\n  const apps = explicitApp ? [explicitApp] : await listGrantedDispatchMcpApps();\r\n  const target = apps\r\n    .filter((app) => appMatchesUrlPath(app, parsed))\r\n    .sort((a, b) => appPathSpecificity(b) - appPathSpecificity(a))[0];\r\n  if (!target) {\r\n    throw new Error(\r\n      \"Embed URL must belong to an app granted through Dispatch.\",\r\n    );\r\n  }\r\n  const path = safeAppPath(appRelativePath(target, parsed));\r\n  if (!path) throw new Error(\"Embed URL path is not safe.\");\r\n  assertAppCanOpenPath(target, path);\r\n  return { app: target, path, url: `${appBaseUrl(target)}${path}` };\r\n}\r\n\r\nasync function createDispatchSelfEmbedSession(input: {\r\n  ownerEmail: string;\r\n  orgId?: string;\r\n  path: string;\r\n  baseUrl: string;\r\n  chrome?: \"full\" | \"minimal\";\r\n}): Promise<{\r\n  startUrl: string;\r\n  targetPath?: string;\r\n  expiresAt?: number;\r\n  app: string;\r\n}> {\r\n  const ticket = await createEmbedSessionTicket({\r\n    ownerEmail: input.ownerEmail,\r\n    orgId: input.orgId,\r\n    targetPath: input.path,\r\n    scope: input.chrome ?? null,\r\n  });\r\n  const startPath = buildEmbedStartPath(ticket.ticket);\r\n  return {\r\n    startUrl: new URL(startPath, input.baseUrl).toString(),\r\n    targetPath: input.path,\r\n    expiresAt: ticket.expiresAt,\r\n    app: DISPATCH_APP_ID,\r\n  };\r\n}\r\n\r\nexport async function createGrantedDispatchMcpEmbedSession(input: {\r\n  app?: string;\r\n  url?: string;\r\n  path?: string;\r\n  chrome?: \"full\" | \"minimal\";\r\n}): Promise<{\r\n  startUrl: string;\r\n  targetPath?: string;\r\n  expiresAt?: number;\r\n  app: string;\r\n}> {\r\n  const userEmail = getRequestUserEmail();\r\n  if (!userEmail) throw new Error(\"no authenticated user\");\r\n  const target = await resolveDispatchEmbedTarget(input);\r\n\r\n  const orgId = getRequestOrgId();\r\n  if (target.app.id === DISPATCH_APP_ID) {\r\n    return createDispatchSelfEmbedSession({\r\n      ownerEmail: userEmail,\r\n      orgId,\r\n      path: target.path,\r\n      baseUrl: appBaseUrl(target.app),\r\n      chrome: input.chrome,\r\n    });\r\n  }\r\n\r\n  const [orgDomain, orgSecret] = orgId\r\n    ? await Promise.all([\r\n        getOrgDomain(orgId).catch(() => null),\r\n        getOrgA2ASecret(orgId).catch(() => null),\r\n      ])\r\n    : [null, null];\r\n  const usableOrgSecret =\r\n    typeof orgSecret === \"string\" && orgSecret.trim().length > 0;\r\n  const usableOrgDomain =\r\n    typeof orgDomain === \"string\" && orgDomain.trim().length > 0;\r\n  const useOrgSigning = usableOrgDomain && usableOrgSecret;\r\n  const signedOrgDomain = usableOrgDomain ? orgDomain.trim() : undefined;\r\n  const token = await signA2AToken(\r\n    userEmail,\r\n    signedOrgDomain,\r\n    useOrgSigning ? orgSecret.trim() : undefined,\r\n    {\r\n      expiresIn: \"5m\",\r\n      // Prefer the synced org A2A secret when present because first-party\r\n      // production apps do not have to share the same deployment env secret.\r\n      // Fall back to the global A2A_SECRET for orgs that have not synced yet.\r\n      preferGlobalSecret: !useOrgSigning,\r\n    },\r\n  );\r\n\r\n  const result = await callTargetCreateEmbedSession({\r\n    app: target.app,\r\n    token,\r\n    url: target.url,\r\n    chrome: input.chrome,\r\n  });\r\n  const parsed = parseMcpToolTextResult(result) as {\r\n    startUrl?: string;\r\n    targetPath?: string;\r\n    expiresAt?: number;\r\n  };\r\n  if (!parsed.startUrl) {\r\n    throw new Error(\"Target app did not return an embed start URL.\");\r\n  }\r\n  const output: {\r\n    startUrl: string;\r\n    targetPath?: string;\r\n    expiresAt?: number;\r\n    app: string;\r\n  } = {\r\n    startUrl: parsed.startUrl,\r\n    app: target.app.id,\r\n  };\r\n  if (parsed.targetPath) output.targetPath = parsed.targetPath;\r\n  if (typeof parsed.expiresAt === \"number\") output.expiresAt = parsed.expiresAt;\r\n  return output;\r\n}\r\n"]}

package/dist/server/lib/onboarding-steps.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Dispatch-specific onboarding steps.
+ *
+ * Slack/Telegram/etc. are auto-registered at order 60 by the framework when
+ * their env keys are declared `required: true` in `env-config.ts`. Without
+ * any earlier dispatch-specific step, a brand-new workspace lands on
+ * "Connect Slack" as the first visible to-do — which is intimidating before
+ * the user has even created a real app. This step nudges them at adding
+ * their first workspace app first.
+ */
+export declare function registerDispatchOnboardingSteps(): void;
+//# sourceMappingURL=onboarding-steps.d.ts.map

package/dist/server/lib/onboarding-steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-steps.d.ts","sourceRoot":"","sources":["../../../src/server/lib/onboarding-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,wBAAgB,+BAA+B,IAAI,IAAI,CAgCtD"}