@jami-studio/dispatch 0.13.14

package/dist/server/lib/vault-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-store.js","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,cAAc,GAEf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AACnE,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAwBpE;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CACf,KAAQ,EACR,GAAa;IAEb,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;iDAEiD;AACjD,SAAS,SAAS,CAAC,GAGlB;IACC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,QAAkB;IAC9D,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI;QAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;KAC5B,EAAE,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAA4C,KAAQ;IACvE,OAAO,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5D,OAAO,EAAE,KAAK,EAAE,MAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,GACP,KAAK,CAAC,KAAK,KAAK,KAAK;QACnB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAC/D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EACL,IAAI,CAAC,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,2CAA2C;QACjD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,qEAAqE;AAErE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAOtC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QAC3C,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAK,GAAG,EAAE;IAC7C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;SACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;SAC7C,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,qEAAqE;AAErE,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAa;IAC7D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAMC,EACD,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;aAC3B,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;QAEJ,MAAM,gBAAgB,CAAC;YACrB,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;YAC5D,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC;YAChB,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;SACnE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAE7B,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa;QACb,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;QAC5D,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;KACnE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,KAQK,EACL,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/B,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;IAC7B,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC5E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI;QAC3B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE3B,IAAI,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,qBAAqB,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC3B,GAAG,CAAC;QACH,IAAI;QACJ,aAAa;QACb,KAAK;QACL,QAAQ;QACR,WAAW;QACX,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;IAEJ,MAAM,aAAa,GAAG;QACpB,IAAI;QACJ,YAAY,EAAE,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,aAAa;QACb,qBAAqB,EACnB,aAAa,KAAK,QAAQ,CAAC,aAAa;YACtC,CAAC,CAAC,QAAQ,CAAC,aAAa;YACxB,CAAC,CAAC,SAAS;QACf,QAAQ;QACR,gBAAgB,EACd,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAChE,WAAW;QACX,mBAAmB,EACjB,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACzE,YAAY,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC;IAEF,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,IAAI,MAAM,aAAa,GAAG;QACtD,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,IAAI,MAAM,aAAa,GAAG;QAC5D,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,MAAM,mCAAmC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC7D,QAAQ,CAAC,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,mCAAmC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEnD,iCAAiC;IACjC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;IACJ,MAAM,mCAAmC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;QAC7D,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,aAAa,GAAG;KACzE,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,aAAa,GAAG;KAC/E,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oEAAoE;AAEpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAGhC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAQ,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAQ,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAE7B,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACzC,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,QAAQ;QACR,KAAK;QACL,OAAO,EAAE,YAAY,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,aAAa,QAAQ,KAAK,EAAE;QACzE,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,yBAAyB,MAAM,CAAC,IAAI,QAAQ,KAAK,EAAE;KAC7D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAmB,EACnB,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,eAAe;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CACzD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CACrC,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;SAC5C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF,CAAC;IAEJ,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,WAAW,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,KAAK,EAAE;QACjF,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,yBAAyB,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,KAAK,EAAE;KACxF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAAC,GAAa;IAI3D,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,GAAa;IAEb,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QACrD,MAAM,cAAc,CAAC;YACnB,GAAG,EAAE,MAAM,CAAC,aAAa;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,GAAG,6BAA6B,IAAI,MAAM,CAAC,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,GAAa,EACb,aAAwB;IAExB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,aAAa;QACxB,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,6BAA6B,CAAC,CAC9D;aACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,EAC1C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC;gBACpB,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,+BAA+B,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,4BAA4B,CAC5D,aAAa,EACb,GAAG,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,aAAa;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC,CAAC;IACJ,IAAI,UAGoC,CAAC;IAEzC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,uCAAuC;IACvC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,UAAU,GAAG;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8DAA8D;SACvE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,KAAK,CAAC,GAAG,yBAAyB,EACrC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAChC,UAAU,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;gBAC1D,UAAU,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG;gBACX,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,wEAAwE;IACxE,wEAAwE;IACxE,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;iBAC1B,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;iBAClD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,KAAK;QACL,OAAO,EAAE,UAAU,UAAU,CAAC,MAAM,iBAAiB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtF,QAAQ,EAAE;YACR,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,eAAe,EAAE;gBACf,KAAK,EAAE,mBAAmB,CAAC,KAAK;gBAChC,OAAO,EAAE,mBAAmB,CAAC,OAAO;aACrC;YACD,OAAO,EAAE,UAAU;SACpB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE;YACf,KAAK,EAAE,mBAAmB,CAAC,KAAK;YAChC,OAAO,EAAE,mBAAmB,CAAC,OAAO;YACpC,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM;SACxC;QACD,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA4B;IAC7D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAQ,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACpC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAInC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAElC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QAC3C,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,GAAG,KAAK,cAAc,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;QACvE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;KAC9C,CAAC,CAAC;IAEH,MAAM,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE9C,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,WAAmB,EACnB,UAAmB,EACnB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAEhC,qDAAqD;IACrD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACpC,CACF,CAAC;IAEJ,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtC,uEAAuE;IACvE,MAAM,eAAe,GAAG,MAAM,EAAE;SAC7B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,EAC5D,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAC1C,CACF,CAAC;IACJ,IAAI,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAExC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,YAAY,CACzB;YACE,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,aAAa;SAC1C,EACD,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,oDAAoD;QACpD,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,YAAY,OAAO,CAAC,aAAa,QAAQ,OAAO,CAAC,KAAK,kBAAkB,OAAO,CAAC,WAAW,GAAG;QACvG,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;KAClC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,MAAsB,EACtB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAEhC,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACpC,CACF,CAAC;IAEJ,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,UAAU,OAAO,CAAC,aAAa,QAAQ,OAAO,CAAC,KAAK,kBAAkB,OAAO,CAAC,WAAW,GAAG;QACrG,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;KAC1C,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IAEpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,KAAK,CAAC,GAAG,2BAA2B,EACvC;gBACE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,YAAY,EAAE,EAAE;oBAChB,eAAe,EAAE,MAAM,CAAC,IAAI;oBAC5B,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAKV,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEtB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CACrD,CAAC;YACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnE,MAAM,YAAY,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChD,OAAO;oBACL,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EACV,CAAC,CAAC,cAAc;wBAChB,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;4BACzB,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC5C,aAAa,EAAE,cAAc,EAAE,EAAE;iBAClC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,KAAK,CAAC,IAAI;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY;gBACZ,eAAe,EAAE,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,KAAK,CAAC,IAAI;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,EAAE;gBAChB,eAAe,EAAE,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AAEpE,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,WAAW,EAAE;QACb,UAAU,EAAE;QACZ,YAAY,EAAE;QACd,sBAAsB,EAAE;KACzB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAE5E,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,gBAAgB,EACd,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;QAChE,gBAAgB;QAChB,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;KAC3E,CAAC;AACJ,CAAC;AAED,oEAAoE;AAEpE,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,KAAuE;IAEvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IAExC,oEAAoE;IACpE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE/C,MAAM,IAAI,GAAG;QACX,mBAAmB,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;QAC3D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7C,iBAAiB,iBAAiB,EAAE,EAAE;QACtC,EAAE;QACF,mBAAmB,MAAM,QAAQ;KAClC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,EAAE,kBAAkB,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;iBACpE;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9C,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\r\n\r\nimport { and, desc, eq, isNull, or } from \"@agent-native/core/db/schema\";\r\nimport { ssrfSafeFetch } from \"@agent-native/core/extensions/url-safety\";\r\nimport {\r\n  deleteAppSecret,\r\n  listAppSecretsForScope,\r\n  writeAppSecret,\r\n  type SecretScope,\r\n} from \"@agent-native/core/secrets\";\r\nimport { discoverAgents } from \"@agent-native/core/server/agent-discovery\";\r\nimport {\r\n  getOrgSetting,\r\n  getUserSetting,\r\n  putOrgSetting,\r\n  putUserSetting,\r\n} from \"@agent-native/core/settings\";\r\n\r\nimport { getDb, schema } from \"../../db/index.js\";\r\nimport {\r\n  currentOwnerEmail,\r\n  currentOrgId,\r\n  recordAudit,\r\n} from \"./dispatch-store.js\";\r\n\r\nconst VAULT_ACCESS_SETTINGS_KEY = \"dispatch-vault-access-settings\";\r\nconst VAULT_SYNC_DESCRIPTION_PREFIX = \"Synced from Dispatch vault:\";\r\n\r\nexport type VaultAccessMode = \"all-apps\" | \"manual\";\r\n\r\nexport interface VaultAccessSettings {\r\n  mode: VaultAccessMode;\r\n  scope: \"org\" | \"user\";\r\n  scopeId: string;\r\n}\r\n\r\n/**\r\n * Caller-supplied access context for vault operations.\r\n *\r\n * Every getSecret / updateSecret / deleteSecret / createGrant call must\r\n * pass the ctx of the *current request* so the row is scoped to that\r\n * caller's tenant. Looking up a vault secret by id alone is unsafe — UUIDs\r\n * are not authorization. A row matches the ctx if either the caller owns\r\n * it or it lives in the caller's active org.\r\n */\r\nexport interface VaultCtx {\r\n  ownerEmail: string;\r\n  orgId: string | null;\r\n}\r\n\r\n/**\r\n * Build a VaultCtx from the current request. Throws if the request is\r\n * unauthenticated — the previous behavior of falling back to \"local@localhost\"\r\n * leaked rows across tenants when a misconfigured environment skipped auth.\r\n */\r\nexport function requireVaultCtx(): VaultCtx {\r\n  const ownerEmail = currentOwnerEmail();\r\n  if (!ownerEmail) {\r\n    throw new Error(\"Vault operation requires an authenticated user\");\r\n  }\r\n  return { ownerEmail, orgId: currentOrgId() };\r\n}\r\n\r\n/** WHERE clause that limits a vault row to the caller's ownership scope. */\r\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\r\n  table: T,\r\n  ctx: VaultCtx,\r\n) {\r\n  if (!ctx.orgId) {\r\n    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\r\n  }\r\n  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\r\n}\r\n\r\n/** Build a ctx that scopes to a specific row's owner/org (used when a\r\n * request approver acts on behalf of the original requester so the\r\n * created secret lands in the request's org). */\r\nfunction ctxForRow(row: {\r\n  ownerEmail: string;\r\n  orgId: string | null;\r\n}): VaultCtx {\r\n  return { ownerEmail: row.ownerEmail, orgId: row.orgId };\r\n}\r\n\r\nfunction ctxForSecretRow(row: VaultSecretRow, fallback: VaultCtx): VaultCtx {\r\n  return row.ownerEmail ? ctxForRow(row) : fallback;\r\n}\r\n\r\nfunction id() {\r\n  return crypto.randomUUID();\r\n}\r\n\r\nfunction now() {\r\n  return Date.now();\r\n}\r\n\r\nfunction safeJson(value: unknown) {\r\n  return JSON.stringify(value ?? null);\r\n}\r\n\r\nfunction workspaceBaseOrigins(): Set<string> {\r\n  const out = new Set<string>();\r\n  for (const value of [\r\n    process.env.WORKSPACE_GATEWAY_URL,\r\n    process.env.APP_URL,\r\n    process.env.URL,\r\n    process.env.DEPLOY_URL,\r\n    process.env.BETTER_AUTH_URL,\r\n  ]) {\r\n    if (!value) continue;\r\n    try {\r\n      out.add(new URL(value).origin);\r\n    } catch {\r\n      // Ignore malformed deploy metadata.\r\n    }\r\n  }\r\n  return out;\r\n}\r\n\r\nexport function isTrustedEnvVarSyncAgentUrl(agentUrl: string): boolean {\r\n  let parsed: URL;\r\n  try {\r\n    parsed = new URL(agentUrl);\r\n  } catch {\r\n    return false;\r\n  }\r\n  const hostname = parsed.hostname.toLowerCase();\r\n  if (\r\n    hostname === \"localhost\" ||\r\n    hostname === \"127.0.0.1\" ||\r\n    hostname === \"::1\" ||\r\n    hostname.endsWith(\".localhost\")\r\n  ) {\r\n    return true;\r\n  }\r\n  return workspaceBaseOrigins().has(parsed.origin);\r\n}\r\n\r\nfunction scopedFilter<T extends { ownerEmail: any; orgId: any }>(table: T) {\r\n  return ctxScope(table, requireVaultCtx());\r\n}\r\n\r\nfunction normalizeCredentialKey(value: string) {\r\n  return value.trim();\r\n}\r\n\r\nfunction vaultAccessScope() {\r\n  const orgId = currentOrgId();\r\n  if (orgId) return { scope: \"org\" as const, scopeId: orgId };\r\n  return { scope: \"user\" as const, scopeId: currentOwnerEmail() };\r\n}\r\n\r\nfunction parseVaultAccessMode(value: unknown): VaultAccessMode {\r\n  return value === \"manual\" ? \"manual\" : \"all-apps\";\r\n}\r\n\r\nexport async function getVaultAccessSettings(): Promise<VaultAccessSettings> {\r\n  const scope = vaultAccessScope();\r\n  const raw =\r\n    scope.scope === \"org\"\r\n      ? await getOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY)\r\n      : await getUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY);\r\n  return {\r\n    ...scope,\r\n    mode: parseVaultAccessMode(raw?.mode),\r\n  };\r\n}\r\n\r\nexport async function setVaultAccessSettings(input: {\r\n  mode: VaultAccessMode;\r\n}): Promise<VaultAccessSettings> {\r\n  const scope = vaultAccessScope();\r\n  const next = { mode: parseVaultAccessMode(input.mode) };\r\n  if (scope.scope === \"org\") {\r\n    await putOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);\r\n  } else {\r\n    await putUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);\r\n  }\r\n  await recordAudit({\r\n    action: \"vault.access-settings.updated\",\r\n    targetType: \"vault-settings\",\r\n    targetId: VAULT_ACCESS_SETTINGS_KEY,\r\n    summary:\r\n      next.mode === \"all-apps\"\r\n        ? \"Set vault access to all workspace apps\"\r\n        : \"Set vault access to manual per-app grants\",\r\n    metadata: next,\r\n  });\r\n  return getVaultAccessSettings();\r\n}\r\n\r\n// ─── Vault Audit ──────────────────────────────────────────────────\r\n\r\nexport async function recordVaultAudit(input: {\r\n  action: string;\r\n  secretId?: string | null;\r\n  appId?: string | null;\r\n  summary: string;\r\n  metadata?: unknown;\r\n  actor?: string;\r\n}) {\r\n  const db = getDb();\r\n  await db.insert(schema.vaultAuditLog).values({\r\n    id: id(),\r\n    ownerEmail: currentOwnerEmail(),\r\n    orgId: currentOrgId(),\r\n    secretId: input.secretId || null,\r\n    appId: input.appId || null,\r\n    action: input.action,\r\n    actor: input.actor || currentOwnerEmail(),\r\n    summary: input.summary,\r\n    metadata: input.metadata ? safeJson(input.metadata) : null,\r\n    createdAt: now(),\r\n  });\r\n}\r\n\r\nexport async function listVaultAudit(limit = 50) {\r\n  const db = getDb();\r\n  return db\r\n    .select()\r\n    .from(schema.vaultAuditLog)\r\n    .where(scopedFilter(schema.vaultAuditLog))\r\n    .orderBy(desc(schema.vaultAuditLog.createdAt))\r\n    .limit(limit);\r\n}\r\n\r\n// ─── Secrets ──────────────────────────────────────────────────────\r\n\r\nexport async function listSecrets() {\r\n  const db = getDb();\r\n  return db\r\n    .select()\r\n    .from(schema.vaultSecrets)\r\n    .where(scopedFilter(schema.vaultSecrets))\r\n    .orderBy(desc(schema.vaultSecrets.updatedAt));\r\n}\r\n\r\nexport async function getSecret(secretId: string, ctx: VaultCtx) {\r\n  const db = getDb();\r\n  const [row] = await db\r\n    .select()\r\n    .from(schema.vaultSecrets)\r\n    .where(\r\n      and(\r\n        eq(schema.vaultSecrets.id, secretId),\r\n        ctxScope(schema.vaultSecrets, ctx),\r\n      ),\r\n    )\r\n    .limit(1);\r\n  return row ?? null;\r\n}\r\n\r\nexport async function createSecret(\r\n  input: {\r\n    credentialKey: string;\r\n    value: string;\r\n    name: string;\r\n    provider?: string | null;\r\n    description?: string | null;\r\n  },\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const timestamp = now();\r\n  const credentialKey = normalizeCredentialKey(input.credentialKey);\r\n  if (!credentialKey) throw new Error(\"Credential key is required\");\r\n  const existing = await db\r\n    .select()\r\n    .from(schema.vaultSecrets)\r\n    .where(\r\n      and(\r\n        eq(schema.vaultSecrets.credentialKey, credentialKey),\r\n        ctxScope(schema.vaultSecrets, ctx),\r\n      ),\r\n    )\r\n    .orderBy(desc(schema.vaultSecrets.updatedAt))\r\n    .limit(1);\r\n\r\n  if (existing[0]) {\r\n    await db\r\n      .update(schema.vaultSecrets)\r\n      .set({\r\n        name: input.name,\r\n        credentialKey,\r\n        value: input.value,\r\n        provider: input.provider || null,\r\n        description: input.description || null,\r\n        updatedAt: timestamp,\r\n      })\r\n      .where(\r\n        and(\r\n          eq(schema.vaultSecrets.id, existing[0].id),\r\n          ctxScope(schema.vaultSecrets, ctx),\r\n        ),\r\n      );\r\n\r\n    await recordVaultAudit({\r\n      action: \"secret.updated\",\r\n      secretId: existing[0].id,\r\n      summary: `Updated secret \"${input.name}\" (${credentialKey})`,\r\n      metadata: { credentialKey, provider: input.provider },\r\n    });\r\n\r\n    await recordAudit({\r\n      action: \"vault.secret.updated\",\r\n      targetType: \"vault-secret\",\r\n      targetId: existing[0].id,\r\n      summary: `Updated vault secret \"${input.name}\" (${credentialKey})`,\r\n    });\r\n\r\n    const updated = await getSecret(existing[0].id, ctx);\r\n    if (updated) {\r\n      await syncSecretsToCredentialStore(\r\n        [updated],\r\n        ctxForSecretRow(updated, ctx),\r\n      );\r\n    }\r\n    return updated;\r\n  }\r\n\r\n  const secretId = id();\r\n  const actor = ctx.ownerEmail;\r\n\r\n  await db.insert(schema.vaultSecrets).values({\r\n    id: secretId,\r\n    ownerEmail: actor,\r\n    orgId: ctx.orgId,\r\n    name: input.name,\r\n    credentialKey,\r\n    value: input.value,\r\n    provider: input.provider || null,\r\n    description: input.description || null,\r\n    createdBy: actor,\r\n    createdAt: timestamp,\r\n    updatedAt: timestamp,\r\n  });\r\n\r\n  await recordVaultAudit({\r\n    action: \"secret.created\",\r\n    secretId,\r\n    summary: `Created secret \"${input.name}\" (${credentialKey})`,\r\n    metadata: { credentialKey, provider: input.provider },\r\n  });\r\n\r\n  await recordAudit({\r\n    action: \"vault.secret.created\",\r\n    targetType: \"vault-secret\",\r\n    targetId: secretId,\r\n    summary: `Created vault secret \"${input.name}\" (${credentialKey})`,\r\n  });\r\n\r\n  const created = await getSecret(secretId, ctx);\r\n  if (created) {\r\n    await syncSecretsToCredentialStore(\r\n      [created],\r\n      ctxForSecretRow(created, ctx),\r\n    );\r\n  }\r\n  return created;\r\n}\r\n\r\nexport async function updateSecret(\r\n  secretId: string,\r\n  input:\r\n    | string\r\n    | {\r\n        credentialKey?: string;\r\n        value?: string;\r\n        name?: string;\r\n        provider?: string | null;\r\n        description?: string | null;\r\n      },\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const existing = await getSecret(secretId, ctx);\r\n  if (!existing) throw new Error(\"Secret not found\");\r\n  const patch = typeof input === \"string\" ? { value: input } : input;\r\n  const credentialKey =\r\n    patch.credentialKey !== undefined\r\n      ? normalizeCredentialKey(patch.credentialKey)\r\n      : existing.credentialKey;\r\n  if (!credentialKey) throw new Error(\"Credential key is required\");\r\n  const name = patch.name !== undefined ? patch.name.trim() : existing.name;\r\n  if (!name) throw new Error(\"Secret name is required\");\r\n  const value = patch.value !== undefined ? patch.value : existing.value;\r\n  if (!value) throw new Error(\"Secret value is required\");\r\n  const provider =\r\n    patch.provider !== undefined ? patch.provider || null : existing.provider;\r\n  const description =\r\n    patch.description !== undefined\r\n      ? patch.description || null\r\n      : existing.description;\r\n\r\n  if (credentialKey !== existing.credentialKey) {\r\n    const conflict = await db\r\n      .select({ id: schema.vaultSecrets.id })\r\n      .from(schema.vaultSecrets)\r\n      .where(\r\n        and(\r\n          eq(schema.vaultSecrets.credentialKey, credentialKey),\r\n          ctxScope(schema.vaultSecrets, ctx),\r\n        ),\r\n      )\r\n      .limit(1);\r\n    if (conflict[0] && conflict[0].id !== secretId) {\r\n      throw new Error(`Credential key \"${credentialKey}\" is already in use`);\r\n    }\r\n  }\r\n\r\n  await db\r\n    .update(schema.vaultSecrets)\r\n    .set({\r\n      name,\r\n      credentialKey,\r\n      value,\r\n      provider,\r\n      description,\r\n      updatedAt: now(),\r\n    })\r\n    .where(\r\n      and(\r\n        eq(schema.vaultSecrets.id, secretId),\r\n        ctxScope(schema.vaultSecrets, ctx),\r\n      ),\r\n    );\r\n\r\n  const auditMetadata = {\r\n    name,\r\n    previousName: name !== existing.name ? existing.name : undefined,\r\n    credentialKey,\r\n    previousCredentialKey:\r\n      credentialKey !== existing.credentialKey\r\n        ? existing.credentialKey\r\n        : undefined,\r\n    provider,\r\n    previousProvider:\r\n      provider !== existing.provider ? existing.provider : undefined,\r\n    description,\r\n    previousDescription:\r\n      description !== existing.description ? existing.description : undefined,\r\n    valueChanged: value !== existing.value ? true : undefined,\r\n  };\r\n\r\n  await recordVaultAudit({\r\n    action: \"secret.updated\",\r\n    secretId,\r\n    summary: `Updated secret \"${name}\" (${credentialKey})`,\r\n    metadata: auditMetadata,\r\n  });\r\n\r\n  await recordAudit({\r\n    action: \"vault.secret.updated\",\r\n    targetType: \"vault-secret\",\r\n    targetId: secretId,\r\n    summary: `Updated vault secret \"${name}\" (${credentialKey})`,\r\n    metadata: auditMetadata,\r\n  });\r\n\r\n  const updated = await getSecret(secretId, ctx);\r\n  if (updated) {\r\n    await syncSecretsToCredentialStore(\r\n      [updated],\r\n      ctxForSecretRow(updated, ctx),\r\n    );\r\n  }\r\n  if (updated && credentialKey !== existing.credentialKey) {\r\n    await cleanupSyncedCredentialKeysIfUnused(ctxForRow(existing), [\r\n      existing.credentialKey,\r\n    ]);\r\n  } else if (updated && patch.credentialKey !== undefined) {\r\n    await cleanupSyncedCredentialKeysIfUnused(ctxForSecretRow(updated, ctx));\r\n  }\r\n  return updated;\r\n}\r\n\r\nexport async function deleteSecret(\r\n  secretId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const existing = await getSecret(secretId, ctx);\r\n  if (!existing) throw new Error(\"Secret not found\");\r\n\r\n  // Revoke all active grants first\r\n  const grants = await listGrants({ secretId });\r\n  for (const grant of grants) {\r\n    if (grant.status === \"active\") {\r\n      await revokeGrant(grant.id, ctx);\r\n    }\r\n  }\r\n\r\n  await db\r\n    .delete(schema.vaultSecrets)\r\n    .where(\r\n      and(\r\n        eq(schema.vaultSecrets.id, secretId),\r\n        ctxScope(schema.vaultSecrets, ctx),\r\n      ),\r\n    );\r\n  await cleanupSyncedCredentialKeysIfUnused(ctxForRow(existing), [\r\n    existing.credentialKey,\r\n  ]);\r\n\r\n  await recordVaultAudit({\r\n    action: \"secret.deleted\",\r\n    secretId,\r\n    summary: `Deleted secret \"${existing.name}\" (${existing.credentialKey})`,\r\n  });\r\n\r\n  await recordAudit({\r\n    action: \"vault.secret.deleted\",\r\n    targetType: \"vault-secret\",\r\n    targetId: secretId,\r\n    summary: `Deleted vault secret \"${existing.name}\" (${existing.credentialKey})`,\r\n  });\r\n\r\n  return existing;\r\n}\r\n\r\n// ─── Grants ──────────────────────────────────────────────────────\r\n\r\nexport async function listGrants(filter?: {\r\n  secretId?: string;\r\n  appId?: string;\r\n}) {\r\n  const db = getDb();\r\n  const conditions = [scopedFilter(schema.vaultGrants)];\r\n  if (filter?.secretId) {\r\n    conditions.push(eq(schema.vaultGrants.secretId, filter.secretId) as any);\r\n  }\r\n  if (filter?.appId) {\r\n    conditions.push(eq(schema.vaultGrants.appId, filter.appId) as any);\r\n  }\r\n  return db\r\n    .select()\r\n    .from(schema.vaultGrants)\r\n    .where(and(...conditions))\r\n    .orderBy(desc(schema.vaultGrants.updatedAt));\r\n}\r\n\r\nexport async function getGrant(\r\n  grantId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const [row] = await db\r\n    .select()\r\n    .from(schema.vaultGrants)\r\n    .where(\r\n      and(\r\n        eq(schema.vaultGrants.id, grantId),\r\n        ctxScope(schema.vaultGrants, ctx),\r\n      ),\r\n    )\r\n    .limit(1);\r\n  return row ?? null;\r\n}\r\n\r\nexport async function createGrant(\r\n  secretId: string,\r\n  appId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const secret = await getSecret(secretId, ctx);\r\n  if (!secret) throw new Error(\"Secret not found\");\r\n\r\n  const timestamp = now();\r\n  const grantId = id();\r\n  const actor = ctx.ownerEmail;\r\n\r\n  await db.insert(schema.vaultGrants).values({\r\n    id: grantId,\r\n    ownerEmail: actor,\r\n    orgId: ctx.orgId,\r\n    secretId,\r\n    appId,\r\n    grantedBy: actor,\r\n    status: \"active\",\r\n    syncedAt: null,\r\n    createdAt: timestamp,\r\n    updatedAt: timestamp,\r\n  });\r\n\r\n  await recordVaultAudit({\r\n    action: \"grant.created\",\r\n    secretId,\r\n    appId,\r\n    summary: `Granted \"${secret.name}\" (${secret.credentialKey}) to ${appId}`,\r\n    metadata: { grantId },\r\n  });\r\n\r\n  await recordAudit({\r\n    action: \"vault.grant.created\",\r\n    targetType: \"vault-grant\",\r\n    targetId: grantId,\r\n    summary: `Granted vault secret \"${secret.name}\" to ${appId}`,\r\n  });\r\n\r\n  return getGrant(grantId);\r\n}\r\n\r\nexport async function grantSecretsToApp(\r\n  secretIds: string[],\r\n  appId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const access = await getVaultAccessSettings();\r\n  const uniqueSecretIds = Array.from(new Set(secretIds));\r\n  if (access.mode === \"all-apps\") {\r\n    return {\r\n      appId,\r\n      accessMode: access.mode,\r\n      created: [],\r\n      skipped: uniqueSecretIds,\r\n    };\r\n  }\r\n  const existingActive = (await listGrants({ appId })).filter(\r\n    (grant) => grant.status === \"active\",\r\n  );\r\n  const existingSecretIds = new Set(\r\n    existingActive.map((grant) => grant.secretId),\r\n  );\r\n  const created = [];\r\n  const skipped: string[] = [];\r\n\r\n  for (const secretId of uniqueSecretIds) {\r\n    if (existingSecretIds.has(secretId)) {\r\n      skipped.push(secretId);\r\n      continue;\r\n    }\r\n    const grant = await createGrant(secretId, appId, ctx);\r\n    if (grant) {\r\n      created.push(grant);\r\n      existingSecretIds.add(secretId);\r\n    }\r\n  }\r\n\r\n  return { appId, accessMode: access.mode, created, skipped };\r\n}\r\n\r\nexport async function revokeGrant(\r\n  grantId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const grant = await getGrant(grantId, ctx);\r\n  if (!grant) throw new Error(\"Grant not found\");\r\n\r\n  const secret = await getSecret(grant.secretId, ctx);\r\n\r\n  await db\r\n    .update(schema.vaultGrants)\r\n    .set({ status: \"revoked\", updatedAt: now() })\r\n    .where(\r\n      and(\r\n        eq(schema.vaultGrants.id, grantId),\r\n        ctxScope(schema.vaultGrants, ctx),\r\n      ),\r\n    );\r\n\r\n  await recordVaultAudit({\r\n    action: \"grant.revoked\",\r\n    secretId: grant.secretId,\r\n    appId: grant.appId,\r\n    summary: `Revoked ${secret?.credentialKey || grant.secretId} from ${grant.appId}`,\r\n    metadata: { grantId },\r\n  });\r\n\r\n  await recordAudit({\r\n    action: \"vault.grant.revoked\",\r\n    targetType: \"vault-grant\",\r\n    targetId: grantId,\r\n    summary: `Revoked vault secret \"${secret?.name || grant.secretId}\" from ${grant.appId}`,\r\n  });\r\n\r\n  return getGrant(grantId, ctx);\r\n}\r\n\r\n// ─── Shared Credential Store Sync ─────────────────────────────────\r\n\r\ntype VaultSecretRow = typeof schema.vaultSecrets.$inferSelect;\r\n\r\nexport function credentialStoreScopeForVaultCtx(ctx: VaultCtx): {\r\n  scope: Extract<SecretScope, \"org\" | \"workspace\">;\r\n  scopeId: string;\r\n} {\r\n  if (ctx.orgId) return { scope: \"org\", scopeId: ctx.orgId };\r\n  return { scope: \"workspace\", scopeId: `solo:${ctx.ownerEmail}` };\r\n}\r\n\r\nexport async function syncSecretsToCredentialStore(\r\n  secrets: VaultSecretRow[],\r\n  ctx: VaultCtx,\r\n) {\r\n  const target = credentialStoreScopeForVaultCtx(ctx);\r\n  const syncedKeys: string[] = [];\r\n\r\n  for (const secret of secrets) {\r\n    if (!secret.credentialKey || !secret.value) continue;\r\n    await writeAppSecret({\r\n      key: secret.credentialKey,\r\n      value: secret.value,\r\n      scope: target.scope,\r\n      scopeId: target.scopeId,\r\n      description: `${VAULT_SYNC_DESCRIPTION_PREFIX} ${secret.name}`,\r\n    });\r\n    syncedKeys.push(secret.credentialKey);\r\n  }\r\n\r\n  return { ...target, keys: syncedKeys };\r\n}\r\n\r\nexport async function cleanupSyncedCredentialKeysIfUnused(\r\n  ctx: VaultCtx,\r\n  candidateKeys?: string[],\r\n) {\r\n  const db = getDb();\r\n  const target = credentialStoreScopeForVaultCtx(ctx);\r\n  const keys = candidateKeys\r\n    ? candidateKeys\r\n    : (await listAppSecretsForScope(target.scope, target.scopeId))\r\n        .filter((secret) =>\r\n          secret.description?.startsWith(VAULT_SYNC_DESCRIPTION_PREFIX),\r\n        )\r\n        .map((secret) => secret.key);\r\n\r\n  for (const key of new Set(keys.filter(Boolean))) {\r\n    const stillUsesKey = await db\r\n      .select({ id: schema.vaultSecrets.id })\r\n      .from(schema.vaultSecrets)\r\n      .where(\r\n        and(\r\n          eq(schema.vaultSecrets.credentialKey, key),\r\n          ctxScope(schema.vaultSecrets, ctx),\r\n        ),\r\n      )\r\n      .limit(1);\r\n    if (!stillUsesKey[0]) {\r\n      await deleteAppSecret({\r\n        key,\r\n        scope: target.scope,\r\n        scopeId: target.scopeId,\r\n      });\r\n    }\r\n  }\r\n}\r\n\r\n// ─── Sync ──────────────────────────────────────────────────────\r\n\r\nexport async function syncGrantsToApp(\r\n  appId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const access = await getVaultAccessSettings();\r\n  const agents = await discoverAgents(\"dispatch\");\r\n  const agent = agents.find((a) => a.id === appId);\r\n  if (!agent) throw new Error(`App \"${appId}\" not found in agent registry`);\r\n\r\n  const secretsToSync: VaultSecretRow[] = [];\r\n  const activeGrants =\r\n    access.mode === \"manual\"\r\n      ? (await listGrants({ appId })).filter((g) => g.status === \"active\")\r\n      : [];\r\n\r\n  if (access.mode === \"all-apps\") {\r\n    const secrets = await listSecrets();\r\n    for (const secret of secrets) {\r\n      secretsToSync.push(secret);\r\n    }\r\n  } else {\r\n    for (const grant of activeGrants) {\r\n      const secret = await getSecret(grant.secretId, ctx);\r\n      if (secret) {\r\n        secretsToSync.push(secret);\r\n      }\r\n    }\r\n  }\r\n\r\n  if (secretsToSync.length === 0) {\r\n    return { appId, accessMode: access.mode, synced: 0, keys: [] };\r\n  }\r\n\r\n  const credentialStoreSync = await syncSecretsToCredentialStore(\r\n    secretsToSync,\r\n    ctx,\r\n  );\r\n  const vars = secretsToSync.map((secret) => ({\r\n    key: secret.credentialKey,\r\n    value: secret.value,\r\n  }));\r\n  let envVarSync:\r\n    | { status: \"synced\"; keys: string[] }\r\n    | { status: \"skipped\"; reason: string }\r\n    | { status: \"failed\"; reason: string };\r\n\r\n  // Best-effort push to the app's env-vars endpoint for local/dev apps that\r\n  // still read process.env directly. Production/shared-DB apps intentionally\r\n  // reject env writes; the encrypted app_secrets sync above is the canonical\r\n  // path for request-scoped credentials.\r\n  if (!isTrustedEnvVarSyncAgentUrl(agent.url)) {\r\n    envVarSync = {\r\n      status: \"skipped\",\r\n      reason: \"env-var sync is limited to localhost or workspace-owned apps\",\r\n    };\r\n  } else {\r\n    try {\r\n      const res = await ssrfSafeFetch(\r\n        `${agent.url}/_agent-native/env-vars`,\r\n        {\r\n          method: \"POST\",\r\n          headers: { \"Content-Type\": \"application/json\" },\r\n          body: JSON.stringify({ vars }),\r\n          signal: AbortSignal.timeout(10_000),\r\n        },\r\n        { maxRedirects: 3 },\r\n      );\r\n\r\n      if (res.ok) {\r\n        const result = await res.json();\r\n        envVarSync = { status: \"synced\", keys: result.saved || [] };\r\n      } else {\r\n        const err = await res.text().catch(() => \"Unknown error\");\r\n        envVarSync = { status: \"skipped\", reason: err };\r\n      }\r\n    } catch (err) {\r\n      envVarSync = {\r\n        status: \"failed\",\r\n        reason: err instanceof Error ? err.message : String(err),\r\n      };\r\n    }\r\n  }\r\n\r\n  const syncedKeys = credentialStoreSync.keys;\r\n  const timestamp = now();\r\n\r\n  // Update syncedAt on grants that were successfully pushed to the shared\r\n  // credential store. All-apps mode has no explicit grant rows to update.\r\n  for (const grant of activeGrants) {\r\n    const secret = await getSecret(grant.secretId, ctx);\r\n    if (secret && syncedKeys.includes(secret.credentialKey)) {\r\n      await db\r\n        .update(schema.vaultGrants)\r\n        .set({ syncedAt: timestamp, updatedAt: timestamp })\r\n        .where(eq(schema.vaultGrants.id, grant.id));\r\n    }\r\n  }\r\n\r\n  await recordVaultAudit({\r\n    action: \"secret.synced\",\r\n    appId,\r\n    summary: `Synced ${syncedKeys.length} secret(s) to ${appId}: ${syncedKeys.join(\", \")}`,\r\n    metadata: {\r\n      syncedKeys,\r\n      accessMode: access.mode,\r\n      credentialStore: {\r\n        scope: credentialStoreSync.scope,\r\n        scopeId: credentialStoreSync.scopeId,\r\n      },\r\n      envVars: envVarSync,\r\n    },\r\n  });\r\n\r\n  return {\r\n    appId,\r\n    accessMode: access.mode,\r\n    synced: syncedKeys.length,\r\n    keys: syncedKeys,\r\n    credentialStore: {\r\n      scope: credentialStoreSync.scope,\r\n      scopeId: credentialStoreSync.scopeId,\r\n      synced: credentialStoreSync.keys.length,\r\n    },\r\n    envVars: envVarSync,\r\n  };\r\n}\r\n\r\n// ─── Requests ──────────────────────────────────────────────────────\r\n\r\nexport async function listRequests(filter?: { status?: string }) {\r\n  const db = getDb();\r\n  const conditions = [scopedFilter(schema.vaultRequests)];\r\n  if (filter?.status) {\r\n    conditions.push(eq(schema.vaultRequests.status, filter.status) as any);\r\n  }\r\n  return db\r\n    .select()\r\n    .from(schema.vaultRequests)\r\n    .where(and(...conditions))\r\n    .orderBy(desc(schema.vaultRequests.updatedAt));\r\n}\r\n\r\nexport async function getRequest(\r\n  requestId: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const [row] = await db\r\n    .select()\r\n    .from(schema.vaultRequests)\r\n    .where(\r\n      and(\r\n        eq(schema.vaultRequests.id, requestId),\r\n        ctxScope(schema.vaultRequests, ctx),\r\n      ),\r\n    )\r\n    .limit(1);\r\n  return row ?? null;\r\n}\r\n\r\nexport async function createRequest(input: {\r\n  credentialKey: string;\r\n  appId: string;\r\n  reason?: string | null;\r\n}) {\r\n  const db = getDb();\r\n  const timestamp = now();\r\n  const requestId = id();\r\n  const actor = currentOwnerEmail();\r\n\r\n  await db.insert(schema.vaultRequests).values({\r\n    id: requestId,\r\n    ownerEmail: actor,\r\n    orgId: currentOrgId(),\r\n    credentialKey: input.credentialKey,\r\n    appId: input.appId,\r\n    reason: input.reason || null,\r\n    requestedBy: actor,\r\n    status: \"pending\",\r\n    reviewedBy: null,\r\n    reviewedAt: null,\r\n    createdAt: timestamp,\r\n    updatedAt: timestamp,\r\n  });\r\n\r\n  await recordVaultAudit({\r\n    action: \"request.created\",\r\n    appId: input.appId,\r\n    summary: `${actor} requested ${input.credentialKey} for ${input.appId}`,\r\n    metadata: { requestId, reason: input.reason },\r\n  });\r\n\r\n  await notifyAdminsOfRequest(requestId, input);\r\n\r\n  return getRequest(requestId);\r\n}\r\n\r\nexport async function approveRequest(\r\n  requestId: string,\r\n  secretValue: string,\r\n  secretName?: string,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const request = await getRequest(requestId, ctx);\r\n  if (!request) throw new Error(\"Request not found\");\r\n  if (request.status !== \"pending\") {\r\n    throw new Error(\"Only pending requests can be approved\");\r\n  }\r\n\r\n  const timestamp = now();\r\n  const reviewer = ctx.ownerEmail;\r\n\r\n  // Update request status — scoped to caller's tenant.\r\n  await db\r\n    .update(schema.vaultRequests)\r\n    .set({\r\n      status: \"approved\",\r\n      reviewedBy: reviewer,\r\n      reviewedAt: timestamp,\r\n      updatedAt: timestamp,\r\n    })\r\n    .where(\r\n      and(\r\n        eq(schema.vaultRequests.id, requestId),\r\n        ctxScope(schema.vaultRequests, ctx),\r\n      ),\r\n    );\r\n\r\n  // Secret + grant must land in the REQUEST's tenant, not the approver's\r\n  // (the approver may be acting on behalf of another user in the same org).\r\n  const requestCtx = ctxForRow(request);\r\n\r\n  // Check if secret already exists in the request's tenant for this key.\r\n  const existingSecrets = await db\r\n    .select()\r\n    .from(schema.vaultSecrets)\r\n    .where(\r\n      and(\r\n        eq(schema.vaultSecrets.credentialKey, request.credentialKey),\r\n        ctxScope(schema.vaultSecrets, requestCtx),\r\n      ),\r\n    );\r\n  let secret = existingSecrets[0] ?? null;\r\n\r\n  if (!secret) {\r\n    secret = await createSecret(\r\n      {\r\n        credentialKey: request.credentialKey,\r\n        value: secretValue,\r\n        name: secretName || request.credentialKey,\r\n      },\r\n      requestCtx,\r\n    );\r\n  }\r\n\r\n  if (secret) {\r\n    // Create the grant in the request's tenant as well.\r\n    await createGrant(secret.id, request.appId, requestCtx);\r\n  }\r\n\r\n  await recordVaultAudit({\r\n    action: \"request.approved\",\r\n    appId: request.appId,\r\n    summary: `Approved ${request.credentialKey} for ${request.appId} (requested by ${request.requestedBy})`,\r\n    metadata: { requestId, reviewer },\r\n  });\r\n\r\n  return getRequest(requestId, ctx);\r\n}\r\n\r\nexport async function denyRequest(\r\n  requestId: string,\r\n  reason?: string | null,\r\n  ctx: VaultCtx = requireVaultCtx(),\r\n) {\r\n  const db = getDb();\r\n  const request = await getRequest(requestId, ctx);\r\n  if (!request) throw new Error(\"Request not found\");\r\n  if (request.status !== \"pending\") {\r\n    throw new Error(\"Only pending requests can be denied\");\r\n  }\r\n\r\n  const timestamp = now();\r\n  const reviewer = ctx.ownerEmail;\r\n\r\n  await db\r\n    .update(schema.vaultRequests)\r\n    .set({\r\n      status: \"denied\",\r\n      reviewedBy: reviewer,\r\n      reviewedAt: timestamp,\r\n      updatedAt: timestamp,\r\n    })\r\n    .where(\r\n      and(\r\n        eq(schema.vaultRequests.id, requestId),\r\n        ctxScope(schema.vaultRequests, ctx),\r\n      ),\r\n    );\r\n\r\n  await recordVaultAudit({\r\n    action: \"request.denied\",\r\n    appId: request.appId,\r\n    summary: `Denied ${request.credentialKey} for ${request.appId} (requested by ${request.requestedBy})`,\r\n    metadata: { requestId, reviewer, reason },\r\n  });\r\n\r\n  return getRequest(requestId, ctx);\r\n}\r\n\r\n// ─── Integrations Catalog ────────────────────────────────────────\r\n\r\nexport interface IntegrationEntry {\r\n  key: string;\r\n  label: string;\r\n  required: boolean;\r\n  configured: boolean;\r\n  vaultGranted: boolean;\r\n  vaultSecretId?: string;\r\n}\r\n\r\nexport interface AppIntegrations {\r\n  appId: string;\r\n  appName: string;\r\n  url: string;\r\n  color: string;\r\n  integrations: IntegrationEntry[];\r\n  vaultAccessMode: VaultAccessMode;\r\n  reachable: boolean;\r\n}\r\n\r\nexport async function listIntegrationsCatalog(): Promise<AppIntegrations[]> {\r\n  const access = await getVaultAccessSettings();\r\n  const agents = await discoverAgents(\"dispatch\");\r\n  const grants = await listGrants();\r\n  const secrets = await listSecrets();\r\n\r\n  const secretByKey = new Map(secrets.map((s) => [s.credentialKey, s]));\r\n\r\n  const results: AppIntegrations[] = [];\r\n\r\n  for (const agent of agents) {\r\n    try {\r\n      const res = await ssrfSafeFetch(\r\n        `${agent.url}/_agent-native/env-status`,\r\n        {\r\n          signal: AbortSignal.timeout(3000),\r\n        },\r\n        { maxRedirects: 3 },\r\n      );\r\n      if (!res.ok) {\r\n        results.push({\r\n          appId: agent.id,\r\n          appName: agent.name,\r\n          url: agent.url,\r\n          color: agent.color,\r\n          integrations: [],\r\n          vaultAccessMode: access.mode,\r\n          reachable: false,\r\n        });\r\n        continue;\r\n      }\r\n\r\n      const envStatus: Array<{\r\n        key: string;\r\n        label: string;\r\n        required: boolean;\r\n        configured: boolean;\r\n      }> = await res.json();\r\n\r\n      const appGrants = grants.filter(\r\n        (g) => g.appId === agent.id && g.status === \"active\",\r\n      );\r\n      const grantedSecretIds = new Set(appGrants.map((g) => g.secretId));\r\n\r\n      const integrations: IntegrationEntry[] = envStatus.map((env) => {\r\n        const matchingSecret = secretByKey.get(env.key);\r\n        return {\r\n          key: env.key,\r\n          label: env.label,\r\n          required: env.required,\r\n          configured: env.configured,\r\n          vaultGranted:\r\n            !!matchingSecret &&\r\n            (access.mode === \"all-apps\" ||\r\n              grantedSecretIds.has(matchingSecret.id)),\r\n          vaultSecretId: matchingSecret?.id,\r\n        };\r\n      });\r\n\r\n      results.push({\r\n        appId: agent.id,\r\n        appName: agent.name,\r\n        url: agent.url,\r\n        color: agent.color,\r\n        integrations,\r\n        vaultAccessMode: access.mode,\r\n        reachable: true,\r\n      });\r\n    } catch {\r\n      results.push({\r\n        appId: agent.id,\r\n        appName: agent.name,\r\n        url: agent.url,\r\n        color: agent.color,\r\n        integrations: [],\r\n        vaultAccessMode: access.mode,\r\n        reachable: false,\r\n      });\r\n    }\r\n  }\r\n\r\n  return results;\r\n}\r\n\r\n// ─── Vault Overview (for dashboard) ──────────────────────────────\r\n\r\nexport async function listVaultOverview() {\r\n  const [secrets, grants, requests, access] = await Promise.all([\r\n    listSecrets(),\r\n    listGrants(),\r\n    listRequests(),\r\n    getVaultAccessSettings(),\r\n  ]);\r\n  const manualGrantCount = grants.filter((g) => g.status === \"active\").length;\r\n\r\n  return {\r\n    accessMode: access.mode,\r\n    secretCount: secrets.length,\r\n    activeGrantCount:\r\n      access.mode === \"all-apps\" ? secrets.length : manualGrantCount,\r\n    manualGrantCount,\r\n    pendingRequestCount: requests.filter((r) => r.status === \"pending\").length,\r\n  };\r\n}\r\n\r\n// ─── SendGrid Notifications ──────────────────────────────────────\r\n\r\nasync function notifyAdminsOfRequest(\r\n  requestId: string,\r\n  input: { credentialKey: string; appId: string; reason?: string | null },\r\n) {\r\n  const apiKey = process.env.SENDGRID_API_KEY;\r\n  const from = process.env.SENDGRID_FROM_EMAIL;\r\n  const appUrl = process.env.APP_URL;\r\n  if (!apiKey || !from || !appUrl) return;\r\n\r\n  // Use approval policy approver emails as admin notification targets\r\n  const { getApprovalPolicy } = await import(\"./dispatch-store.js\");\r\n  const policy = await getApprovalPolicy();\r\n  if (policy.approverEmails.length === 0) return;\r\n\r\n  const body = [\r\n    `Secret request: ${input.credentialKey} for ${input.appId}`,\r\n    input.reason ? `Reason: ${input.reason}` : \"\",\r\n    `Requested by: ${currentOwnerEmail()}`,\r\n    \"\",\r\n    `Review it here: ${appUrl}/vault`,\r\n  ]\r\n    .filter(Boolean)\r\n    .join(\"\\n\");\r\n\r\n  await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\r\n    method: \"POST\",\r\n    headers: {\r\n      Authorization: `Bearer ${apiKey}`,\r\n      \"Content-Type\": \"application/json\",\r\n    },\r\n    body: JSON.stringify({\r\n      personalizations: [\r\n        {\r\n          to: policy.approverEmails.map((email) => ({ email })),\r\n          subject: `Vault request: ${input.credentialKey} for ${input.appId}`,\r\n        },\r\n      ],\r\n      from: { email: from },\r\n      content: [{ type: \"text/plain\", value: body }],\r\n      custom_args: { requestId },\r\n    }),\r\n  }).catch(() => {});\r\n}\r\n"]}

package/dist/server/lib/workspace-resources-store.d.ts

@@ -0,0 +1,358 @@
+import { type EffectiveResourceLayer, type ResourceInheritanceScope, type ResourceMeta } from "@agent-native/core/resources/store";
+/**
+ * Caller-supplied access context for workspace-resource operations.
+ * Same shape and semantics as VaultCtx — looking up a row by id alone is
+ * unsafe because UUIDs are not authorization. A row matches the ctx if
+ * either the caller owns it or it lives in the caller's active org.
+ */
+export interface WorkspaceResourceCtx {
+    ownerEmail: string;
+    orgId: string | null;
+}
+export declare function requireWorkspaceResourceCtx(): WorkspaceResourceCtx;
+export type WorkspaceResourceKind = "skill" | "instruction" | "agent" | "knowledge" | "mcp-server";
+export type WorkspaceResourceScope = "all" | "selected";
+export interface WorkspaceResourceInput {
+    kind: WorkspaceResourceKind;
+    name: string;
+    description?: string | null;
+    path: string;
+    content: string;
+    scope: WorkspaceResourceScope;
+}
+export interface WorkspaceResourceOption {
+    id: string;
+    kind: WorkspaceResourceKind;
+    name: string;
+    description: string | null;
+    path: string;
+    scope: WorkspaceResourceScope;
+    updatedAt: number;
+}
+export interface WorkspaceResourceForApp extends WorkspaceResourceOption {
+    source: "workspace" | "grant";
+    autoLoaded: boolean;
+    grantId: string | null;
+}
+export type WorkspaceResourceAvailability = "all-apps" | "selected-granted" | "selected-not-granted" | "selected-no-app" | "path-not-managed";
+export interface WorkspaceResourceEffectiveLayer extends Omit<EffectiveResourceLayer, "scope"> {
+    scope: ResourceInheritanceScope;
+    resource: ResourceMeta | null;
+}
+export interface WorkspaceResourceEffectiveContext {
+    appId: string | null;
+    userEmail: string;
+    path: string;
+    workspaceResource: WorkspaceResourceOption | null;
+    availability: WorkspaceResourceAvailability;
+    availableToApp: boolean;
+    activeGrantId: string | null;
+    effectiveScope: ResourceInheritanceScope | null;
+    effectiveResource: ResourceMeta | null;
+    layers: WorkspaceResourceEffectiveLayer[];
+}
+export type WorkspaceResourceChangeOperation = "create" | "update" | "delete";
+export interface WorkspaceResourceOverrideImpact {
+    scope: "shared" | "personal";
+    owner: string;
+    label: string;
+    updatedAt: number;
+}
+export interface WorkspaceResourceChangeImpact {
+    operation: WorkspaceResourceChangeOperation;
+    path: string | null;
+    resourceId: string | null;
+    beforeScope: WorkspaceResourceScope | null;
+    afterScope: WorkspaceResourceScope | null;
+    affectsAllApps: boolean;
+    affectedApps: {
+        label: string;
+        count: number | null;
+        apps: Array<{
+            id: string;
+            name: string;
+        }>;
+    };
+    overrides: {
+        count: number;
+        sharedCount: number;
+        personalCount: number;
+        items: WorkspaceResourceOverrideImpact[];
+    };
+    approval: {
+        policyEnabled: boolean;
+        willRequestApproval: boolean;
+    };
+}
+export declare const STARTER_GLOBAL_WORKSPACE_RESOURCES: WorkspaceResourceInput[];
+export declare function ensureStarterWorkspaceResources(ctx?: WorkspaceResourceCtx): Promise<void>;
+export declare function restoreStarterWorkspaceResources(input?: {
+    paths?: string[];
+}): Promise<{
+    restored: WorkspaceResourceOption[];
+    existing: WorkspaceResourceOption[];
+    unknown: string[];
+}>;
+export declare function listWorkspaceResources(filter?: {
+    kind?: string;
+}): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+}[]>;
+export declare function listWorkspaceResourceOptions(filter?: {
+    kind?: string;
+}): Promise<WorkspaceResourceOption[]>;
+export declare function listWorkspaceResourcesForApp(appId: string): Promise<{
+    appId: string;
+    resources: WorkspaceResourceForApp[];
+    counts: {
+        total: number;
+        workspace: number;
+        global: number;
+        granted: number;
+        autoLoaded: number;
+    };
+}>;
+export declare function previewWorkspaceResourceChange(input: {
+    operation?: WorkspaceResourceChangeOperation;
+    resourceId?: string;
+    path?: string;
+    scope?: WorkspaceResourceScope;
+}): Promise<WorkspaceResourceChangeImpact>;
+export declare function getWorkspaceResourceEffectiveContext(input: {
+    resourceId?: string;
+    path?: string;
+    appId?: string | null;
+    userEmail?: string | null;
+}): Promise<WorkspaceResourceEffectiveContext>;
+export declare function getWorkspaceResource(resourceId: string, ctx?: WorkspaceResourceCtx): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function applyWorkspaceResourceCreate(input: WorkspaceResourceInput, actor?: string, ctx?: WorkspaceResourceCtx): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function createWorkspaceResource(input: WorkspaceResourceInput): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+} | {
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    changeType: string;
+    targetType: string;
+    targetId: string | null;
+    status: string;
+    summary: string;
+    payload: string;
+    beforeValue: string | null;
+    afterValue: string | null;
+    requestedBy: string;
+    reviewedBy: string | null;
+    reviewedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function applyWorkspaceResourceUpdate(resourceId: string, input: Partial<Pick<WorkspaceResourceInput, "name" | "description" | "content" | "scope">>, actor?: string, ctx?: WorkspaceResourceCtx): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function updateWorkspaceResource(resourceId: string, input: Partial<Pick<WorkspaceResourceInput, "name" | "description" | "content" | "scope">>): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+} | {
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    changeType: string;
+    targetType: string;
+    targetId: string | null;
+    status: string;
+    summary: string;
+    payload: string;
+    beforeValue: string | null;
+    afterValue: string | null;
+    requestedBy: string;
+    reviewedBy: string | null;
+    reviewedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function applyWorkspaceResourceDelete(resourceId: string, actor?: string, ctx?: WorkspaceResourceCtx): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function deleteWorkspaceResource(resourceId: string): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    kind: string;
+    name: string;
+    description: string | null;
+    path: string;
+    content: string;
+    scope: string;
+    createdBy: string;
+    createdAt: number;
+    updatedAt: number;
+} | {
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    changeType: string;
+    targetType: string;
+    targetId: string | null;
+    status: string;
+    summary: string;
+    payload: string;
+    beforeValue: string | null;
+    afterValue: string | null;
+    requestedBy: string;
+    reviewedBy: string | null;
+    reviewedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function listResourceGrants(filter?: {
+    resourceId?: string;
+    appId?: string;
+}): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    resourceId: string;
+    appId: string;
+    status: string;
+    syncedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}[]>;
+export declare function getResourceGrant(grantId: string, ctx?: WorkspaceResourceCtx): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    resourceId: string;
+    appId: string;
+    status: string;
+    syncedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function createResourceGrant(resourceId: string, appId: string): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    resourceId: string;
+    appId: string;
+    status: string;
+    syncedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function grantWorkspaceResourcesToApp(input: {
+    appId: string;
+    resourceIds: string[];
+}): Promise<{
+    appId: string;
+    granted: {
+        id: string;
+        resourceId: string;
+        appId: string;
+    }[];
+    skipped: {
+        resourceId: string;
+        reason: string;
+    }[];
+}>;
+export declare function revokeResourceGrant(grantId: string, ctx?: WorkspaceResourceCtx): Promise<{
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    resourceId: string;
+    appId: string;
+    status: string;
+    syncedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}>;
+export declare function listWorkspaceResourcesOverview(): Promise<{
+    skillCount: number;
+    instructionCount: number;
+    agentCount: number;
+    knowledgeCount: number;
+    mcpServerCount: number;
+    totalResources: number;
+    activeGrantCount: number;
+}>;
+//# sourceMappingURL=workspace-resources-store.d.ts.map

package/dist/server/lib/workspace-resources-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-resources-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/workspace-resources-store.ts"],"names":[],"mappings":"AAIA,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,YAAY,EAClB,MAAM,oCAAoC,CAAC;AAkB5C;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,2BAA2B,IAAI,oBAAoB,CAGlE;AA0ID,MAAM,MAAM,qBAAqB,GAC7B,OAAO,GACP,aAAa,GACb,OAAO,GACP,WAAW,GACX,YAAY,CAAC;AACjB,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,UAAU,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,sBAAsB,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,6BAA6B,GACrC,UAAU,GACV,kBAAkB,GAClB,sBAAsB,GACtB,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,+BAAgC,SAAQ,IAAI,CAC3D,sBAAsB,EACtB,OAAO,CACR;IACC,KAAK,EAAE,wBAAwB,CAAC;IAChC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,6BAA6B,CAAC;IAC5C,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAChD,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,+BAA+B,EAAE,CAAC;CAC3C;AAED,MAAM,MAAM,gCAAgC,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9E,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,gCAAgC,CAAC;IAC5C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC3C,UAAU,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3C,CAAC;IACF,SAAS,EAAE;QACT,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,+BAA+B,EAAE,CAAC;KAC1C,CAAC;IACF,QAAQ,EAAE;QACR,aAAa,EAAE,OAAO,CAAC;QACvB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,CAAC;CACH;AAMD,eAAO,MAAM,kCAAkC,EAAE,sBAAsB,EAwMtE,CAAC;AAiGF,wBAAsB,+BAA+B,CACnD,GAAG,GAAE,oBAAoD,iBAY1D;AAyBD,wBAAsB,gCAAgC,CAAC,KAAK,CAAC,EAAE;IAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;;;;GAiDA;AAED,wBAAsB,sBAAsB,CAAC,MAAM,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;KActE;AAED,wBAAsB,4BAA4B,CAAC,MAAM,CAAC,EAAE;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAWrC;AASD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,uBAAuB,EAAE,CAAC;IACrC,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC,CAmDD;AAuHD,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,SAAS,CAAC,EAAE,gCAAgC,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAmDzC;AAED,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAsD7C;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,oBAAoD;;;;;;;;;;;;;GAc1D;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,sBAAsB,EAC7B,KAAK,SAAsB,EAC3B,GAAG,GAAE,oBAAoD;;;;;;;;;;;;;GAkC1D;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkB1E;AAED,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,OAAO,CACZ,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,CAC3E,EACD,KAAK,SAAsB,EAC3B,GAAG,GAAE,oBAAoD;;;;;;;;;;;;;GAoC1D;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,OAAO,CACZ,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,CAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuBF;AAED,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,KAAK,SAAsB,EAC3B,GAAG,GAAE,oBAAoD;;;;;;;;;;;;;GAoC1D;AAED,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqB/D;AAID,wBAAsB,kBAAkB,CAAC,MAAM,CAAC,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;;;;;;;;;;KAkBA;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,oBAAoD;;;;;;;;;;GAc1D;AAED,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;GAqC1E;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;;;YAM4B,MAAM;oBAAc,MAAM;eAAS,MAAM;;;oBACjC,MAAM;gBAAU,MAAM;;GAwB1D;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,oBAAoD;;;;;;;;;;GA0B1D;AAID,wBAAsB,8BAA8B;;;;;;;;GAsBnD"}