@onepointfour-packs/flaredeck-agent 0.2.38 → 0.2.40

package/dist/credentials.d.ts

@@ -0,0 +1,217 @@
+/**
+ * Credentials an agent uses, kept in FlareDeck and NOWHERE ELSE.
+ *
+ * The complaint this answers: setting up an agent meant setting up its credentials, one box at a
+ * time. Connect Sceneflo. Connect Cnjure. Connect Jam. Sign in to the site under test. Then do it
+ * all again on the next machine, and again when the token expires. At twenty agents that is not a
+ * setup cost, it is a standing job.
+ *
+ * The ones that hurt most are the ones a machine cannot regenerate. A browser sign-in session is
+ * minutes of a person's time and sometimes a code from their phone, and it used to live in
+ * exactly one `~/.config/flaredeck-agent/browser/` — so the next agent that needed the same site
+ * signed in again from scratch, and the one after that did too.
+ *
+ * NOTHING IS WRITTEN TO THIS MACHINE. Not a copy, not a cache, not a fallback. That is a
+ * deliberate reversal of how this module was first built, and the reason is that a cache quietly
+ * undoes the entire point: twenty machines each holding a copy of a credential is the situation
+ * being escaped, and a "fallback" is just that situation with a nicer name. It also means
+ * revocation is honest — one write in FlareDeck and the next read anywhere returns nothing, with
+ * no window during which some disconnected box is still using what it had.
+ *
+ * The price is paid openly: an agent that cannot reach FlareDeck cannot open a signed-in page,
+ * and must say so rather than carrying on with something stale. `get` therefore distinguishes
+ * "there is no session" from "I could not ask", because those call for different behaviour — the
+ * first means request a sign-in, the second means stop and report.
+ *
+ * The other thing this module refuses to do is throw. A credential store that throws turns "I
+ * could not reach FlareDeck" into a failed card. Every path here resolves to an outcome.
+ */
+export type CredentialKind = 'browser-session' | 'mcp-server' | 'token' | 'oauth'
+/**
+ * A central secret that is NEVER handed to an agent — a GitHub App's private key, say. It
+ * exists so FlareDeck can MINT short-lived, narrowly scoped credentials from it on request.
+ * The server refuses to serve one of these through the ordinary read path, which is the point:
+ * see "the two patterns" in docs/credential-store.md.
+ */
+ | 'app-key';
+export type CredentialMeta = {
+    id: string;
+    kind: CredentialKind;
+    label: string;
+    version: number;
+    state: 'active' | 'revoked';
+    bytes: number;
+};
+export type PutOptions = {
+    kind: CredentialKind;
+    /** What a person sees in the FlareDeck UI. Never a value, and never anything secret. */
+    label?: string;
+};
+/**
+ * The outcome of a read.
+ *
+ * `{ ok: true, value: null }` and `{ ok: false }` are emphatically not the same thing and the
+ * caller must not collapse them. The first means FlareDeck was asked and holds no session for
+ * this site, which is the normal case and the trigger for requesting a sign-in. The second means
+ * FlareDeck could not be asked, and the only correct response is to stop and say so — there is
+ * nothing on disk to fall back to, by design.
+ */
+export type Read = {
+    ok: true;
+    value: Buffer | null;
+} | {
+    ok: false;
+    why: string;
+};
+export type CredentialStore = {
+    get(id: string): Promise<Read>;
+    put(id: string, value: Buffer, opts: PutOptions): Promise<{
+        ok: boolean;
+        message?: string;
+    }>;
+    /** Metadata for everything this agent may read. Never a value. */
+    list(): Promise<CredentialMeta[]>;
+};
+/**
+ * What a signed-in site IS, centrally.
+ *
+ * The on-disk key was `<repo basename>/<part>` — `"App/ui"` — and the reasoning behind it is
+ * sound: every worktree serves the app on a different port, so a URL-keyed memory is empty on
+ * every card, while a given repo's `ui` is the same place on Tuesday as it was on Monday. What is
+ * wrong with it centrally is the subject, not the logic. "App/ui" on this machine and "App/ui" on
+ * another are the same project but say nothing about which SITE was signed in to, and a real
+ * site — Sceneflo, Cnjure, a staging box — is the same site from every machine.
+ *
+ * So both halves are kept and the subject changes:
+ *
+ *  · A real site is its HOST. `session:host:app.sceneflo.ai`. The port is dropped because cookies
+ *    ignore ports and a port is a deployment accident; the full host is kept because a session is
+ *    scoped to a host. Two agents on two machines that both need Sceneflo now land on one key,
+ *    which is the entire request.
+ *  · A local site is its PROJECT. `session:repo:App:ui` for anything on loopback or a private
+ *    address. There is no identity in `localhost:4301`; the identity is "this project's UI".
+ *
+ * The separator in the project form is a colon and not the slash the on-disk key used, because a
+ * credential id is a Firestore document id and a slash in one silently creates a subcollection
+ * somewhere nobody is looking. The server refuses it outright (`VALID_ID` in
+ * flaredeck-mcp/src/vault/store.ts), which is how this was caught: every local session wrote fine
+ * and came back 400 from FlareDeck.
+ *
+ * The tenant is not in the key — it is in the Firestore path and in the request URL, so putting
+ * it here would only create a second place for it to be wrong.
+ */
+export declare function siteCredentialId(repo: string, part: string, url?: string): string;
+/**
+ * Which site a saved session actually belongs to, read off the session itself.
+ *
+ * This exists so that `rememberSignIn` needs no new argument: its two callers are in `main.ts`
+ * and `serve.ts`, and those belong to somebody else. The session already knows where it came
+ * from, so asking it is both less code and harder to get wrong than threading a URL through.
+ *
+ * `_ss` first because `captureSessionStorage` records the origin of the page as it was when the
+ * session was taken — i.e. the app, after the sign-in redirect chain finished. `origins` is the
+ * fallback and needs the identity providers filtered out, because a Google sign-in leaves
+ * `accounts.google.com` in there and that is emphatically not the site being remembered.
+ *
+ * Returning undefined is a normal outcome, not a failure: the caller then keys by project.
+ */
+export declare function sessionOrigin(session: {
+    origins?: unknown[];
+    _ss?: {
+        origin?: string;
+    }[];
+} | null | undefined): string | undefined;
+export type FlaredeckStoreConfig = {
+    tenantId: string;
+    /** The agent's own access token. A function because it is refreshed as it expires. */
+    auth: () => Promise<string>;
+    baseUrl?: string;
+    /** The board being worked, when there is one — for board-scoped credentials and the audit row. */
+    board?: () => string | undefined;
+};
+export type RemoteRead = {
+    kind: 'value';
+    value: Buffer;
+    meta: CredentialMeta;
+} | {
+    kind: 'missing';
+} | {
+    kind: 'withheld';
+    message: string;
+} | {
+    kind: 'revoked';
+    message: string;
+} | {
+    kind: 'unreachable';
+    message: string;
+};
+/**
+ * The vault over HTTP.
+ *
+ * Returns a tagged outcome rather than a value-or-null because the failures are not the same
+ * thing and the caller treats them differently: `missing` and `revoked` mean request a sign-in,
+ * `withheld` means somebody deliberately said no, `unreachable` means stop.
+ */
+export declare class FlaredeckCredentials {
+    private readonly cfg;
+    constructor(cfg: FlaredeckStoreConfig);
+    private get base();
+    private url;
+    read(id: string): Promise<RemoteRead>;
+    write(id: string, value: Buffer, opts: PutOptions): Promise<{
+        ok: boolean;
+        message?: string;
+    }>;
+    list(): Promise<CredentialMeta[]>;
+}
+/**
+ * FlareDeck, and only FlareDeck.
+ *
+ * How many times this is called matters, because there is no cache to absorb it: once per
+ * `open_page`, which is a handful of times per card. That is deliberately cheaper than a cache
+ * would be to reason about — and it is what makes a rotation or a revoke take effect on the very
+ * next page an agent opens, anywhere, with nothing told to forget anything.
+ */
+export declare function vaultStore(remote: FlaredeckCredentials, onNote?: (text: string) => void): CredentialStore;
+/**
+ * The store for an agent with no FlareDeck login.
+ *
+ * Says why, every time, instead of silently behaving like an empty vault. The difference matters:
+ * an empty vault means "sign in to the site", while this means "this agent is not set up", and
+ * sending a person to sign in to a site over the second one wastes their time.
+ */
+export declare function unavailable(why: string): CredentialStore;
+/**
+ * The store for this checkout's agent, built from what is already on disk.
+ *
+ * Takes a repo path and nothing else on purpose. The browser tools are constructed from a
+ * `BrowserDeps` that has no FlareDeck client in it, and the places that build that object are
+ * several and belong to other work; threading a client through all of them to reach one call site
+ * would be a far bigger change than this feature deserves. The agent's login is in its config
+ * file, which is where every other command gets it from.
+ */
+export declare function credentialsFor(repo: string, onNote?: (text: string) => void, board?: () => string | undefined): CredentialStore;
+export declare function getJson<T>(store: CredentialStore, id: string): Promise<{
+    ok: true;
+    value: T | null;
+} | {
+    ok: false;
+    why: string;
+}>;
+export declare function putJson(store: CredentialStore, id: string, value: unknown, opts: PutOptions): Promise<{
+    ok: boolean;
+    message?: string;
+}>;
+/**
+ * Write a credential that cannot be regenerated cheaply, with retries.
+ *
+ * A captured sign-in has nowhere else to go — there is no local copy any more — so losing it to
+ * one network blip would cost a person another trip through a sign-in form, possibly with a code
+ * from their phone. Three attempts with a widening gap, then it gives up and says so loudly; the
+ * card then hits the sign-in wall again on its next look and the existing machinery asks for a
+ * fresh one, which is the same path an expired session takes.
+ */
+export declare function putInsistently(store: CredentialStore, id: string, value: Buffer, opts: PutOptions, onNote?: (text: string) => void, attempts?: number): Promise<{
+    ok: boolean;
+    message?: string;
+}>;

package/dist/credentials.js

@@ -0,0 +1,332 @@
+import { loadConfig, saveConfig } from './config.js';
+import { freshAccessToken } from './oauth.js';
+/**
+ * How long to wait on FlareDeck.
+ *
+ * Short on read: this is in the path of opening a page, and an agent waiting half a minute to be
+ * told "no" is worse than being told quickly. Long on write: a captured sign-in has nowhere else
+ * to go, so it is worth being patient for.
+ */
+const READ_TIMEOUT_MS = 10_000;
+const WRITE_TIMEOUT_MS = 60_000;
+// ---------------------------------------------------------------------------------------------
+// Identity
+const PRIVATE_HOST = /^(localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|\[?::1\]?|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|169\.254\.\d+\.\d+)$/i;
+const PRIVATE_SUFFIX = /\.(local|localhost|internal|test|lan|home)$/i;
+/**
+ * What a signed-in site IS, centrally.
+ *
+ * The on-disk key was `<repo basename>/<part>` — `"App/ui"` — and the reasoning behind it is
+ * sound: every worktree serves the app on a different port, so a URL-keyed memory is empty on
+ * every card, while a given repo's `ui` is the same place on Tuesday as it was on Monday. What is
+ * wrong with it centrally is the subject, not the logic. "App/ui" on this machine and "App/ui" on
+ * another are the same project but say nothing about which SITE was signed in to, and a real
+ * site — Sceneflo, Cnjure, a staging box — is the same site from every machine.
+ *
+ * So both halves are kept and the subject changes:
+ *
+ *  · A real site is its HOST. `session:host:app.sceneflo.ai`. The port is dropped because cookies
+ *    ignore ports and a port is a deployment accident; the full host is kept because a session is
+ *    scoped to a host. Two agents on two machines that both need Sceneflo now land on one key,
+ *    which is the entire request.
+ *  · A local site is its PROJECT. `session:repo:App:ui` for anything on loopback or a private
+ *    address. There is no identity in `localhost:4301`; the identity is "this project's UI".
+ *
+ * The separator in the project form is a colon and not the slash the on-disk key used, because a
+ * credential id is a Firestore document id and a slash in one silently creates a subcollection
+ * somewhere nobody is looking. The server refuses it outright (`VALID_ID` in
+ * flaredeck-mcp/src/vault/store.ts), which is how this was caught: every local session wrote fine
+ * and came back 400 from FlareDeck.
+ *
+ * The tenant is not in the key — it is in the Firestore path and in the request URL, so putting
+ * it here would only create a second place for it to be wrong.
+ */
+export function siteCredentialId(repo, part, url) {
+    const host = (() => {
+        if (!url)
+            return null;
+        try {
+            const h = new URL(url).hostname.replace(/^\[|\]$/g, '');
+            return PRIVATE_HOST.test(h) || PRIVATE_SUFFIX.test(h) ? null : h.toLowerCase();
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (host)
+        return `session:host:${host}`;
+    const project = repo.replace(/\/+$/, '').split('/').pop() || repo;
+    return `session:repo:${project}:${part || 'ui'}`;
+}
+/** Well-known identity providers, which are never the site that was signed IN to. */
+const IDP_HOST = /(^|\.)(accounts\.google\.com|login\.microsoftonline\.com|login\.live\.com|github\.com|auth0\.com|okta\.com|appleid\.apple\.com)$/i;
+/**
+ * Which site a saved session actually belongs to, read off the session itself.
+ *
+ * This exists so that `rememberSignIn` needs no new argument: its two callers are in `main.ts`
+ * and `serve.ts`, and those belong to somebody else. The session already knows where it came
+ * from, so asking it is both less code and harder to get wrong than threading a URL through.
+ *
+ * `_ss` first because `captureSessionStorage` records the origin of the page as it was when the
+ * session was taken — i.e. the app, after the sign-in redirect chain finished. `origins` is the
+ * fallback and needs the identity providers filtered out, because a Google sign-in leaves
+ * `accounts.google.com` in there and that is emphatically not the site being remembered.
+ *
+ * Returning undefined is a normal outcome, not a failure: the caller then keys by project.
+ */
+export function sessionOrigin(session) {
+    const ss = session?._ss?.find((o) => typeof o?.origin === 'string' && o.origin);
+    if (ss?.origin)
+        return ss.origin;
+    const origins = (session?.origins ?? [])
+        .map((o) => o?.origin)
+        .filter((o) => typeof o === 'string' && !!o)
+        .filter((o) => { try {
+        return !IDP_HOST.test(new URL(o).hostname);
+    }
+    catch {
+        return false;
+    } });
+    // Only when it is unambiguous. Two non-IdP origins means a guess, and a guess here splits one
+    // site's session across two keys, which is the exact problem this is meant to end.
+    return origins.length === 1 ? origins[0] : undefined;
+}
+/**
+ * The vault over HTTP.
+ *
+ * Returns a tagged outcome rather than a value-or-null because the failures are not the same
+ * thing and the caller treats them differently: `missing` and `revoked` mean request a sign-in,
+ * `withheld` means somebody deliberately said no, `unreachable` means stop.
+ */
+export class FlaredeckCredentials {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    get base() {
+        return (this.cfg.baseUrl ?? 'https://mcp.flaredeck.app/api').replace(/\/+$/, '');
+    }
+    url(id) {
+        const board = this.cfg.board?.();
+        return `${this.base}/v1/${encodeURIComponent(this.cfg.tenantId)}/credentials/${encodeURIComponent(id)}${board ? `?board=${encodeURIComponent(board)}` : ''}`;
+    }
+    async read(id) {
+        let res;
+        try {
+            res = await fetch(this.url(id), {
+                headers: { Authorization: `Bearer ${await this.cfg.auth()}` },
+                signal: AbortSignal.timeout(READ_TIMEOUT_MS),
+            });
+        }
+        catch (e) {
+            // A token refresh that failed lands here too, and it is the same situation from the agent's
+            // point of view: FlareDeck cannot be asked right now.
+            return { kind: 'unreachable', message: e instanceof Error ? e.message : String(e) };
+        }
+        const message = async () => {
+            const body = await res.json().catch(() => ({}));
+            return String(body?.message || `HTTP ${res.status}`);
+        };
+        if (res.status === 404)
+            return { kind: 'missing' };
+        if (res.status === 410)
+            return { kind: 'revoked', message: await message() };
+        if (res.status === 403)
+            return { kind: 'withheld', message: await message() };
+        if (!res.ok)
+            return { kind: 'unreachable', message: await message() };
+        const body = (await res.json().catch(() => null));
+        const value = Buffer.from(String(body?.value ?? ''), 'base64');
+        // An empty value is not a credential. Treating it as one would hand an empty session to a
+        // browser, which looks exactly like being signed out but without the sign-in being requested.
+        if (!value.length)
+            return { kind: 'unreachable', message: 'FlareDeck returned an empty credential' };
+        return {
+            kind: 'value',
+            value,
+            meta: {
+                id,
+                kind: body.kind ?? 'token',
+                label: String(body.label ?? id),
+                version: Number(body.version ?? 1),
+                state: body.state === 'revoked' ? 'revoked' : 'active',
+                bytes: Number(body.bytes ?? value.length),
+            },
+        };
+    }
+    async write(id, value, opts) {
+        try {
+            const res = await fetch(this.url(id), {
+                method: 'PUT',
+                headers: { Authorization: `Bearer ${await this.cfg.auth()}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    kind: opts.kind,
+                    ...(opts.label ? { label: opts.label } : {}),
+                    value: value.toString('base64'),
+                }),
+                signal: AbortSignal.timeout(WRITE_TIMEOUT_MS),
+            });
+            if (res.ok)
+                return { ok: true };
+            const body = await res.json().catch(() => ({}));
+            return { ok: false, message: String(body?.message || `HTTP ${res.status}`) };
+        }
+        catch (e) {
+            return { ok: false, message: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    async list() {
+        try {
+            const res = await fetch(`${this.base}/v1/${encodeURIComponent(this.cfg.tenantId)}/credentials`, {
+                headers: { Authorization: `Bearer ${await this.cfg.auth()}` },
+                signal: AbortSignal.timeout(READ_TIMEOUT_MS),
+            });
+            if (!res.ok)
+                return [];
+            const body = (await res.json());
+            return (body.credentials ?? []).map((c) => ({
+                id: String(c.id),
+                kind: c.kind ?? 'token',
+                label: String(c.label ?? c.id),
+                version: Number(c.version ?? 1),
+                state: c.state === 'revoked' ? 'revoked' : 'active',
+                bytes: Number(c.bytes ?? 0),
+            }));
+        }
+        catch {
+            return [];
+        }
+    }
+}
+// ---------------------------------------------------------------------------------------------
+// The store
+/**
+ * FlareDeck, and only FlareDeck.
+ *
+ * How many times this is called matters, because there is no cache to absorb it: once per
+ * `open_page`, which is a handful of times per card. That is deliberately cheaper than a cache
+ * would be to reason about — and it is what makes a rotation or a revoke take effect on the very
+ * next page an agent opens, anywhere, with nothing told to forget anything.
+ */
+export function vaultStore(remote, onNote = () => { }) {
+    return {
+        async get(id) {
+            const read = await remote.read(id);
+            switch (read.kind) {
+                case 'value':
+                    return { ok: true, value: read.value };
+                case 'missing':
+                    // Normal, and the trigger for requesting a sign-in. Not worth a note: it is what every
+                    // first visit to a site looks like.
+                    return { ok: true, value: null };
+                case 'revoked':
+                    onNote(`${id} was revoked in FlareDeck (${read.message}) — a fresh sign-in is needed.`);
+                    return { ok: true, value: null };
+                case 'withheld':
+                    onNote(`${id} is in FlareDeck but not for this agent: ${read.message}`);
+                    return { ok: true, value: null };
+                case 'unreachable':
+                    return { ok: false, why: read.message };
+            }
+        },
+        put: (id, value, opts) => remote.write(id, value, opts),
+        list: () => remote.list(),
+    };
+}
+/**
+ * The store for an agent with no FlareDeck login.
+ *
+ * Says why, every time, instead of silently behaving like an empty vault. The difference matters:
+ * an empty vault means "sign in to the site", while this means "this agent is not set up", and
+ * sending a person to sign in to a site over the second one wastes their time.
+ */
+export function unavailable(why) {
+    return {
+        async get() { return { ok: false, why }; },
+        async put() { return { ok: false, message: why }; },
+        async list() { return []; },
+    };
+}
+// ---------------------------------------------------------------------------------------------
+// Wiring
+/**
+ * The store for this checkout's agent, built from what is already on disk.
+ *
+ * Takes a repo path and nothing else on purpose. The browser tools are constructed from a
+ * `BrowserDeps` that has no FlareDeck client in it, and the places that build that object are
+ * several and belong to other work; threading a client through all of them to reach one call site
+ * would be a far bigger change than this feature deserves. The agent's login is in its config
+ * file, which is where every other command gets it from.
+ */
+export function credentialsFor(repo, onNote = () => { }, board) {
+    const config = loadConfig(repo);
+    const tenantId = config ? tenantOfConfig(config) : null;
+    if (!config?.oauth || !tenantId) {
+        return unavailable('this agent has no FlareDeck login, and credentials are only ever read from FlareDeck — run: flaredeck-agent login');
+    }
+    const origin = new URL(config.mcpUrl).origin;
+    return vaultStore(new FlaredeckCredentials({
+        tenantId,
+        baseUrl: `${origin}/api`,
+        auth: () => freshAccessToken(origin, config.oauth, (next) => {
+            config.oauth = next;
+            saveConfig(config);
+        }),
+        ...(board ? { board } : {}),
+    }), onNote);
+}
+/** The tenant the agent's own token is for. Same read as main.ts's `tenantOf`. */
+function tenantOfConfig(config) {
+    if (!config.oauth)
+        return config.tenantId ?? null;
+    try {
+        const part = config.oauth.accessToken.split('.')[1] ?? '';
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8')).tenantId ?? config.tenantId ?? null;
+    }
+    catch {
+        return config.tenantId ?? null;
+    }
+}
+// ---------------------------------------------------------------------------------------------
+// JSON, which is what everything stored here happens to be
+export async function getJson(store, id) {
+    const read = await store.get(id);
+    if (!read.ok)
+        return read;
+    if (!read.value)
+        return { ok: true, value: null };
+    try {
+        return { ok: true, value: JSON.parse(read.value.toString('utf8')) };
+    }
+    catch {
+        // A corrupt or truncated credential reads as "no credential", never as a throw: the caller's
+        // only sensible response is to sign in again, and that is also its response to not having one.
+        return { ok: true, value: null };
+    }
+}
+export function putJson(store, id, value, opts) {
+    return store.put(id, Buffer.from(JSON.stringify(value), 'utf8'), opts);
+}
+/**
+ * Write a credential that cannot be regenerated cheaply, with retries.
+ *
+ * A captured sign-in has nowhere else to go — there is no local copy any more — so losing it to
+ * one network blip would cost a person another trip through a sign-in form, possibly with a code
+ * from their phone. Three attempts with a widening gap, then it gives up and says so loudly; the
+ * card then hits the sign-in wall again on its next look and the existing machinery asks for a
+ * fresh one, which is the same path an expired session takes.
+ */
+export async function putInsistently(store, id, value, opts, onNote = () => { }, attempts = 3) {
+    let last = { ok: false, message: 'not attempted' };
+    for (let n = 1; n <= attempts; n++) {
+        last = await store.put(id, value, opts);
+        if (last.ok)
+            return last;
+        if (n < attempts) {
+            onNote(`could not save ${id} to FlareDeck (${last.message}) — retrying (${n}/${attempts - 1}).`);
+            await new Promise((r) => setTimeout(r, 1000 * 2 ** (n - 1)));
+        }
+    }
+    return last;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6E9C;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,gGAAgG;AAChG,WAAW;AAEX,MAAM,YAAY,GAChB,kJAAkJ,CAAC;AACrJ,MAAM,cAAc,GAAG,8CAA8C,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,GAAY;IACvE,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;QACjB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,IAAI;QAAE,OAAO,gBAAgB,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAClE,OAAO,gBAAgB,OAAO,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,MAAM,QAAQ,GAAG,mIAAmI,CAAC;AAErJ;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgF;IAC5G,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,EAAE,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyB,EAAE,MAAM,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,8FAA8F;IAC9F,mFAAmF;IACnF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,GAAyB;QAAzB,QAAG,GAAH,GAAG,CAAsB;IAAG,CAAC;IAE1D,IAAY,IAAI;QACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,OAAO,GAAG,IAAI,CAAC,IAAI,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/J,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE;gBAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4FAA4F;YAC5F,sDAAsD;YACtD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO,MAAM,CAAE,IAA6B,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC;QAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC;QAEtE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA0D,CAAC;QAC3G,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/D,0FAA0F;QAC1F,8FAA8F;QAC9F,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;QACrG,OAAO;YACL,IAAI,EAAE,OAAO;YACb,KAAK;YACL,IAAI,EAAE;gBACJ,EAAE;gBACF,IAAI,EAAG,IAAK,CAAC,IAAuB,IAAI,OAAO;gBAC/C,KAAK,EAAE,MAAM,CAAC,IAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChC,OAAO,EAAE,MAAM,CAAC,IAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnC,KAAK,EAAE,IAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBACvD,KAAK,EAAE,MAAM,CAAC,IAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,KAAa,EAAE,IAAgB;QACrD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBACpC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAChC,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAE,IAA6B,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACzG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE;gBAC9F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE;gBAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1C,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,IAAI,EAAG,CAAC,CAAC,IAAuB,IAAI,OAAO;gBAC3C,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBACnD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;aAC5B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAA4B,EAAE,SAAiC,GAAG,EAAE,GAAE,CAAC;IAChG,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,OAAO;oBACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzC,KAAK,SAAS;oBACZ,uFAAuF;oBACvF,oCAAoC;oBACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACnC,KAAK,SAAS;oBACZ,MAAM,CAAC,GAAG,EAAE,8BAA8B,IAAI,CAAC,OAAO,gCAAgC,CAAC,CAAC;oBACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACnC,KAAK,UAAU;oBACb,MAAM,CAAC,GAAG,EAAE,4CAA4C,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;oBACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACnC,KAAK,aAAa;oBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC;QACvD,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO;QACL,KAAK,CAAC,GAAG,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,GAAG,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS;AAET;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,SAAiC,GAAG,EAAE,GAAE,CAAC,EACzC,KAAgC;IAEhC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,WAAW,CAChB,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,UAAU,CACf,IAAI,oBAAoB,CAAC;QACvB,QAAQ;QACR,OAAO,EAAE,GAAG,MAAM,MAAM;QACxB,IAAI,EAAE,GAAG,EAAE,CACT,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC;QACJ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,EACF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IACjC,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,2DAA2D;AAE3D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAI,KAAsB,EAAE,EAAU;IACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,+FAA+F;QAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAsB,EACtB,EAAU,EACV,KAAc,EACd,IAAgB;IAEhB,OAAO,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAsB,EACtB,EAAU,EACV,KAAa,EACb,IAAgB,EAChB,SAAiC,GAAG,EAAE,GAAE,CAAC,EACzC,QAAQ,GAAG,CAAC;IAEZ,IAAI,IAAI,GAAsC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjB,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,IAAI,CAAC,OAAO,iBAAiB,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;YACjG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine-antigravity.js

@@ -166,6 +166,7 @@ export class AntigravityEngine {
                 ...(ctx.tools.runs ? { runs: ctx.tools.runs.server } : {}),
                 ...(ctx.tools.schedules ? { schedules: ctx.tools.schedules.server } : {}),
                 ...(ctx.tools.browser ? { browser: ctx.tools.browser.server } : {}),
+                ...(ctx.tools.env ? { env: ctx.tools.env.server } : {}),
             }, (note) => push({ kind: 'tool', name: note }));
             local = served;
             // FlareDeck through the harness rather than straight at the server: the SDK lists tools
@@ -276,6 +277,7 @@ export class AntigravityEngine {
                     ...(ctx.tools.runs?.toolNames ?? []),
                     ...(ctx.tools.schedules?.toolNames ?? []),
                     ...(ctx.tools.browser?.toolNames ?? []),
+                    ...(ctx.tools.env?.toolNames ?? []),
                 ],
                 ...(ctx.resume ? { resume: ctx.resume } : {}),
                 // Mapped from the SIZE, never from `ctx.model` — that is the other engine's name for the