@opengeni/sdk 3.1.2 → 3.2.2

package/dist/external-vault-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/external-vault-receiver.ts"],"sourcesContent":["/**\n * Server-only receiver for Opengeni's signed remote vault protocol\n * (`opengeni.vault.v1`). Import from `@opengeni/sdk/external-vault-receiver`\n * in the server that owns the customer's secrets; never in a browser bundle.\n *\n * Order of checks for every request: bounded body, connection lookup, exact\n * body signature, strict schema, request age and replay, native authority\n * bindings, then the host's own `authorize` mapping (a MAC is not an\n * authorization decision), then the handler. Handler output is projected to\n * the known wire fields and validated before it is signed, so metadata can\n * never carry values and reads return only requested fields.\n *\n * Mutations are claimed in the caller-owned durable store under an\n * idempotency key and an operation digest. A repeated key with the same\n * digest returns the recorded result; a different digest is refused; an\n * unfinished or uncertain claim reports `provider_outcome_unknown` until the\n * host reconciles it. Nothing here retries a mutation.\n */\nimport {\n  OPENGENI_SIGNATURE_HEADER,\n  signOpenGeniPayload,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\nimport {\n  VAULT_PROVIDER_WIRE_LIMITS,\n  VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER,\n  VAULT_PROVIDER_WIRE_VERSION,\n  VaultProviderWireFreshness,\n  VaultProviderWireRequest,\n  VaultProviderWireResults,\n  isVaultProviderWireMutation,\n  vaultProviderWireNameKey,\n  vaultProviderWireResponseKey,\n  vaultProviderWireUtf8Bytes,\n  type VaultProviderWireAuthority,\n  type VaultProviderWireErrorCode,\n  type VaultProviderWireFailure,\n  type VaultProviderWireOperation,\n  type VaultProviderWireOperationName,\n  type VaultProviderWireOperationOf,\n  type VaultProviderWirePage,\n  type VaultProviderWireProvider,\n  type VaultProviderWireResult,\n  type VaultProviderWireSuccess,\n  type VaultProviderWireWriteItem,\n} from \"@opengeni/contracts/vault-provider-wire\";\n\nexport {\n  VAULT_PROVIDER_WIRE_ERROR_CODES,\n  VAULT_PROVIDER_WIRE_LIMITS,\n  VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER,\n  VAULT_PROVIDER_WIRE_VERSION,\n  vaultProviderWireResponseKey,\n} from \"@opengeni/contracts/vault-provider-wire\";\nexport type {\n  VaultProviderWireAuthority,\n  VaultProviderWireDescribeResult,\n  VaultProviderWireErrorCode,\n  VaultProviderWireFieldMeta,\n  VaultProviderWireFieldValue,\n  VaultProviderWireFreshness,\n  VaultProviderWireItemMeta,\n  VaultProviderWireOperation,\n  VaultProviderWireOperationName,\n  VaultProviderWirePage,\n  VaultProviderWireProvider,\n  VaultProviderWireRequest,\n  VaultProviderWireResponse,\n  VaultProviderWireResult,\n  VaultProviderWireVault,\n  VaultProviderWireWriteField,\n  VaultProviderWireWriteItem,\n} from \"@opengeni/contracts/vault-provider-wire\";\n\n/** A definite, safe receiver failure. Its message is never sent to Opengeni. */\nexport class ExternalVaultReceiverError extends Error {\n  readonly code: VaultProviderWireErrorCode;\n  readonly retryAfterMs: number | null;\n  readonly freshness: VaultProviderWireFreshness | null;\n  constructor(\n    code: VaultProviderWireErrorCode,\n    options: {\n      retryAfterMs?: number;\n      freshness?: VaultProviderWireFreshness;\n      message?: string;\n    } = {},\n  ) {\n    super(options.message ?? code);\n    this.name = \"ExternalVaultReceiverError\";\n    this.code = code;\n    this.retryAfterMs =\n      options.retryAfterMs === undefined\n        ? null\n        : Math.min(Math.max(Math.trunc(options.retryAfterMs), 0), 86_400_000);\n    this.freshness = options.freshness ?? null;\n  }\n}\n\nexport interface ExternalVaultReceiverConnection<TConnection> {\n  provider: VaultProviderWireProvider;\n  /**\n   * Accepted signing secrets: the current one first, then a previous one\n   * during rotation. Responses are signed with the secret that verified.\n   */\n  signingSecrets: readonly string[];\n  /** When set, requests for any other Opengeni account are refused. */\n  accountId?: string;\n  /** When set, requests for a connection owned by another workspace are refused. */\n  connectionWorkspaceId?: string;\n  /** Host data for this connection: its fixed inventory scope, not a user. */\n  context: TConnection;\n}\n\nexport type ExternalVaultMutationClaim =\n  | { state: \"claimed\" }\n  | { state: \"completed\"; result: unknown }\n  /** In flight, or uncertain after a failure: report an unknown outcome. */\n  | { state: \"pending\" }\n  /** Same key, different operation or caller. */\n  | { state: \"mismatch\" };\n\n/**\n * Caller-owned replay and idempotency storage. Use durable shared storage\n * (for example a database table with unique keys) when the receiver runs in\n * more than one process or must survive restarts.\n */\nexport interface ExternalVaultReceiverStore {\n  /** Atomically record a request id. False when it was already recorded. */\n  rememberRequest(input: {\n    connectionId: string;\n    requestId: string;\n    expiresAt: Date;\n  }): Promise<boolean>;\n  /** Atomically claim a mutation key, or report its existing state. */\n  claimMutation(input: {\n    connectionId: string;\n    idempotencyKey: string;\n    digest: string;\n    expiresAt: Date;\n  }): Promise<ExternalVaultMutationClaim>;\n  /** Record the metadata-only result of a confirmed mutation. */\n  completeMutation(input: {\n    connectionId: string;\n    idempotencyKey: string;\n    digest: string;\n    result: unknown;\n  }): Promise<void>;\n  /** The handler definitely changed nothing: allow the key to be claimed again. */\n  releaseMutation(input: {\n    connectionId: string;\n    idempotencyKey: string;\n    digest: string;\n  }): Promise<void>;\n}\n\nexport interface ExternalVaultHandlerOutput<R> {\n  result: R;\n  freshness?: VaultProviderWireFreshness | null;\n}\n\ntype ReadContext = { forceRefresh: boolean; cacheEpoch: string | null };\n\nexport interface ExternalVaultCallContext<TConnection, TPrincipal> {\n  connectionId: string;\n  connection: TConnection;\n  /** The host principal returned by `authorize` for this exact request. */\n  principal: TPrincipal;\n  authority: VaultProviderWireAuthority;\n  requestId: string;\n  signal?: AbortSignal;\n}\n\n/**\n * Inventory handlers receive the connection, not the acting principal: one\n * connection has one fixed inventory, so listings must not vary by subject.\n */\nexport interface ExternalVaultInventoryContext<TConnection> {\n  connectionId: string;\n  connection: TConnection;\n  requestId: string;\n  signal?: AbortSignal;\n}\n\nexport interface ExternalVaultReceiverHandlers<TConnection, TPrincipal> {\n  describe(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"describe\">>>;\n  /** Deliberate upstream refresh; omit when the store is always live. */\n  refresh?(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"refresh\">>>;\n  listVaults(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n    input: { page: VaultProviderWirePage } & ReadContext,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"list_vaults\">>>;\n  listItems(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n    input: { externalVaultId: string; page: VaultProviderWirePage } & ReadContext,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"list_items\">>>;\n  readFields(\n    ctx: ExternalVaultCallContext<TConnection, TPrincipal>,\n    input: {\n      externalVaultId: string;\n      externalItemId: string;\n      externalFieldIds: readonly string[];\n    } & ReadContext,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"read_fields\">>>;\n  /** Omit when the connection is read-only. Throw only definite failures. */\n  writeItem?(\n    ctx: ExternalVaultCallContext<TConnection, TPrincipal>,\n    input: { externalVaultId: string; item: VaultProviderWireWriteItem; idempotencyKey: string },\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"write_item\">>>;\n  archiveItem?(\n    ctx: ExternalVaultCallContext<TConnection, TPrincipal>,\n    input: { externalVaultId: string; externalItemId: string; idempotencyKey: string },\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"archive_item\">>>;\n}\n\nexport interface ExternalVaultAuthorizeInput<TConnection> {\n  connectionId: string;\n  connection: TConnection;\n  authority: VaultProviderWireAuthority;\n  operation: {\n    op: VaultProviderWireOperationName;\n    externalVaultId?: string;\n    externalItemId?: string;\n  };\n  requestId: string;\n}\n\nexport interface ExternalVaultReceiverOptions<TConnection, TPrincipal> {\n  /** Unknown connections are indistinguishable from bad signatures. */\n  resolveConnection(\n    connectionId: string,\n  ): Promise<ExternalVaultReceiverConnection<TConnection> | null>;\n  /**\n   * Map Opengeni's native account/workspace/subject to the host tenant and\n   * user and recheck access for this operation. Return null to refuse.\n   * Called for every request, including inventory reads.\n   */\n  authorize(input: ExternalVaultAuthorizeInput<TConnection>): Promise<TPrincipal | null>;\n  handlers: ExternalVaultReceiverHandlers<TConnection, TPrincipal>;\n  store: ExternalVaultReceiverStore;\n  /** How long mutation results stay replayable. Default 24 hours. */\n  mutationRetentionMs?: number;\n  now?: () => number;\n  /** Host diagnostics. Never forward these errors to Opengeni. */\n  onError?(event: {\n    stage: \"authorize\" | \"handler\" | \"store\" | \"output\";\n    op: VaultProviderWireOperationName;\n    connectionId: string;\n    error: unknown;\n  }): void;\n}\n\nexport interface ExternalVaultReceiverHttpRequest {\n  /** The exact raw request body; parse nothing before calling `handle`. */\n  body: string;\n  headers: Headers | Record<string, string | string[] | undefined>;\n  signal?: AbortSignal;\n}\n\nexport interface ExternalVaultReceiverHttpResponse {\n  status: number;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport interface ExternalVaultReceiver {\n  handle(request: ExternalVaultReceiverHttpRequest): Promise<ExternalVaultReceiverHttpResponse>;\n  /** Fetch-style adapter: POST only, bounded body, then `handle`. */\n  fetch(request: Request): Promise<Response>;\n}\n\nconst JSON_HEADERS = { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" };\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction plain(status: number, error: string): ExternalVaultReceiverHttpResponse {\n  return { status, headers: { ...JSON_HEADERS }, body: JSON.stringify({ error }) };\n}\n\nfunction headerValue(headers: ExternalVaultReceiverHttpRequest[\"headers\"], name: string) {\n  if (headers instanceof Headers) return headers.get(name);\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted) {\n      return Array.isArray(value)\n        ? value.length === 1\n          ? (value[0] ?? null)\n          : null\n        : (value ?? null);\n    }\n  }\n  return null;\n}\n\nfunction canonicalJson(value: unknown): string {\n  if (value === null || typeof value !== \"object\") return JSON.stringify(value);\n  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(\",\")}]`;\n  const entries = Object.entries(value as Record<string, unknown>)\n    .filter(([, entry]) => entry !== undefined)\n    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n  return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(\",\")}}`;\n}\n\nasync function hmacHex(key: string, message: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const cryptoKey = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(key),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const mac = new Uint8Array(await crypto.subtle.sign(\"HMAC\", cryptoKey, encoder.encode(message)));\n  return Array.from(mac, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Keyed digest of one mutation's exact scope: connection, provider, trusted\n * caller tuple and operation (without its idempotency key). Keyed so the\n * store never holds a plain hash of submitted secret values.\n */\nexport async function externalVaultMutationDigest(input: {\n  signingSecret: string;\n  request: VaultProviderWireRequest;\n}): Promise<string> {\n  const { request } = input;\n  const { idempotencyKey: _ignored, ...operation } = request.operation as Extract<\n    VaultProviderWireOperation,\n    { idempotencyKey: string }\n  >;\n  return hmacHex(\n    `${input.signingSecret}\\u0000${VAULT_PROVIDER_WIRE_VERSION}.idempotency`,\n    canonicalJson({\n      connectionId: request.connectionId.toLowerCase(),\n      provider: request.provider,\n      accountId: request.authority.accountId,\n      workspaceId: request.authority.workspaceId,\n      subjectId: request.authority.subjectId,\n      connectionWorkspaceId: request.authority.connectionWorkspaceId,\n      operation,\n    }),\n  );\n}\n\nfunction pick<T extends object, K extends keyof T>(value: T, keys: readonly K[]): Pick<T, K> {\n  const out = {} as Pick<T, K>;\n  for (const key of keys) if (value[key] !== undefined) out[key] = value[key];\n  return out;\n}\n\n/** Project handler output to known wire keys only; values never ride along. */\nfunction project(op: VaultProviderWireOperationName, raw: unknown): unknown {\n  if (!raw || typeof raw !== \"object\") return raw;\n  const result = raw as Record<string, any>;\n  const field = (f: any) =>\n    f && typeof f === \"object\" ? pick(f, [\"externalFieldId\", \"name\", \"kind\"]) : f;\n  const item = (i: any) =>\n    i && typeof i === \"object\"\n      ? {\n          ...pick(i, [\"externalItemId\", \"name\", \"type\", \"websites\", \"version\", \"updatedAt\"]),\n          fields: Array.isArray(i.fields) ? i.fields.map(field) : i.fields,\n        }\n      : i;\n  const vault = (v: any) =>\n    v && typeof v === \"object\"\n      ? pick(v, [\n          \"externalVaultId\",\n          \"name\",\n          \"contentVersion\",\n          \"itemCount\",\n          \"writeAccess\",\n          \"operations\",\n        ])\n      : v;\n  switch (op) {\n    case \"describe\":\n      return pick(result, [\n        \"accountId\",\n        \"accountName\",\n        \"operations\",\n        \"capabilities\",\n        \"inventoryScope\",\n      ]);\n    case \"refresh\":\n      return pick(result, [\"refreshed\"]);\n    case \"list_vaults\":\n    case \"list_items\":\n      return {\n        ...pick(result, [\"nextCursor\", \"snapshot\"]),\n        items: Array.isArray(result.items)\n          ? result.items.map(op === \"list_vaults\" ? vault : item)\n          : result.items,\n      };\n    case \"read_fields\":\n      return {\n        fields: Array.isArray(result.fields)\n          ? result.fields.map((f: any) =>\n              f && typeof f === \"object\" ? pick(f, [\"externalFieldId\", \"value\"]) : f,\n            )\n          : result.fields,\n      };\n    case \"write_item\":\n      return { item: item(result.item) };\n    case \"archive_item\":\n      return pick(result, [\"archived\"]);\n  }\n}\n\n/** Mirrors Opengeni's secret-name rule: usable item/field names from upstream titles. */\nexport function safeExternalVaultName(raw: string, fallback = \"Untitled\"): string {\n  // oxlint-disable-next-line no-control-regex\n  const forbidden = /[/{}#\\\\\\u0000-\\u001f\\u007f-\\u009f]/g;\n  const clean = (value: string) =>\n    [...value.replace(forbidden, \"-\").trim()].slice(0, 120).join(\"\").trim();\n  let name = clean(typeof raw === \"string\" ? raw : \"\");\n  if (!name) name = clean(fallback) || \"Untitled\";\n  if (/^id:/i.test(name)) name = `id-${name.slice(3)}`;\n  return name;\n}\n\n/** A safe field name, unique case-insensitively within `taken` (which it updates). */\nexport function uniqueExternalVaultFieldName(raw: string, taken: Set<string>, fallback = \"field\") {\n  let base = safeExternalVaultName(raw, fallback);\n  if (vaultProviderWireNameKey(base) === \"otp\") base = \"otp-code\";\n  let candidate = base;\n  for (let n = 2; taken.has(vaultProviderWireNameKey(candidate)); n += 1) {\n    const suffix = ` (${n})`;\n    candidate = `${[...base].slice(0, 120 - suffix.length).join(\"\")}${suffix}`;\n  }\n  taken.add(vaultProviderWireNameKey(candidate));\n  return candidate;\n}\n\n/**\n * Process-local store for tests, development and a single-process bridge\n * that accepts losing replay/idempotency memory on restart. It is not durable.\n */\nexport function createInMemoryExternalVaultReceiverStore(\n  options: { maxEntries?: number; now?: () => number } = {},\n): ExternalVaultReceiverStore & { size(): number } {\n  const maxEntries = options.maxEntries ?? 10_000;\n  const now = options.now ?? (() => Date.now());\n  const requests = new Map<string, number>();\n  const mutations = new Map<\n    string,\n    { digest: string; expiresAt: number; state: \"pending\" | \"completed\"; result?: unknown }\n  >();\n  const prune = () => {\n    const t = now();\n    for (const [key, expiresAt] of requests) if (expiresAt <= t) requests.delete(key);\n    for (const [key, entry] of mutations) if (entry.expiresAt <= t) mutations.delete(key);\n  };\n  const full = () => requests.size + mutations.size >= maxEntries;\n  return {\n    size: () => requests.size + mutations.size,\n    async rememberRequest({ connectionId, requestId, expiresAt }) {\n      prune();\n      const key = `${connectionId}\\u0000${requestId}`;\n      if (requests.has(key)) return false;\n      // Refuse rather than forget: forgetting would reopen a replay window.\n      if (full()) throw new ExternalVaultReceiverError(\"provider_rate_limited\");\n      requests.set(key, expiresAt.getTime());\n      return true;\n    },\n    async claimMutation({ connectionId, idempotencyKey, digest, expiresAt }) {\n      prune();\n      const key = `${connectionId}\\u0000${idempotencyKey}`;\n      const existing = mutations.get(key);\n      if (existing) {\n        if (existing.digest !== digest) return { state: \"mismatch\" };\n        return existing.state === \"completed\"\n          ? { state: \"completed\", result: structuredClone(existing.result) }\n          : { state: \"pending\" };\n      }\n      if (full()) throw new ExternalVaultReceiverError(\"provider_rate_limited\");\n      mutations.set(key, { digest, expiresAt: expiresAt.getTime(), state: \"pending\" });\n      return { state: \"claimed\" };\n    },\n    async completeMutation({ connectionId, idempotencyKey, digest, result }) {\n      const entry = mutations.get(`${connectionId}\\u0000${idempotencyKey}`);\n      if (!entry || entry.digest !== digest) throw new Error(\"mutation claim missing\");\n      entry.state = \"completed\";\n      entry.result = structuredClone(result);\n    },\n    async releaseMutation({ connectionId, idempotencyKey, digest }) {\n      const key = `${connectionId}\\u0000${idempotencyKey}`;\n      if (mutations.get(key)?.digest === digest) mutations.delete(key);\n    },\n  };\n}\n\nfunction operationTarget(operation: VaultProviderWireOperation) {\n  return {\n    op: operation.op,\n    ...(\"externalVaultId\" in operation ? { externalVaultId: operation.externalVaultId } : {}),\n    ...(\"externalItemId\" in operation ? { externalItemId: operation.externalItemId } : {}),\n    ...(operation.op === \"write_item\" && operation.item.externalItemId\n      ? { externalItemId: operation.item.externalItemId }\n      : {}),\n  };\n}\n\nexport function createExternalVaultReceiver<TConnection, TPrincipal>(\n  options: ExternalVaultReceiverOptions<TConnection, TPrincipal>,\n): ExternalVaultReceiver {\n  const now = options.now ?? (() => Date.now());\n  const tolerance = VAULT_PROVIDER_WIRE_LIMITS.signatureToleranceSeconds;\n  const retentionMs = Math.max(options.mutationRetentionMs ?? 86_400_000, tolerance * 2_000);\n  const report = (\n    stage: \"authorize\" | \"handler\" | \"store\" | \"output\",\n    op: VaultProviderWireOperationName,\n    connectionId: string,\n    error: unknown,\n  ) => {\n    try {\n      options.onError?.({ stage, op, connectionId, error });\n    } catch {\n      // Diagnostics never change the protocol outcome.\n    }\n  };\n\n  async function signed(\n    secret: string,\n    response: VaultProviderWireSuccess | VaultProviderWireFailure,\n  ): Promise<ExternalVaultReceiverHttpResponse> {\n    const body = JSON.stringify(response);\n    const signature = await signOpenGeniPayload(\n      vaultProviderWireResponseKey(secret),\n      body,\n      Math.floor(now() / 1000),\n    );\n    return {\n      status: 200,\n      headers: { ...JSON_HEADERS, [VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER]: signature },\n      body,\n    };\n  }\n\n  async function handle(\n    request: ExternalVaultReceiverHttpRequest,\n  ): Promise<ExternalVaultReceiverHttpResponse> {\n    if (typeof request.body !== \"string\") return plain(400, \"invalid_request\");\n    if (vaultProviderWireUtf8Bytes(request.body) > VAULT_PROVIDER_WIRE_LIMITS.maxRequestBytes) {\n      return plain(413, \"request_too_large\");\n    }\n    const signature = headerValue(request.headers, OPENGENI_SIGNATURE_HEADER);\n    if (!signature) return plain(401, \"unauthorized\");\n    let raw: unknown;\n    try {\n      raw = JSON.parse(request.body);\n    } catch {\n      return plain(400, \"invalid_request\");\n    }\n    const claimedConnectionId =\n      raw && typeof raw === \"object\" ? (raw as { connectionId?: unknown }).connectionId : undefined;\n    if (typeof claimedConnectionId !== \"string\" || !UUID.test(claimedConnectionId)) {\n      return plain(401, \"unauthorized\");\n    }\n    const connectionId = claimedConnectionId.toLowerCase();\n    let connection: ExternalVaultReceiverConnection<TConnection> | null;\n    try {\n      connection = await options.resolveConnection(connectionId);\n    } catch (error) {\n      report(\"store\", \"describe\", connectionId, error);\n      return plain(503, \"unavailable\");\n    }\n    if (!connection || connection.signingSecrets.length === 0) return plain(401, \"unauthorized\");\n    let secret: string | null = null;\n    for (const candidate of connection.signingSecrets.slice(0, 4)) {\n      if (\n        await verifyOpenGeniSignature({\n          secret: candidate,\n          body: request.body,\n          signature,\n          toleranceSeconds: tolerance,\n          nowSeconds: Math.floor(now() / 1000),\n        })\n      ) {\n        secret = candidate;\n        break;\n      }\n    }\n    if (!secret) return plain(401, \"unauthorized\");\n    const parsed = VaultProviderWireRequest.safeParse(raw);\n    if (!parsed.success) return plain(400, \"invalid_request\");\n    const wire = parsed.data;\n    const op = wire.operation.op;\n    const sentAt = Date.parse(wire.sentAt);\n    if (!Number.isFinite(sentAt) || Math.abs(now() - sentAt) > tolerance * 1000) {\n      return plain(401, \"unauthorized\");\n    }\n\n    const failure = (\n      code: VaultProviderWireErrorCode,\n      extra: { retryAfterMs?: number | null; freshness?: VaultProviderWireFreshness | null } = {},\n    ) =>\n      signed(secret!, {\n        version: VAULT_PROVIDER_WIRE_VERSION,\n        type: \"response\",\n        requestId: wire.requestId,\n        ok: false,\n        op,\n        error: { code, retryAfterMs: extra.retryAfterMs ?? null },\n        // Host-supplied freshness is validated like handler output; invalid is dropped.\n        freshness:\n          extra.freshness == null\n            ? null\n            : (VaultProviderWireFreshness.safeParse(extra.freshness).data ?? null),\n      });\n\n    try {\n      const fresh = await options.store.rememberRequest({\n        connectionId,\n        requestId: wire.requestId,\n        expiresAt: new Date(now() + tolerance * 2_000),\n      });\n      if (!fresh) return plain(409, \"replayed_request\");\n    } catch (error) {\n      report(\"store\", op, connectionId, error);\n      if (error instanceof ExternalVaultReceiverError) return failure(error.code);\n      return failure(\"provider_unavailable\");\n    }\n\n    if (\n      wire.provider !== connection.provider ||\n      (connection.accountId !== undefined && wire.authority.accountId !== connection.accountId) ||\n      (connection.connectionWorkspaceId !== undefined &&\n        wire.authority.connectionWorkspaceId !== connection.connectionWorkspaceId)\n    ) {\n      return failure(\"provider_permission_denied\");\n    }\n\n    let principal: TPrincipal | null;\n    try {\n      principal = await options.authorize({\n        connectionId,\n        connection: connection.context,\n        authority: wire.authority,\n        operation: operationTarget(wire.operation),\n        requestId: wire.requestId,\n      });\n    } catch (error) {\n      report(\"authorize\", op, connectionId, error);\n      if (error instanceof ExternalVaultReceiverError) return failure(error.code);\n      return failure(\"provider_unavailable\");\n    }\n    if (principal === null || principal === undefined) {\n      return failure(\"provider_permission_denied\");\n    }\n\n    const inventory: ExternalVaultInventoryContext<TConnection> = {\n      connectionId,\n      connection: connection.context,\n      requestId: wire.requestId,\n      ...(request.signal ? { signal: request.signal } : {}),\n    };\n    const call: ExternalVaultCallContext<TConnection, TPrincipal> = {\n      ...inventory,\n      principal,\n      authority: wire.authority,\n    };\n\n    const respond = async (\n      output: ExternalVaultHandlerOutput<unknown>,\n    ): Promise<\n      | { ok: true; response: ExternalVaultReceiverHttpResponse; result: unknown }\n      | { ok: false; code: VaultProviderWireErrorCode }\n    > => {\n      const projected = project(op, output?.result);\n      const result = VaultProviderWireResults[op].safeParse(projected);\n      const freshness =\n        output?.freshness == null ? null : VaultProviderWireFreshness.safeParse(output.freshness);\n      if (!result.success || (freshness && !freshness.success)) {\n        report(\"output\", op, connectionId, result.error ?? freshness?.error);\n        return { ok: false, code: \"provider_unavailable\" };\n      }\n      const consistency = checkConsistency(wire.operation, result.data);\n      if (consistency) return { ok: false, code: consistency };\n      return {\n        ok: true,\n        result: result.data,\n        response: await signed(secret!, {\n          version: VAULT_PROVIDER_WIRE_VERSION,\n          type: \"response\",\n          requestId: wire.requestId,\n          ok: true,\n          op,\n          result: result.data,\n          freshness: freshness ? freshness.data : null,\n        } as VaultProviderWireSuccess),\n      };\n    };\n\n    if (!isVaultProviderWireMutation(op)) {\n      try {\n        const output = await runRead(wire.operation, inventory, call);\n        if (!output) return failure(\"provider_permission_denied\");\n        const outcome = await respond(output);\n        return outcome.ok ? outcome.response : failure(outcome.code);\n      } catch (error) {\n        if (error instanceof ExternalVaultReceiverError) {\n          return failure(error.code, {\n            retryAfterMs: error.retryAfterMs,\n            freshness: error.freshness,\n          });\n        }\n        report(\"handler\", op, connectionId, error);\n        return failure(\"provider_unavailable\");\n      }\n    }\n\n    const mutation = wire.operation as VaultProviderWireOperationOf<\"write_item\" | \"archive_item\">;\n    const handler =\n      mutation.op === \"write_item\" ? options.handlers.writeItem : options.handlers.archiveItem;\n    if (!handler) return failure(\"provider_permission_denied\");\n    const digest = await externalVaultMutationDigest({ signingSecret: secret, request: wire });\n    const key = { connectionId, idempotencyKey: mutation.idempotencyKey, digest };\n    let claim: ExternalVaultMutationClaim;\n    try {\n      claim = await options.store.claimMutation({\n        ...key,\n        expiresAt: new Date(now() + retentionMs),\n      });\n    } catch (error) {\n      report(\"store\", op, connectionId, error);\n      // Nothing was claimed or run.\n      return failure(\n        error instanceof ExternalVaultReceiverError ? error.code : \"provider_unavailable\",\n      );\n    }\n    if (claim.state === \"mismatch\") return failure(\"provider_conflict\");\n    if (claim.state === \"pending\") return failure(\"provider_outcome_unknown\");\n    if (claim.state === \"completed\") {\n      const outcome = await respond({ result: claim.result });\n      return outcome.ok ? outcome.response : failure(\"provider_outcome_unknown\");\n    }\n\n    let output: ExternalVaultHandlerOutput<unknown>;\n    try {\n      output =\n        mutation.op === \"write_item\"\n          ? await options.handlers.writeItem!(call, {\n              externalVaultId: mutation.externalVaultId,\n              item: mutation.item,\n              idempotencyKey: mutation.idempotencyKey,\n            })\n          : await options.handlers.archiveItem!(call, {\n              externalVaultId: mutation.externalVaultId,\n              externalItemId: mutation.externalItemId,\n              idempotencyKey: mutation.idempotencyKey,\n            });\n    } catch (error) {\n      if (\n        error instanceof ExternalVaultReceiverError &&\n        error.code !== \"provider_outcome_unknown\"\n      ) {\n        // Definite failure: the key may be used again.\n        try {\n          await options.store.releaseMutation(key);\n        } catch (storeError) {\n          report(\"store\", op, connectionId, storeError);\n        }\n        return failure(error.code, {\n          retryAfterMs: error.retryAfterMs,\n          freshness: error.freshness,\n        });\n      }\n      // Unknown: keep the claim pending so a repeat cannot apply it twice.\n      report(\"handler\", op, connectionId, error);\n      return failure(\"provider_outcome_unknown\");\n    }\n    const outcome = await respond(output);\n    if (!outcome.ok) return failure(\"provider_outcome_unknown\");\n    try {\n      await options.store.completeMutation({ ...key, result: outcome.result });\n    } catch (error) {\n      report(\"store\", op, connectionId, error);\n    }\n    return outcome.response;\n  }\n\n  async function runRead(\n    operation: VaultProviderWireOperation,\n    inventory: ExternalVaultInventoryContext<TConnection>,\n    call: ExternalVaultCallContext<TConnection, TPrincipal>,\n  ): Promise<ExternalVaultHandlerOutput<unknown> | null> {\n    const handlers = options.handlers;\n    switch (operation.op) {\n      case \"describe\":\n        return handlers.describe(inventory);\n      case \"refresh\":\n        return handlers.refresh ? handlers.refresh(inventory) : null;\n      case \"list_vaults\":\n        return handlers.listVaults(inventory, {\n          page: operation.page,\n          forceRefresh: operation.forceRefresh,\n          cacheEpoch: operation.cacheEpoch,\n        });\n      case \"list_items\":\n        return handlers.listItems(inventory, {\n          externalVaultId: operation.externalVaultId,\n          page: operation.page,\n          forceRefresh: operation.forceRefresh,\n          cacheEpoch: operation.cacheEpoch,\n        });\n      case \"read_fields\":\n        return handlers.readFields(call, {\n          externalVaultId: operation.externalVaultId,\n          externalItemId: operation.externalItemId,\n          externalFieldIds: operation.externalFieldIds,\n          forceRefresh: operation.forceRefresh,\n          cacheEpoch: operation.cacheEpoch,\n        });\n      default:\n        return null;\n    }\n  }\n\n  return {\n    handle,\n    async fetch(request) {\n      if (request.method !== \"POST\") {\n        return new Response(JSON.stringify({ error: \"method_not_allowed\" }), {\n          status: 405,\n          headers: { ...JSON_HEADERS, allow: \"POST\" },\n        });\n      }\n      const max = VAULT_PROVIDER_WIRE_LIMITS.maxRequestBytes;\n      const declared = Number(request.headers.get(\"content-length\") ?? \"0\");\n      if (Number.isFinite(declared) && declared > max) {\n        await request.body?.cancel().catch(() => {});\n        const response = plain(413, \"request_too_large\");\n        return new Response(response.body, { status: response.status, headers: response.headers });\n      }\n      const chunks: Uint8Array[] = [];\n      let total = 0;\n      const reader = request.body?.getReader();\n      if (reader) {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          total += value.byteLength;\n          if (total > max) {\n            await reader.cancel().catch(() => {});\n            const response = plain(413, \"request_too_large\");\n            return new Response(response.body, {\n              status: response.status,\n              headers: response.headers,\n            });\n          }\n          chunks.push(value);\n        }\n      }\n      const bytes = new Uint8Array(total);\n      let offset = 0;\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.byteLength;\n      }\n      let body: string;\n      try {\n        body = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n      } catch {\n        const response = plain(400, \"invalid_request\");\n        return new Response(response.body, { status: response.status, headers: response.headers });\n      }\n      const response = await handle({ body, headers: request.headers, signal: request.signal });\n      return new Response(response.body, { status: response.status, headers: response.headers });\n    },\n  };\n}\n\n/** Cross-checks the schema cannot express on its own. */\nfunction checkConsistency(\n  operation: VaultProviderWireOperation,\n  result: unknown,\n): VaultProviderWireErrorCode | null {\n  switch (operation.op) {\n    case \"list_vaults\":\n    case \"list_items\": {\n      const page = result as VaultProviderWireResult<\"list_items\" | \"list_vaults\">;\n      if (page.items.length > operation.page.limit) return \"provider_unavailable\";\n      const ids = new Set<string>();\n      for (const entry of page.items as Array<{\n        externalVaultId?: string;\n        externalItemId?: string;\n      }>) {\n        const id = entry.externalVaultId ?? entry.externalItemId ?? \"\";\n        if (ids.has(id)) return \"provider_unavailable\";\n        ids.add(id);\n      }\n      return null;\n    }\n    case \"read_fields\": {\n      const fields = (result as VaultProviderWireResult<\"read_fields\">).fields;\n      const requested = new Set(operation.externalFieldIds);\n      if (fields.some((field) => !requested.has(field.externalFieldId))) {\n        return \"provider_unavailable\";\n      }\n      return fields.length === requested.size ? null : \"provider_not_found\";\n    }\n    case \"write_item\": {\n      const item = (result as VaultProviderWireResult<\"write_item\">).item;\n      const expected = operation.item.externalItemId;\n      return expected !== undefined && item.externalItemId !== expected\n        ? \"provider_outcome_unknown\"\n        : null;\n    }\n    default:\n      return null;\n  }\n}\n"],"mappings":";;;;;;;AAuBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAYK;AAEP;AAAA,EACE;AAAA,EACA,8BAAAA;AAAA,EACA,iDAAAC;AAAA,EACA,+BAAAC;AAAA,EACA,gCAAAC;AAAA,OACK;AAsBA,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACT,YACE,MACA,UAII,CAAC,GACL;AACA,UAAM,QAAQ,WAAW,IAAI;AAC7B,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,eACH,QAAQ,iBAAiB,SACrB,OACA,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,YAAY,GAAG,CAAC,GAAG,KAAU;AACxE,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AACF;AAkLA,IAAM,eAAe,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AACvF,IAAM,OAAO;AAEb,SAAS,MAAM,QAAgB,OAAkD;AAC/E,SAAO,EAAE,QAAQ,SAAS,EAAE,GAAG,aAAa,GAAG,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,SAAsD,MAAc;AACvF,MAAI,mBAAmB,QAAS,QAAO,QAAQ,IAAI,IAAI;AACvD,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,QAAQ;AAChC,aAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,WAAW,IACd,MAAM,CAAC,KAAK,OACb,OACD,SAAS;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC5E,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,CAAC;AACvE,QAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;AAClD,SAAO,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,cAAc,KAAK,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AACtG;AAEA,eAAe,QAAQ,KAAa,SAAkC;AACpE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA,QAAQ,OAAO,GAAG;AAAA,IAClB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,WAAW,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAOA,eAAsB,4BAA4B,OAG9B;AAClB,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,EAAE,gBAAgB,UAAU,GAAG,UAAU,IAAI,QAAQ;AAI3D,SAAO;AAAA,IACL,GAAG,MAAM,aAAa,KAAS,2BAA2B;AAAA,IAC1D,cAAc;AAAA,MACZ,cAAc,QAAQ,aAAa,YAAY;AAAA,MAC/C,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ,UAAU;AAAA,MAC7B,aAAa,QAAQ,UAAU;AAAA,MAC/B,WAAW,QAAQ,UAAU;AAAA,MAC7B,uBAAuB,QAAQ,UAAU;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,KAA0C,OAAU,MAAgC;AAC3F,QAAM,MAAM,CAAC;AACb,aAAW,OAAO,KAAM,KAAI,MAAM,GAAG,MAAM,OAAW,KAAI,GAAG,IAAI,MAAM,GAAG;AAC1E,SAAO;AACT;AAGA,SAAS,QAAQ,IAAoC,KAAuB;AAC1E,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,SAAS;AACf,QAAM,QAAQ,CAAC,MACb,KAAK,OAAO,MAAM,WAAW,KAAK,GAAG,CAAC,mBAAmB,QAAQ,MAAM,CAAC,IAAI;AAC9E,QAAM,OAAO,CAAC,MACZ,KAAK,OAAO,MAAM,WACd;AAAA,IACE,GAAG,KAAK,GAAG,CAAC,kBAAkB,QAAQ,QAAQ,YAAY,WAAW,WAAW,CAAC;AAAA,IACjF,QAAQ,MAAM,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE;AAAA,EAC5D,IACA;AACN,QAAM,QAAQ,CAAC,MACb,KAAK,OAAO,MAAM,WACd,KAAK,GAAG;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACD;AACN,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,KAAK,QAAQ;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,KAAK;AACH,aAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;AAAA,IACnC,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG,KAAK,QAAQ,CAAC,cAAc,UAAU,CAAC;AAAA,QAC1C,OAAO,MAAM,QAAQ,OAAO,KAAK,IAC7B,OAAO,MAAM,IAAI,OAAO,gBAAgB,QAAQ,IAAI,IACpD,OAAO;AAAA,MACb;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,QAAQ,MAAM,QAAQ,OAAO,MAAM,IAC/B,OAAO,OAAO;AAAA,UAAI,CAAC,MACjB,KAAK,OAAO,MAAM,WAAW,KAAK,GAAG,CAAC,mBAAmB,OAAO,CAAC,IAAI;AAAA,QACvE,IACA,OAAO;AAAA,MACb;AAAA,IACF,KAAK;AACH,aAAO,EAAE,MAAM,KAAK,OAAO,IAAI,EAAE;AAAA,IACnC,KAAK;AACH,aAAO,KAAK,QAAQ,CAAC,UAAU,CAAC;AAAA,EACpC;AACF;AAGO,SAAS,sBAAsB,KAAa,WAAW,YAAoB;AAEhF,QAAM,YAAY;AAClB,QAAM,QAAQ,CAAC,UACb,CAAC,GAAG,MAAM,QAAQ,WAAW,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK;AACxE,MAAI,OAAO,MAAM,OAAO,QAAQ,WAAW,MAAM,EAAE;AACnD,MAAI,CAAC,KAAM,QAAO,MAAM,QAAQ,KAAK;AACrC,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,MAAM,KAAK,MAAM,CAAC,CAAC;AAClD,SAAO;AACT;AAGO,SAAS,6BAA6B,KAAa,OAAoB,WAAW,SAAS;AAChG,MAAI,OAAO,sBAAsB,KAAK,QAAQ;AAC9C,MAAI,yBAAyB,IAAI,MAAM,MAAO,QAAO;AACrD,MAAI,YAAY;AAChB,WAAS,IAAI,GAAG,MAAM,IAAI,yBAAyB,SAAS,CAAC,GAAG,KAAK,GAAG;AACtE,UAAM,SAAS,KAAK,CAAC;AACrB,gBAAY,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,GAAG,MAAM,OAAO,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM;AAAA,EAC1E;AACA,QAAM,IAAI,yBAAyB,SAAS,CAAC;AAC7C,SAAO;AACT;AAMO,SAAS,yCACd,UAAuD,CAAC,GACP;AACjD,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,MAAM,QAAQ,QAAQ,MAAM,KAAK,IAAI;AAC3C,QAAM,WAAW,oBAAI,IAAoB;AACzC,QAAM,YAAY,oBAAI,IAGpB;AACF,QAAM,QAAQ,MAAM;AAClB,UAAM,IAAI,IAAI;AACd,eAAW,CAAC,KAAK,SAAS,KAAK,SAAU,KAAI,aAAa,EAAG,UAAS,OAAO,GAAG;AAChF,eAAW,CAAC,KAAK,KAAK,KAAK,UAAW,KAAI,MAAM,aAAa,EAAG,WAAU,OAAO,GAAG;AAAA,EACtF;AACA,QAAM,OAAO,MAAM,SAAS,OAAO,UAAU,QAAQ;AACrD,SAAO;AAAA,IACL,MAAM,MAAM,SAAS,OAAO,UAAU;AAAA,IACtC,MAAM,gBAAgB,EAAE,cAAc,WAAW,UAAU,GAAG;AAC5D,YAAM;AACN,YAAM,MAAM,GAAG,YAAY,KAAS,SAAS;AAC7C,UAAI,SAAS,IAAI,GAAG,EAAG,QAAO;AAE9B,UAAI,KAAK,EAAG,OAAM,IAAI,2BAA2B,uBAAuB;AACxE,eAAS,IAAI,KAAK,UAAU,QAAQ,CAAC;AACrC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,EAAE,cAAc,gBAAgB,QAAQ,UAAU,GAAG;AACvE,YAAM;AACN,YAAM,MAAM,GAAG,YAAY,KAAS,cAAc;AAClD,YAAM,WAAW,UAAU,IAAI,GAAG;AAClC,UAAI,UAAU;AACZ,YAAI,SAAS,WAAW,OAAQ,QAAO,EAAE,OAAO,WAAW;AAC3D,eAAO,SAAS,UAAU,cACtB,EAAE,OAAO,aAAa,QAAQ,gBAAgB,SAAS,MAAM,EAAE,IAC/D,EAAE,OAAO,UAAU;AAAA,MACzB;AACA,UAAI,KAAK,EAAG,OAAM,IAAI,2BAA2B,uBAAuB;AACxE,gBAAU,IAAI,KAAK,EAAE,QAAQ,WAAW,UAAU,QAAQ,GAAG,OAAO,UAAU,CAAC;AAC/E,aAAO,EAAE,OAAO,UAAU;AAAA,IAC5B;AAAA,IACA,MAAM,iBAAiB,EAAE,cAAc,gBAAgB,QAAQ,OAAO,GAAG;AACvE,YAAM,QAAQ,UAAU,IAAI,GAAG,YAAY,KAAS,cAAc,EAAE;AACpE,UAAI,CAAC,SAAS,MAAM,WAAW,OAAQ,OAAM,IAAI,MAAM,wBAAwB;AAC/E,YAAM,QAAQ;AACd,YAAM,SAAS,gBAAgB,MAAM;AAAA,IACvC;AAAA,IACA,MAAM,gBAAgB,EAAE,cAAc,gBAAgB,OAAO,GAAG;AAC9D,YAAM,MAAM,GAAG,YAAY,KAAS,cAAc;AAClD,UAAI,UAAU,IAAI,GAAG,GAAG,WAAW,OAAQ,WAAU,OAAO,GAAG;AAAA,IACjE;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAuC;AAC9D,SAAO;AAAA,IACL,IAAI,UAAU;AAAA,IACd,GAAI,qBAAqB,YAAY,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,IACvF,GAAI,oBAAoB,YAAY,EAAE,gBAAgB,UAAU,eAAe,IAAI,CAAC;AAAA,IACpF,GAAI,UAAU,OAAO,gBAAgB,UAAU,KAAK,iBAChD,EAAE,gBAAgB,UAAU,KAAK,eAAe,IAChD,CAAC;AAAA,EACP;AACF;AAEO,SAAS,4BACd,SACuB;AACvB,QAAM,MAAM,QAAQ,QAAQ,MAAM,KAAK,IAAI;AAC3C,QAAM,YAAY,2BAA2B;AAC7C,QAAM,cAAc,KAAK,IAAI,QAAQ,uBAAuB,OAAY,YAAY,GAAK;AACzF,QAAM,SAAS,CACb,OACA,IACA,cACA,UACG;AACH,QAAI;AACF,cAAQ,UAAU,EAAE,OAAO,IAAI,cAAc,MAAM,CAAC;AAAA,IACtD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,iBAAe,OACb,QACA,UAC4C;AAC5C,UAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,UAAM,YAAY,MAAM;AAAA,MACtB,6BAA6B,MAAM;AAAA,MACnC;AAAA,MACA,KAAK,MAAM,IAAI,IAAI,GAAI;AAAA,IACzB;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,EAAE,GAAG,cAAc,CAAC,6CAA6C,GAAG,UAAU;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OACb,SAC4C;AAC5C,QAAI,OAAO,QAAQ,SAAS,SAAU,QAAO,MAAM,KAAK,iBAAiB;AACzE,QAAI,2BAA2B,QAAQ,IAAI,IAAI,2BAA2B,iBAAiB;AACzF,aAAO,MAAM,KAAK,mBAAmB;AAAA,IACvC;AACA,UAAM,YAAY,YAAY,QAAQ,SAAS,yBAAyB;AACxE,QAAI,CAAC,UAAW,QAAO,MAAM,KAAK,cAAc;AAChD,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,QAAQ,IAAI;AAAA,IAC/B,QAAQ;AACN,aAAO,MAAM,KAAK,iBAAiB;AAAA,IACrC;AACA,UAAM,sBACJ,OAAO,OAAO,QAAQ,WAAY,IAAmC,eAAe;AACtF,QAAI,OAAO,wBAAwB,YAAY,CAAC,KAAK,KAAK,mBAAmB,GAAG;AAC9E,aAAO,MAAM,KAAK,cAAc;AAAA,IAClC;AACA,UAAM,eAAe,oBAAoB,YAAY;AACrD,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,kBAAkB,YAAY;AAAA,IAC3D,SAAS,OAAO;AACd,aAAO,SAAS,YAAY,cAAc,KAAK;AAC/C,aAAO,MAAM,KAAK,aAAa;AAAA,IACjC;AACA,QAAI,CAAC,cAAc,WAAW,eAAe,WAAW,EAAG,QAAO,MAAM,KAAK,cAAc;AAC3F,QAAI,SAAwB;AAC5B,eAAW,aAAa,WAAW,eAAe,MAAM,GAAG,CAAC,GAAG;AAC7D,UACE,MAAM,wBAAwB;AAAA,QAC5B,QAAQ;AAAA,QACR,MAAM,QAAQ;AAAA,QACd;AAAA,QACA,kBAAkB;AAAA,QAClB,YAAY,KAAK,MAAM,IAAI,IAAI,GAAI;AAAA,MACrC,CAAC,GACD;AACA,iBAAS;AACT;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,OAAQ,QAAO,MAAM,KAAK,cAAc;AAC7C,UAAM,SAAS,yBAAyB,UAAU,GAAG;AACrD,QAAI,CAAC,OAAO,QAAS,QAAO,MAAM,KAAK,iBAAiB;AACxD,UAAM,OAAO,OAAO;AACpB,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,KAAK,MAAM,KAAK,MAAM;AACrC,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,IAAI,MAAM,IAAI,YAAY,KAAM;AAC3E,aAAO,MAAM,KAAK,cAAc;AAAA,IAClC;AAEA,UAAM,UAAU,CACd,MACA,QAAyF,CAAC,MAE1F,OAAO,QAAS;AAAA,MACd,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,MAChB,IAAI;AAAA,MACJ;AAAA,MACA,OAAO,EAAE,MAAM,cAAc,MAAM,gBAAgB,KAAK;AAAA;AAAA,MAExD,WACE,MAAM,aAAa,OACf,OACC,2BAA2B,UAAU,MAAM,SAAS,EAAE,QAAQ;AAAA,IACvE,CAAC;AAEH,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,MAAM,gBAAgB;AAAA,QAChD;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,WAAW,IAAI,KAAK,IAAI,IAAI,YAAY,GAAK;AAAA,MAC/C,CAAC;AACD,UAAI,CAAC,MAAO,QAAO,MAAM,KAAK,kBAAkB;AAAA,IAClD,SAAS,OAAO;AACd,aAAO,SAAS,IAAI,cAAc,KAAK;AACvC,UAAI,iBAAiB,2BAA4B,QAAO,QAAQ,MAAM,IAAI;AAC1E,aAAO,QAAQ,sBAAsB;AAAA,IACvC;AAEA,QACE,KAAK,aAAa,WAAW,YAC5B,WAAW,cAAc,UAAa,KAAK,UAAU,cAAc,WAAW,aAC9E,WAAW,0BAA0B,UACpC,KAAK,UAAU,0BAA0B,WAAW,uBACtD;AACA,aAAO,QAAQ,4BAA4B;AAAA,IAC7C;AAEA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,QAAQ,UAAU;AAAA,QAClC;AAAA,QACA,YAAY,WAAW;AAAA,QACvB,WAAW,KAAK;AAAA,QAChB,WAAW,gBAAgB,KAAK,SAAS;AAAA,QACzC,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,aAAa,IAAI,cAAc,KAAK;AAC3C,UAAI,iBAAiB,2BAA4B,QAAO,QAAQ,MAAM,IAAI;AAC1E,aAAO,QAAQ,sBAAsB;AAAA,IACvC;AACA,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,QAAQ,4BAA4B;AAAA,IAC7C;AAEA,UAAM,YAAwD;AAAA,MAC5D;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,WAAW,KAAK;AAAA,MAChB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AACA,UAAM,OAA0D;AAAA,MAC9D,GAAG;AAAA,MACH;AAAA,MACA,WAAW,KAAK;AAAA,IAClB;AAEA,UAAM,UAAU,OACdC,YAIG;AACH,YAAM,YAAY,QAAQ,IAAIA,SAAQ,MAAM;AAC5C,YAAM,SAAS,yBAAyB,EAAE,EAAE,UAAU,SAAS;AAC/D,YAAM,YACJA,SAAQ,aAAa,OAAO,OAAO,2BAA2B,UAAUA,QAAO,SAAS;AAC1F,UAAI,CAAC,OAAO,WAAY,aAAa,CAAC,UAAU,SAAU;AACxD,eAAO,UAAU,IAAI,cAAc,OAAO,SAAS,WAAW,KAAK;AACnE,eAAO,EAAE,IAAI,OAAO,MAAM,uBAAuB;AAAA,MACnD;AACA,YAAM,cAAc,iBAAiB,KAAK,WAAW,OAAO,IAAI;AAChE,UAAI,YAAa,QAAO,EAAE,IAAI,OAAO,MAAM,YAAY;AACvD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,OAAO;AAAA,QACf,UAAU,MAAM,OAAO,QAAS;AAAA,UAC9B,SAAS;AAAA,UACT,MAAM;AAAA,UACN,WAAW,KAAK;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,QAAQ,OAAO;AAAA,UACf,WAAW,YAAY,UAAU,OAAO;AAAA,QAC1C,CAA6B;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI,CAAC,4BAA4B,EAAE,GAAG;AACpC,UAAI;AACF,cAAMA,UAAS,MAAM,QAAQ,KAAK,WAAW,WAAW,IAAI;AAC5D,YAAI,CAACA,QAAQ,QAAO,QAAQ,4BAA4B;AACxD,cAAMC,WAAU,MAAM,QAAQD,OAAM;AACpC,eAAOC,SAAQ,KAAKA,SAAQ,WAAW,QAAQA,SAAQ,IAAI;AAAA,MAC7D,SAAS,OAAO;AACd,YAAI,iBAAiB,4BAA4B;AAC/C,iBAAO,QAAQ,MAAM,MAAM;AAAA,YACzB,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,UACnB,CAAC;AAAA,QACH;AACA,eAAO,WAAW,IAAI,cAAc,KAAK;AACzC,eAAO,QAAQ,sBAAsB;AAAA,MACvC;AAAA,IACF;AAEA,UAAM,WAAW,KAAK;AACtB,UAAM,UACJ,SAAS,OAAO,eAAe,QAAQ,SAAS,YAAY,QAAQ,SAAS;AAC/E,QAAI,CAAC,QAAS,QAAO,QAAQ,4BAA4B;AACzD,UAAM,SAAS,MAAM,4BAA4B,EAAE,eAAe,QAAQ,SAAS,KAAK,CAAC;AACzF,UAAM,MAAM,EAAE,cAAc,gBAAgB,SAAS,gBAAgB,OAAO;AAC5E,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,MAAM,cAAc;AAAA,QACxC,GAAG;AAAA,QACH,WAAW,IAAI,KAAK,IAAI,IAAI,WAAW;AAAA,MACzC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,SAAS,IAAI,cAAc,KAAK;AAEvC,aAAO;AAAA,QACL,iBAAiB,6BAA6B,MAAM,OAAO;AAAA,MAC7D;AAAA,IACF;AACA,QAAI,MAAM,UAAU,WAAY,QAAO,QAAQ,mBAAmB;AAClE,QAAI,MAAM,UAAU,UAAW,QAAO,QAAQ,0BAA0B;AACxE,QAAI,MAAM,UAAU,aAAa;AAC/B,YAAMA,WAAU,MAAM,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AACtD,aAAOA,SAAQ,KAAKA,SAAQ,WAAW,QAAQ,0BAA0B;AAAA,IAC3E;AAEA,QAAI;AACJ,QAAI;AACF,eACE,SAAS,OAAO,eACZ,MAAM,QAAQ,SAAS,UAAW,MAAM;AAAA,QACtC,iBAAiB,SAAS;AAAA,QAC1B,MAAM,SAAS;AAAA,QACf,gBAAgB,SAAS;AAAA,MAC3B,CAAC,IACD,MAAM,QAAQ,SAAS,YAAa,MAAM;AAAA,QACxC,iBAAiB,SAAS;AAAA,QAC1B,gBAAgB,SAAS;AAAA,QACzB,gBAAgB,SAAS;AAAA,MAC3B,CAAC;AAAA,IACT,SAAS,OAAO;AACd,UACE,iBAAiB,8BACjB,MAAM,SAAS,4BACf;AAEA,YAAI;AACF,gBAAM,QAAQ,MAAM,gBAAgB,GAAG;AAAA,QACzC,SAAS,YAAY;AACnB,iBAAO,SAAS,IAAI,cAAc,UAAU;AAAA,QAC9C;AACA,eAAO,QAAQ,MAAM,MAAM;AAAA,UACzB,cAAc,MAAM;AAAA,UACpB,WAAW,MAAM;AAAA,QACnB,CAAC;AAAA,MACH;AAEA,aAAO,WAAW,IAAI,cAAc,KAAK;AACzC,aAAO,QAAQ,0BAA0B;AAAA,IAC3C;AACA,UAAM,UAAU,MAAM,QAAQ,MAAM;AACpC,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ,0BAA0B;AAC1D,QAAI;AACF,YAAM,QAAQ,MAAM,iBAAiB,EAAE,GAAG,KAAK,QAAQ,QAAQ,OAAO,CAAC;AAAA,IACzE,SAAS,OAAO;AACd,aAAO,SAAS,IAAI,cAAc,KAAK;AAAA,IACzC;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,iBAAe,QACb,WACA,WACA,MACqD;AACrD,UAAM,WAAW,QAAQ;AACzB,YAAQ,UAAU,IAAI;AAAA,MACpB,KAAK;AACH,eAAO,SAAS,SAAS,SAAS;AAAA,MACpC,KAAK;AACH,eAAO,SAAS,UAAU,SAAS,QAAQ,SAAS,IAAI;AAAA,MAC1D,KAAK;AACH,eAAO,SAAS,WAAW,WAAW;AAAA,UACpC,MAAM,UAAU;AAAA,UAChB,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,QACxB,CAAC;AAAA,MACH,KAAK;AACH,eAAO,SAAS,UAAU,WAAW;AAAA,UACnC,iBAAiB,UAAU;AAAA,UAC3B,MAAM,UAAU;AAAA,UAChB,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,QACxB,CAAC;AAAA,MACH,KAAK;AACH,eAAO,SAAS,WAAW,MAAM;AAAA,UAC/B,iBAAiB,UAAU;AAAA,UAC3B,gBAAgB,UAAU;AAAA,UAC1B,kBAAkB,UAAU;AAAA,UAC5B,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,QACxB,CAAC;AAAA,MACH;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,SAAS;AACnB,UAAI,QAAQ,WAAW,QAAQ;AAC7B,eAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,qBAAqB,CAAC,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS,EAAE,GAAG,cAAc,OAAO,OAAO;AAAA,QAC5C,CAAC;AAAA,MACH;AACA,YAAM,MAAM,2BAA2B;AACvC,YAAM,WAAW,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AACpE,UAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,KAAK;AAC/C,cAAM,QAAQ,MAAM,OAAO,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC3C,cAAMC,YAAW,MAAM,KAAK,mBAAmB;AAC/C,eAAO,IAAI,SAASA,UAAS,MAAM,EAAE,QAAQA,UAAS,QAAQ,SAASA,UAAS,QAAQ,CAAC;AAAA,MAC3F;AACA,YAAM,SAAuB,CAAC;AAC9B,UAAI,QAAQ;AACZ,YAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,UAAI,QAAQ;AACV,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,KAAM;AACV,mBAAS,MAAM;AACf,cAAI,QAAQ,KAAK;AACf,kBAAM,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,YAAC,CAAC;AACpC,kBAAMA,YAAW,MAAM,KAAK,mBAAmB;AAC/C,mBAAO,IAAI,SAASA,UAAS,MAAM;AAAA,cACjC,QAAQA,UAAS;AAAA,cACjB,SAASA,UAAS;AAAA,YACpB,CAAC;AAAA,UACH;AACA,iBAAO,KAAK,KAAK;AAAA,QACnB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,cAAM,IAAI,OAAO,MAAM;AACvB,kBAAU,MAAM;AAAA,MAClB;AACA,UAAI;AACJ,UAAI;AACF,eAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,MAC/D,QAAQ;AACN,cAAMA,YAAW,MAAM,KAAK,iBAAiB;AAC7C,eAAO,IAAI,SAASA,UAAS,MAAM,EAAE,QAAQA,UAAS,QAAQ,SAASA,UAAS,QAAQ,CAAC;AAAA,MAC3F;AACA,YAAM,WAAW,MAAM,OAAO,EAAE,MAAM,SAAS,QAAQ,SAAS,QAAQ,QAAQ,OAAO,CAAC;AACxF,aAAO,IAAI,SAAS,SAAS,MAAM,EAAE,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAQ,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;AAGA,SAAS,iBACP,WACA,QACmC;AACnC,UAAQ,UAAU,IAAI;AAAA,IACpB,KAAK;AAAA,IACL,KAAK,cAAc;AACjB,YAAM,OAAO;AACb,UAAI,KAAK,MAAM,SAAS,UAAU,KAAK,MAAO,QAAO;AACrD,YAAM,MAAM,oBAAI,IAAY;AAC5B,iBAAW,SAAS,KAAK,OAGrB;AACF,cAAM,KAAK,MAAM,mBAAmB,MAAM,kBAAkB;AAC5D,YAAI,IAAI,IAAI,EAAE,EAAG,QAAO;AACxB,YAAI,IAAI,EAAE;AAAA,MACZ;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,eAAe;AAClB,YAAM,SAAU,OAAkD;AAClE,YAAM,YAAY,IAAI,IAAI,UAAU,gBAAgB;AACpD,UAAI,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,MAAM,eAAe,CAAC,GAAG;AACjE,eAAO;AAAA,MACT;AACA,aAAO,OAAO,WAAW,UAAU,OAAO,OAAO;AAAA,IACnD;AAAA,IACA,KAAK,cAAc;AACjB,YAAM,OAAQ,OAAiD;AAC/D,YAAM,WAAW,UAAU,KAAK;AAChC,aAAO,aAAa,UAAa,KAAK,mBAAmB,WACrD,6BACA;AAAA,IACN;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;","names":["VAULT_PROVIDER_WIRE_LIMITS","VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER","VAULT_PROVIDER_WIRE_VERSION","vaultProviderWireResponseKey","output","outcome","response"]}

package/dist/index.js

@@ -2,9 +2,9 @@ import {
   EMPTY_FINAL_REPLY_NOTICE,
   OpenGeniEmbeddingClient,
   turnCompletedWithEmptyFinalReply
-} from "./chunk-S3D75WSQ.js";
-import "./chunk-OAKHWFSV.js";
-import "./chunk-YDVPI7WT.js";
+} from "./chunk-N2I422X4.js";
+import "./chunk-PDU6EU2M.js";
+import "./chunk-JP62FZSI.js";
 import {
   humanizeModelSlug,
   isRawModelLabel,
@@ -20,16 +20,18 @@ import {
   resolveWorkspaceVoiceInputEnabled
 } from "./chunk-GZQSWAKD.js";
 import {
-  OPENGENI_TEST_REQUEST_NIL_ID,
   OPENGENI_WEBHOOK_HEADERS,
-  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
   OpenGeniSignatureError,
-  WORKSPACE_WEBHOOK_EVENT_TYPES,
-  signOpenGeniPayload,
   verifyCredentialProviderRequest,
-  verifyOpenGeniSignature,
   verifyWebhookEvent
-} from "./chunk-RJHCBZF7.js";
+} from "./chunk-VT4YM4XQ.js";
+import {
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature
+} from "./chunk-KGEABAID.js";
 import {
   CODEX_REALTIME_CONTEXT_APPEND_MAX_BYTES,
   CodexRealtimeMicrophoneError,
@@ -94,7 +96,7 @@ import {
   isOpenGeniSiteBridgeRequestMessage,
   isSiteCatalogStaleError,
   sanitizeOpenGeniSiteToolCallRequest
-} from "./chunk-JXXCTW5W.js";
+} from "./chunk-PBVUAXSU.js";
 import {
   OpenGeniToolCallError,
   OpenGeniToolReapprovalRequiredError,
@@ -118,7 +120,7 @@ import {
   vaultErrorCode,
   vaultErrorDetail,
   vaultsApi
-} from "./chunk-NEM5N6C6.js";
+} from "./chunk-JKG75TTU.js";
 import "./chunk-VPVMLM7Q.js";
 import {
   parseSseStream,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/prepared-mcp-setup.ts","../../contracts/src/tool-review-presentation.ts","../../contracts/src/mcp-endpoint.ts","../src/tool-display-metadata.ts","../src/mcp-output.ts","../src/desktop.ts","../src/terminal.ts","../src/workspace-instruction-policies.ts","../src/company-profile.ts","../src/company-brain.ts","../src/preference-registry.ts"],"sourcesContent":["import type {\n  CustomMcpSetupRequest,\n  PreparedMcpSetup,\n} from \"@opengeni/contracts/prepared-mcp-setup\";\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst keys = (value: Record<string, unknown>, allowed: string[]) =>\n  Object.keys(value).every((key) => allowed.includes(key));\nconst text = (value: unknown, max: number, min = 1): value is string =>\n  typeof value === \"string\" && value.length >= min && value.length <= max;\nconst trimmedText = (value: unknown, max: number): value is string =>\n  typeof value === \"string\" && text(value.trim(), max);\nconst headerPart = (value: unknown): value is string =>\n  text(value, 16_384, 0) && !/[\\r\\n\\0]/.test(value);\nconst fieldId = (value: unknown): value is string =>\n  typeof value === \"string\" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(value);\nconst endpoint = (value: unknown): value is string => {\n  if (!text(value, 2048)) return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" && !url.username && !url.password && !url.search && !url.hash;\n  } catch {\n    return false;\n  }\n};\n\n/** Browser/native-safe display projection. The API owns authoritative schema\n * validation; parity tests keep this lightweight parser aligned without pulling\n * schema runtimes into the SDK or replaying unknown fields into a secret form. */\nexport function parseCustomMcpSetupRequest(value: unknown): CustomMcpSetupRequest | null {\n  if (\n    !record(value) ||\n    !keys(value, [\"kind\", \"name\", \"endpointUrl\", \"rationale\", \"ownership\", \"mcpSetup\"]) ||\n    value.kind !== \"mcp\" ||\n    !trimmedText(value.name, 256) ||\n    !endpoint(value.endpointUrl) ||\n    !trimmedText(value.rationale, 2000)\n  )\n    return null;\n  const base = {\n    kind: \"mcp\" as const,\n    name: value.name.trim(),\n    endpointUrl: value.endpointUrl,\n    rationale: value.rationale.trim(),\n  };\n  if (value.ownership === undefined && value.mcpSetup === undefined) return base;\n  if (value.ownership !== \"personal\" && value.ownership !== \"workspace\") return null;\n  const setup = value.mcpSetup;\n  if (\n    !record(setup) ||\n    !keys(setup, [\"name\", \"endpointUrl\", \"headers\", \"secretFields\"]) ||\n    !trimmedText(setup.name, 256) ||\n    setup.name.trim() !== base.name ||\n    setup.endpointUrl !== base.endpointUrl ||\n    !Array.isArray(setup.headers) ||\n    setup.headers.length < 1 ||\n    setup.headers.length > 32 ||\n    !Array.isArray(setup.secretFields) ||\n    setup.secretFields.length > 32\n  )\n    return null;\n  const fields: PreparedMcpSetup[\"secretFields\"] = [];\n  const fieldIds = new Set<string>();\n  for (const field of setup.secretFields) {\n    if (\n      !record(field) ||\n      !keys(field, [\"id\", \"label\"]) ||\n      !fieldId(field.id) ||\n      !trimmedText(field.label, 256) ||\n      fieldIds.has(field.id)\n    )\n      return null;\n    fieldIds.add(field.id);\n    fields.push({ id: field.id, label: field.label.trim() });\n  }\n  const headers: PreparedMcpSetup[\"headers\"] = [];\n  const names = new Set<string>();\n  const used = new Set<string>();\n  for (const header of setup.headers) {\n    if (\n      !record(header) ||\n      !text(header.name, 256) ||\n      !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(header.name)\n    )\n      return null;\n    const name = header.name.toLowerCase();\n    if (names.has(name)) return null;\n    names.add(name);\n    if (\"value\" in header) {\n      if (\n        !keys(header, [\"name\", \"value\"]) ||\n        !headerPart(header.value) ||\n        !header.value ||\n        [\"authorization\", \"proxy-authorization\", \"cookie\", \"x-api-key\", \"api-key\"].includes(name)\n      )\n        return null;\n      headers.push({ name: header.name, value: header.value });\n    } else {\n      if (\n        !keys(header, [\"name\", \"secret\", \"prefix\", \"suffix\"]) ||\n        !fieldId(header.secret) ||\n        !fieldIds.has(header.secret) ||\n        (header.prefix !== undefined && !headerPart(header.prefix)) ||\n        (header.suffix !== undefined && !headerPart(header.suffix))\n      )\n        return null;\n      used.add(header.secret);\n      headers.push({\n        name: header.name,\n        secret: header.secret,\n        ...(header.prefix !== undefined ? { prefix: header.prefix as string } : {}),\n        ...(header.suffix !== undefined ? { suffix: header.suffix as string } : {}),\n      });\n    }\n  }\n  if (used.size !== fieldIds.size) return null;\n  return {\n    ...base,\n    ownership: value.ownership,\n    mcpSetup: { name: base.name, endpointUrl: base.endpointUrl, headers, secretFields: fields },\n  };\n}\n","import type {\n  ToolActionReview,\n  ToolReviewContext,\n  ToolReviewDetailsPage,\n} from \"./tool-action-review\";\n\nconst protectedName =\n  /password|passwd|secret|credential|authorization|cookie|(^|[_-])token($|[_-])|api[_-]?key|accessToken|refreshToken|privateKey/i;\nconst protectedReviewField = (key: string, fields: readonly string[] = []) =>\n  protectedName.test(key) || fields.includes(key) || fields.includes(\"*\");\nconst bound = (value: string, limit: number) =>\n  value.length > limit ? `${value.slice(0, limit)}…` : value;\nexport function toolReviewFieldLabel(key: string): string {\n  const label = key\n    .replace(/([a-z0-9])([A-Z])/g, \"$1 $2\")\n    .replace(/[_-]+/g, \" \")\n    .replace(/\\bids?\\b/gi, (word) => (word.length === 3 ? \"IDs\" : \"ID\"))\n    .replace(\n      /\\b(api|url|uri|http|https|ip|sql|json|html)(s?)\\b/gi,\n      (_word, name: string, plural: string) => `${name.toUpperCase()}${plural}`,\n    )\n    // Sentence case, keeping acronyms: \"Working Directory\" → \"Working directory\".\n    .replace(\n      /(?<=\\S\\s+)([A-Z])([a-z]+)\\b/g,\n      (_word, first: string, rest: string) => `${first.toLowerCase()}${rest}`,\n    )\n    .trim();\n  return label.charAt(0).toUpperCase() + label.slice(1);\n}\nexport function decodeReviewArguments(value: unknown): Record<string, unknown> | null {\n  // Historical SDK entries sometimes wrapped arguments in JSON. Decode only once.\n  let decoded = value;\n  if (typeof decoded === \"string\") {\n    try {\n      decoded = JSON.parse(decoded);\n    } catch {\n      return null;\n    }\n  }\n  return decoded && typeof decoded === \"object\" && !Array.isArray(decoded)\n    ? (decoded as Record<string, unknown>)\n    : null;\n}\nexport function safeReviewValue(\n  value: unknown,\n  key = \"\",\n  protectedFields: readonly string[] = [],\n  depth = 0,\n): unknown {\n  if (protectedReviewField(key, protectedFields)) return \"[Protected value]\";\n  if (depth > 20) return \"[Nested value; open this field for details]\";\n  if (Array.isArray(value))\n    return value.map((entry) => safeReviewValue(entry, \"\", protectedFields, depth + 1));\n  if (value && typeof value === \"object\")\n    return Object.fromEntries(\n      Object.entries(value).map(([name, entry]) => [\n        name,\n        safeReviewValue(entry, name, protectedFields, depth + 1),\n      ]),\n    );\n  return value;\n}\nfunction valueText(value: unknown): string {\n  return typeof value === \"string\"\n    ? value\n    : value === null\n      ? \"None\"\n      : typeof value === \"boolean\"\n        ? value\n          ? \"Yes\"\n          : \"No\"\n        : (JSON.stringify(value) ?? \"Unavailable\");\n}\nconst pointer = (name: string) => `/${name.replaceAll(\"~\", \"~0\").replaceAll(\"/\", \"~1\")}`;\n// Long arbitrary property names remain readable without placing them in every\n// preview or URL. An indexed segment opens their saved name and value together.\nconst fieldPointer = (key: string, index: number, parent = \"\") =>\n  pointer(key).length > 256 || parent.length + pointer(key).length > 1024\n    ? `/~2${index}`\n    : pointer(key);\n\nexport function toolReviewFields(\n  argumentsValue: unknown,\n  context?: ToolReviewContext,\n): { fields: ToolActionReview[\"fields\"]; moreFields: number } {\n  const args = decodeReviewArguments(argumentsValue);\n  if (!args) return { fields: [], moreFields: 0 };\n  const entries = Object.entries(args);\n  if (context?.email) {\n    const email = toolReviewFields(context.email);\n    const original = toolReviewFields(args, { ...context, email: undefined });\n    const fields = [\n      ...email.fields\n        .filter(\n          (field) =>\n            field.path !== \"/contentSha256\" && field.path !== \"/htmlBody\" && field.preview !== \"\",\n        )\n        .map((field) => ({\n          ...field,\n          label: field.path === \"/textBody\" ? \"Message\" : field.label,\n          path: `/$email${field.path}`,\n          ...(field.path === \"/attachments\"\n            ? {\n                preview: context\n                  .email!.attachments.map((attachment) => attachment.name)\n                  .join(\", \")\n                  .slice(0, 240),\n              }\n            : {}),\n        })),\n      ...original.fields.filter(\n        (field) =>\n          ![\n            \"/raw\",\n            \"/expectedContentSha256\",\n            \"/from\",\n            \"/to\",\n            \"/cc\",\n            \"/bcc\",\n            \"/subject\",\n            \"/body\",\n            \"/textBody\",\n            \"/htmlBody\",\n            \"/attachments\",\n          ].includes(field.path),\n      ),\n    ];\n    return {\n      fields: fields.slice(0, 16),\n      moreFields: original.moreFields + Math.max(0, fields.length - 16),\n    };\n  }\n  return {\n    moreFields: Math.max(0, entries.length - 16),\n    fields: entries.slice(0, 16).map(([key, value], index) => {\n      const hidden = protectedReviewField(key, context?.protectedFields);\n      const safe = hidden ? \"[Protected value]\" : value;\n      const count = !hidden && Array.isArray(value) ? value.length : undefined;\n      const compactList =\n        !hidden &&\n        Array.isArray(value) &&\n        value.length > 0 &&\n        value.length <= 4 &&\n        value.every(\n          (entry) =>\n            typeof entry === \"string\" || typeof entry === \"number\" || typeof entry === \"boolean\",\n        )\n          ? value.map(valueText).join(\", \")\n          : undefined;\n      const text =\n        compactList !== undefined\n          ? compactList\n          : count !== undefined\n            ? `${count.toLocaleString(\"en-US\")} item${count === 1 ? \"\" : \"s\"}`\n            : safe && typeof safe === \"object\"\n              ? `${Object.keys(safe).length} field${Object.keys(safe).length === 1 ? \"\" : \"s\"}`\n              : valueText(safe);\n      return {\n        path: fieldPointer(key, index),\n        label: bound(\n          (context?.fieldLabels && Object.hasOwn(context.fieldLabels, key)\n            ? context.fieldLabels[key]\n            : undefined) ?? toolReviewFieldLabel(key),\n          256,\n        ),\n        preview: bound(text, 240),\n        ...(count !== undefined ? { count } : {}),\n        truncated:\n          !hidden &&\n          (text.length > 240 ||\n            (compactList === undefined && typeof value === \"object\" && value !== null)),\n        ...(hidden ? { protected: true } : {}),\n      };\n    }),\n  };\n}\n\n/** Deterministic consequences from the reviewed bytes. Unknown fields remain visible. */\nexport function toolReviewAction(\n  toolName: string,\n  argumentsValue: unknown,\n  context?: ToolReviewContext,\n): Pick<\n  ToolActionReview,\n  \"title\" | \"approveLabel\" | \"effects\" | \"consequence\" | \"selectionCount\" | \"selectionKind\"\n> {\n  const fallback = {\n    title:\n      context?.title ??\n      bound(\n        toolReviewFieldLabel(\n          toolName.replace(/^mcp_[^_]+__/, \"\").replace(/^batch[_-](?=[a-z])/i, \"\"),\n        ),\n        256,\n      ),\n    approveLabel: \"Approve action\",\n    effects: [] as string[],\n  };\n  if (context?.kind !== \"gmail\") return fallback;\n  const args = decodeReviewArguments(argumentsValue);\n  if (!args) return fallback;\n  const thread = toolName.endsWith(\"_thread\");\n  const selectionKind = thread ? (\"threads\" as const) : (\"messages\" as const);\n  const ids =\n    thread && typeof args.threadId === \"string\"\n      ? [args.threadId]\n      : Array.isArray(args.messageIds)\n        ? args.messageIds\n        : typeof args.messageId === \"string\"\n          ? [args.messageId]\n          : null;\n  const selectionCount = ids?.every((id) => typeof id === \"string\") ? new Set(ids).size : undefined;\n  const noun =\n    selectionCount === undefined\n      ? thread\n        ? \"conversations\"\n        : \"messages\"\n      : `${selectionCount.toLocaleString(\"en-US\")} ${thread ? \"conversation\" : \"message\"}${selectionCount === 1 ? \"\" : \"s\"}`;\n  const addValues = toolName.startsWith(\"label_\") ? args.labelIds : args.addLabelIds;\n  const adds = Array.isArray(addValues)\n    ? addValues.filter((v): v is string => typeof v === \"string\")\n    : [];\n  const removeValues = toolName.startsWith(\"unlabel_\") ? args.labelIds : args.removeLabelIds;\n  const removes = Array.isArray(removeValues)\n    ? removeValues.filter((v): v is string => typeof v === \"string\")\n    : [];\n  const labelEffect = (label: string, adding: boolean): string => {\n    const known: Record<string, [string, string]> = {\n      TRASH: [\"Move to Trash\", \"Remove from Trash\"],\n      INBOX: [\"Move to Inbox\", \"Remove from Inbox\"],\n      UNREAD: [\"Mark as unread\", \"Mark as read\"],\n      STARRED: [\"Add star\", \"Remove star\"],\n      SPAM: [\"Mark as spam\", \"Remove from Spam\"],\n      IMPORTANT: [\"Mark as important\", \"Remove importance\"],\n    };\n    return (\n      (Object.hasOwn(known, label) ? known[label]?.[adding ? 0 : 1] : undefined) ??\n      `${adding ? \"Add\" : \"Remove\"} label ${bound(label, 120)}`\n    );\n  };\n  const effects = [\n    ...adds.map((id) => labelEffect(id, true)),\n    ...removes.map((id) => labelEffect(id, false)),\n  ];\n  if (\n    [\n      \"batch_modify_messages\",\n      \"modify_message\",\n      \"modify_thread\",\n      \"label_message\",\n      \"label_thread\",\n      \"unlabel_message\",\n      \"unlabel_thread\",\n    ].includes(toolName)\n  ) {\n    const trash = adds.includes(\"TRASH\");\n    return {\n      title: trash ? `Move ${noun} to Trash` : `Update ${noun}`,\n      approveLabel: trash ? \"Move to Trash\" : \"Apply changes\",\n      effects,\n      ...(selectionCount === undefined ? {} : { selectionCount, selectionKind }),\n      ...(trash\n        ? { consequence: \"Messages stay recoverable in Trash until Gmail deletes them.\" }\n        : thread\n          ? { consequence: \"Applies to every message in the conversation.\" }\n          : {}),\n    };\n  }\n  if ([\"trash_message\", \"restore_message\", \"trash_thread\", \"restore_thread\"].includes(toolName))\n    return {\n      title: toolName.startsWith(\"trash_\") ? `Move ${noun} to Trash` : `Remove ${noun} from Trash`,\n      approveLabel: toolName.startsWith(\"trash_\") ? \"Move to Trash\" : \"Remove from Trash\",\n      effects,\n      ...(selectionCount === undefined ? {} : { selectionCount, selectionKind }),\n    };\n  const named: Record<string, [string, string]> = {\n    send_message: [\"Send email\", \"Send email\"],\n    send_draft: [\"Send draft\", \"Send draft\"],\n    create_draft: [\"Create email draft\", \"Create draft\"],\n    update_draft: [\"Update email draft\", \"Update draft\"],\n    delete_draft: [\"Delete email draft\", \"Delete draft\"],\n    create_label: [\"Create label\", \"Create label\"],\n    update_label: [\"Update label\", \"Update label\"],\n    delete_label: [\"Delete label\", \"Delete label\"],\n  };\n  const action = Object.hasOwn(named, toolName) ? named[toolName] : undefined;\n  return action ? { title: action[0], approveLabel: action[1], effects } : fallback;\n}\n\n/** A bounded slice of the immutable saved arguments; never evaluates a fresh provider query. */\nexport function toolReviewDetails(\n  argumentsValue: unknown,\n  context: ToolReviewContext | undefined,\n  path: string,\n  offset: number,\n  limit = 25,\n): Omit<ToolReviewDetailsPage, \"id\" | \"actionDigest\" | \"version\"> {\n  if (\n    !Number.isSafeInteger(offset) ||\n    offset < 0 ||\n    !Number.isSafeInteger(limit) ||\n    limit < 1 ||\n    limit > 50\n  )\n    throw new Error(\"Invalid review page\");\n  const args = decodeReviewArguments(argumentsValue);\n  let value: unknown = context?.email ? { ...args, $email: context.email } : args;\n  if (path !== \"\") {\n    if (!path.startsWith(\"/\")) throw new Error(\"Invalid review field\");\n    for (const escaped of path.slice(1).split(\"/\")) {\n      if (/^~2\\d+$/.test(escaped)) {\n        if (!value || typeof value !== \"object\" || Array.isArray(value))\n          throw new Error(\"Review field not found\");\n        const selected = Object.entries(value)[Number(escaped.slice(2))];\n        if (!selected) throw new Error(\"Review field not found\");\n        value = {\n          fieldName: selected[0],\n          value: protectedReviewField(selected[0], context?.protectedFields)\n            ? \"[Protected value]\"\n            : selected[1],\n        };\n        continue;\n      }\n      const key = escaped.replaceAll(\"~1\", \"/\").replaceAll(\"~0\", \"~\");\n      if (protectedReviewField(key, context?.protectedFields)) {\n        value = \"[Protected value]\";\n        break;\n      }\n      if (!value || typeof value !== \"object\" || !Object.hasOwn(value, key))\n        throw new Error(\"Review field not found\");\n      value = (value as Record<string, unknown>)[key];\n    }\n  }\n  type DetailItem = ToolReviewDetailsPage[\"items\"][number];\n  const preview = (\n    entry: unknown,\n    key: string,\n    childPath: string,\n  ): Pick<DetailItem, \"value\" | \"truncated\" | \"path\"> => {\n    const hidden = protectedReviewField(key, context?.protectedFields);\n    if (!hidden && entry !== null && typeof entry === \"object\") {\n      const count = Array.isArray(entry) ? entry.length : Object.keys(entry).length;\n      return {\n        value: `${count.toLocaleString(\"en-US\")} ${Array.isArray(entry) ? (count === 1 ? \"item\" : \"items\") : count === 1 ? \"field\" : \"fields\"}`,\n        path: childPath,\n        truncated: true,\n      };\n    }\n    const text = valueText(safeReviewValue(entry, key, context?.protectedFields));\n    return {\n      value: bound(text, 4000),\n      ...(hidden ? {} : { path: childPath }),\n      truncated: !hidden && text.length > 4000,\n    };\n  };\n  let total: number;\n  let items: DetailItem[];\n  if (Array.isArray(value)) {\n    total = value.length;\n    items = value.slice(offset, offset + limit).map((entry, index) => ({\n      label: `${offset + index + 1}`,\n      ...preview(entry, \"\", `${path}/${offset + index}`),\n    }));\n  } else if (value && typeof value === \"object\") {\n    const entries = Object.entries(value);\n    total = entries.length;\n    items = entries.slice(offset, offset + limit).map(([key, entry], index) => ({\n      label: bound(\n        (context?.fieldLabels && Object.hasOwn(context.fieldLabels, key)\n          ? context.fieldLabels[key]\n          : undefined) ?? toolReviewFieldLabel(key),\n        256,\n      ),\n      ...preview(entry, key, `${path}${fieldPointer(key, offset + index, path)}`),\n    }));\n  } else {\n    const text = valueText(value);\n    total = Math.max(1, Math.ceil(text.length / 4000));\n    items = Array.from({ length: Math.max(0, Math.min(limit, total - offset)) }, (_, index) => ({\n      label: `Part ${offset + index + 1}`,\n      value: text.slice((offset + index) * 4000, (offset + index + 1) * 4000),\n    }));\n  }\n  return { path, items, total, nextOffset: offset + limit < total ? offset + limit : null };\n}\n","/** Exact endpoint identity: normalize URL syntax, preserve paths and query parameters. */\nexport function mcpEndpointIdentity(value: string | null | undefined): string | null {\n  if (!value) return null;\n  try {\n    const url = new URL(value);\n    if (![\"https:\", \"http:\"].includes(url.protocol) || url.username || url.password) return null;\n    url.hash = \"\";\n    return url.href;\n  } catch {\n    return null;\n  }\n}\n\nexport function pluginMcpUnavailableReason(server: {\n  endpoint: string | null;\n  transport?: string;\n  requiresConfiguration?: boolean;\n}): string | null {\n  if (server.transport === \"stdio\" || !server.endpoint) return \"Requires a local runtime\";\n  if (\n    server.transport &&\n    ![\"http\", \"streamable-http\", \"streamable_http\"].includes(server.transport)\n  )\n    return \"Unsupported transport: \" + server.transport;\n  if (server.requiresConfiguration || server.endpoint.includes(\"{\"))\n    return \"Requires custom connection configuration\";\n  const endpoint = mcpEndpointIdentity(server.endpoint);\n  if (!endpoint?.startsWith(\"https://\")) return \"Requires a valid HTTPS endpoint\";\n  return null;\n}\n","import type { ToolDisplayMetadata } from \"@opengeni/contracts\";\n\n/** Browser/native-safe event projection; do not import server schema runtimes. */\nexport function parseToolDisplayMetadata(value: unknown): ToolDisplayMetadata | undefined {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined;\n  const item = value as Record<string, unknown>;\n  if (\n    Object.keys(item).some(\n      (key) => ![\"toolName\", \"title\", \"accountLabel\", \"connector\", \"providerDomain\"].includes(key),\n    )\n  )\n    return undefined;\n  const text = (v: unknown, max: number): v is string =>\n    typeof v === \"string\" && v.length > 0 && v.length <= max;\n  if (!text(item.toolName, 512) || /[\\u0000-\\u001f\\u007f]/u.test(item.toolName)) return undefined;\n  if (item.title !== undefined && !text(item.title, 512)) return undefined;\n  if (item.accountLabel !== undefined && !text(item.accountLabel, 1024)) return undefined;\n  if (item.connector !== undefined && !text(item.connector, 512)) return undefined;\n  if (item.providerDomain !== undefined && !text(item.providerDomain, 253)) return undefined;\n  return {\n    toolName: item.toolName,\n    ...(item.title !== undefined ? { title: item.title as string } : {}),\n    ...(item.accountLabel !== undefined ? { accountLabel: item.accountLabel as string } : {}),\n    ...(item.connector !== undefined ? { connector: item.connector as string } : {}),\n    ...(item.providerDomain !== undefined ? { providerDomain: item.providerDomain as string } : {}),\n  };\n}\n","/**\n * A transport-tolerant MCP tool result.\n *\n * `value` is the canonical machine-readable payload after recognized MCP/JSON\n * envelopes are removed. `text` is the best presentation string without\n * discarding structured data. `raw` always retains the original evidence.\n */\nexport type NormalizedMcpOutput = Readonly<{\n  raw: unknown;\n  value: unknown;\n  text: string;\n  isError: boolean;\n}>;\n\nconst MAX_MCP_OUTPUT_DEPTH = 8;\nconst RESULT_ENVELOPE_KEYS = new Set([\"result\", \"isError\", \"jsonrpc\", \"id\", \"_meta\"]);\n\n/** Normalize common direct, JSON, and standard MCP result envelopes without throwing. */\nexport function normalizeMcpOutput(output: unknown): NormalizedMcpOutput {\n  const normalized = normalizeValue(output, 0, new Set<object>());\n  return {\n    raw: output,\n    value: normalized.value,\n    text: normalized.text,\n    isError: normalized.isError,\n  };\n}\n\ntype NormalizedValue = Omit<NormalizedMcpOutput, \"raw\">;\n\nfunction normalizeValue(value: unknown, depth: number, ancestors: Set<object>): NormalizedValue {\n  if (value === null || value === undefined) {\n    return { value, text: \"\", isError: false };\n  }\n  if (typeof value === \"string\") {\n    return normalizeText(value, depth, ancestors);\n  }\n  if (typeof value !== \"object\") {\n    return { value, text: String(value), isError: false };\n  }\n  if (depth >= MAX_MCP_OUTPUT_DEPTH || ancestors.has(value)) {\n    return { value, text: safeStringify(value), isError: false };\n  }\n\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value)) {\n      return { value, text: safeStringify(value), isError: false };\n    }\n\n    const record = value as Record<string, unknown>;\n    const envelopeError = record.isError === true;\n\n    if (record.type === \"text\" && typeof record.text === \"string\") {\n      const normalized = normalizeText(record.text, depth + 1, ancestors);\n      return {\n        value: normalized.value,\n        text: record.text,\n        isError: envelopeError || normalized.isError,\n      };\n    }\n\n    if (\"structuredContent\" in record) {\n      const normalized = normalizeValue(record.structuredContent, depth + 1, ancestors);\n      return {\n        value: normalized.value,\n        text: firstMcpText(record.content) ?? normalized.text,\n        isError: envelopeError || normalized.isError,\n      };\n    }\n\n    if (isMcpContent(record.content)) {\n      const text = firstMcpText(record.content);\n      if (text !== null) {\n        const normalized = normalizeText(text, depth + 1, ancestors);\n        return {\n          value: normalized.value,\n          text,\n          isError: envelopeError || normalized.isError,\n        };\n      }\n      return {\n        value,\n        text: safeStringify(value),\n        isError: envelopeError,\n      };\n    }\n\n    if (isResultEnvelope(record)) {\n      const normalized = normalizeValue(record.result, depth + 1, ancestors);\n      return {\n        value: normalized.value,\n        text: normalized.text,\n        isError: envelopeError || normalized.isError,\n      };\n    }\n\n    return {\n      value,\n      text: safeStringify(value),\n      isError: envelopeError,\n    };\n  } finally {\n    ancestors.delete(value);\n  }\n}\n\nfunction normalizeText(text: string, depth: number, ancestors: Set<object>): NormalizedValue {\n  try {\n    const parsed: unknown = JSON.parse(text);\n    const normalized = normalizeValue(parsed, depth + 1, ancestors);\n    return {\n      value: normalized.value,\n      text,\n      isError: normalized.isError,\n    };\n  } catch {\n    return { value: text, text, isError: false };\n  }\n}\n\nfunction isMcpContent(value: unknown): value is readonly Record<string, unknown>[] {\n  return (\n    Array.isArray(value) &&\n    value.some(\n      (part) =>\n        part !== null &&\n        typeof part === \"object\" &&\n        typeof (part as { type?: unknown }).type === \"string\",\n    )\n  );\n}\n\nfunction firstMcpText(value: unknown): string | null {\n  if (!Array.isArray(value)) {\n    return null;\n  }\n  for (const part of value) {\n    if (\n      part !== null &&\n      typeof part === \"object\" &&\n      (part as { type?: unknown }).type === \"text\" &&\n      typeof (part as { text?: unknown }).text === \"string\"\n    ) {\n      return (part as { text: string }).text;\n    }\n  }\n  return null;\n}\n\nfunction isResultEnvelope(record: Record<string, unknown>): boolean {\n  return \"result\" in record && Object.keys(record).every((key) => RESULT_ENVELOPE_KEYS.has(key));\n}\n\nfunction safeStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value) ?? \"\";\n  } catch {\n    return String(value);\n  }\n}\n","// Zero-dependency desktop (noVNC) transport contract.\n//\n// The actual `@novnc/novnc` RFB import is a browser-only DOM dependency and\n// lives in `@opengeni/react` (lazily imported, SSR-safe). The framework-agnostic\n// SDK ships only the transport CONTRACT: a URL assembler, the minimal RFB\n// surface the component drives, the connection state machine, and the\n// rotation/fence reducers — all pure and unit-testable, with no DOM and no deps.\n//\n// Channel A (terminal-as-events, files, git) needs NO new transport here: those\n// are event projections + the synchronous fs/git/terminal point queries on\n// `OpenGeniClient`. Only the desktop pixel plane (Channel B, direct-to-provider)\n// needs this.\n\nimport type { DesktopStreamCapability, StreamUrlRotatedPayload } from \"./types\";\n\n/**\n * Translate the negotiated desktop capability into the WebSocket URL the noVNC\n * RFB client connects to. The scoped provider token is ALREADY embedded in the\n * minted `url` (Modal tunnel host, Blaxel `bl_preview_token`, Daytona signed\n * preview) by `session.resolveExposedPort(6080)` — we do NOT append `cap.token`\n * as a query param (that double-auth was an adversarial-review bug: the box runs\n * `-nopw` in v1, so the RFB password is meaningless and the real auth is the\n * tunnel token in the host). We only normalize the scheme to `ws`/`wss` and, when\n * the minted URL points at a `vnc.html` viewer page, rewrite it to the\n * websockify socket path noVNC actually dials.\n */\nexport function desktopSocketUrl(cap: Pick<DesktopStreamCapability, \"url\">): string {\n  if (!cap.url) {\n    throw new Error(\"desktop capability has no url (transport is null)\");\n  }\n  const u = new URL(cap.url);\n  // https → wss, http → ws (noVNC dials a WebSocket, not the HTTP viewer page).\n  if (u.protocol === \"https:\") {\n    u.protocol = \"wss:\";\n  } else if (u.protocol === \"http:\") {\n    u.protocol = \"ws:\";\n  }\n  // A minted `…/vnc.html` (or `…/vnc_lite.html`) viewer page → the websockify\n  // socket the page itself would open (`…/websockify`). A bare host/path with no\n  // viewer page is already the socket path; leave it untouched.\n  if (/\\/vnc(_lite)?\\.html$/.test(u.pathname)) {\n    u.pathname = u.pathname.replace(/\\/vnc(_lite)?\\.html$/, \"/websockify\");\n    u.search = \"\";\n    u.hash = \"\";\n  }\n  return u.toString();\n}\n\n/**\n * The minimal RFB surface the React component drives. Lets tests (and 3rd\n * parties swapping noVNC for a WebRTC client in v3) provide a fake without the\n * DOM. Matches `@novnc/novnc`'s RFB constructor + lifecycle.\n */\nexport interface DesktopRfbLike {\n  viewOnly: boolean;\n  scaleViewport: boolean;\n  /**\n   * 1:1 viewport clipping. We always drive this FALSE: with clipping on, noVNC\n   * paints the framebuffer pixel-for-pixel and scrolls/crops to the container\n   * (the \"zoomed in\" look). FALSE lets `scaleViewport` shrink the 1280x800 frame\n   * to fit the panel (aspect-preserved). Declared so the hook can pin it instead\n   * of relying on noVNC's default — `scaleViewport=true` forces clip off\n   * internally, but a stale/partial state on reconnect could leave it on.\n   */\n  clipViewport: boolean;\n  addEventListener(\n    type: \"connect\" | \"disconnect\" | \"securityfailure\",\n    cb: (e?: unknown) => void,\n  ): void;\n  removeEventListener?: (\n    type: \"connect\" | \"disconnect\" | \"securityfailure\",\n    cb: (e?: unknown) => void,\n  ) => void;\n  /** Send clipboard text over the already-open RFB connection. */\n  clipboardPasteFrom?(text: string): void;\n  /** Send one RFB key event. A missing `down` emits a complete key press. */\n  sendKey?(keysym: number, code: string, down?: boolean): void;\n  /** Focus or release the RFB keyboard sink without reconnecting. */\n  focus?(options?: FocusOptions): void;\n  blur?(): void;\n  disconnect(): void;\n}\n\nexport type DesktopRfbFactory = (\n  target: HTMLElement,\n  url: string,\n  opts: {\n    credentials?: { password?: string | undefined } | undefined;\n    wsProtocols?: string[] | undefined;\n  },\n) => DesktopRfbLike;\n\nexport type DesktopConnectionState =\n  | \"idle\"\n  | \"negotiating\"\n  | \"connecting\"\n  | \"connected\"\n  | \"rotating\"\n  | \"reconnecting\"\n  | \"error\"\n  | \"ended\";\n\nexport type DesktopStreamEvent =\n  | { type: \"negotiated\" }\n  | { type: \"connected\" }\n  | { type: \"disconnected\" }\n  | { type: \"rotate\" }\n  | { type: \"fail\" }\n  | { type: \"abort\" };\n\n/**\n * Pure reducer for the desktop connection lifecycle. The component owns the RFB\n * object + DOM; this owns the transitions so they are unit-testable. Mirrors the\n * Channel-A stream reducer discipline.\n */\nexport function nextDesktopState(\n  current: DesktopConnectionState,\n  ev: DesktopStreamEvent,\n): DesktopConnectionState {\n  switch (ev.type) {\n    case \"negotiated\":\n      return \"connecting\";\n    case \"connected\":\n      return \"connected\";\n    case \"rotate\":\n      return current === \"connected\" ? \"rotating\" : current;\n    case \"disconnected\":\n      // A deliberate teardown (ended) stays ended; everything else reconnects.\n      return current === \"ended\" ? \"ended\" : \"reconnecting\";\n    case \"fail\":\n      return \"error\";\n    case \"abort\":\n      return \"ended\";\n    default:\n      return current;\n  }\n}\n\n// `DesktopStreamCapability` is the desktop cell of `SessionCapabilities`; alias\n// it for the rotation reducer below without depending on the whole doc.\nexport type DesktopStreamCapabilityLike = {\n  url: string | null;\n  token: string | null;\n  expiresAt: string | null;\n};\n\n/**\n * Apply a `stream.url.rotated` event onto a desktop capability, fencing on\n * leaseEpoch (split-brain). A rotation minted under an epoch the client has\n * already advanced PAST is from a superseded owner and is dropped (returns\n * null); otherwise the fresh url/token/expiresAt are folded in.\n */\nexport function applyUrlRotation<T extends DesktopStreamCapabilityLike>(\n  cap: T,\n  payload: StreamUrlRotatedPayload,\n  knownEpoch: number,\n): T | null {\n  if (payload.leaseEpoch < knownEpoch) {\n    return null;\n  }\n  return { ...cap, url: payload.url, token: payload.token, expiresAt: payload.expiresAt };\n}\n","// Zero-dependency interactive-terminal (ttyd PTY-over-websocket) transport\n// contract. Symmetric with `desktop.ts`: the SDK ships only the pure transport\n// CONTRACT (a URL assembler + the ttyd wire-protocol frame codec), with no DOM\n// and no deps. The actual WebSocket open + xterm attach lives in `@opengeni/react`\n// (`use-terminal-stream.ts`).\n//\n// The interactive terminal is a REAL PTY streamed over the SAME Modal raw-TLS\n// tunnel as the desktop noVNC, with the SAME scoped stream-token mechanism. The\n// box bakes `ttyd` on `TERMINAL_STREAM_PORT` (7681); `session.resolveExposedPort`\n// mints the tunnel URL. The Terminal capability cell carries transport \"pty-ws\" +\n// that url + the scoped token when the box is warm and a viewer is attached.\n\nimport type { TerminalCapability } from \"./types\";\n\n/**\n * Translate the negotiated `pty-ws` Terminal capability into the WebSocket URL\n * the ttyd client dials. The scoped provider token is ALREADY embedded in the\n * minted `url` (the Modal tunnel host) by `session.resolveExposedPort(7681)` —\n * we do NOT append `cap.token` (identical posture to the desktop: the gate is the\n * unguessable short-TTL tunnel URL + the server-recorded scoped stream token; ttyd\n * runs `--writable` with no `-c` credential in v1). We only normalize the scheme\n * to `ws`/`wss`; a bare host is already the ttyd websocket endpoint.\n */\nexport function terminalSocketUrl(cap: Pick<TerminalCapability, \"url\">): string {\n  if (!cap.url) {\n    throw new Error(\"terminal capability has no url (transport is not pty-ws)\");\n  }\n  const u = new URL(cap.url);\n  // https → wss, http → ws (ttyd is dialed as a WebSocket, not an HTTP page).\n  if (u.protocol === \"https:\") {\n    u.protocol = \"wss:\";\n  } else if (u.protocol === \"http:\") {\n    u.protocol = \"ws:\";\n  }\n  return u.toString();\n}\n\n// ── ttyd wire protocol ───────────────────────────────────────────────────────\n// ttyd frames are a single ASCII command char + payload. These mirror ttyd's\n// `protocol.h` Command enum. Client→server and server→client share the byte 0/1/2\n// values but mean different things per direction (see below).\n\n/** ttyd subprotocol — REQUIRED on the WebSocket handshake or ttyd refuses it. */\nexport const TTYD_SUBPROTOCOL = \"tty\";\n\n/** Client→server command bytes (the first char of each outbound text frame). */\nexport const TtydClientCommand = {\n  /** stdin: \"0\" + raw input bytes. */\n  INPUT: \"0\",\n  /** window resize: \"1\" + JSON.stringify({ columns, rows }). */\n  RESIZE: \"1\",\n  /** flow-control pause (back-pressure): \"2\". */\n  PAUSE: \"2\",\n  /** flow-control resume: \"3\". */\n  RESUME: \"3\",\n} as const;\n\n/** Server→client command bytes (the first char of each inbound frame). */\nexport const TtydServerCommand = {\n  /** stdout/stderr: \"0\" + raw output bytes (write the rest into xterm). */\n  OUTPUT: \"0\",\n  /** set the window title: \"1\" + title string. */\n  SET_WINDOW_TITLE: \"1\",\n  /** ttyd client preferences JSON: \"2\" + json (ignored by us). */\n  SET_PREFERENCES: \"2\",\n} as const;\n\n/**\n * The ttyd handshake's first frame: an auth message. ttyd expects\n * `JSON.stringify({ AuthToken })` as the FIRST text frame on the socket. We send\n * an empty token — our gate is the tunnel URL + scoped stream token, NOT a ttyd\n * `-c` basic-auth credential (which the box does not set in v1). Optional ttyd\n * `columns`/`rows` can ride this frame to seed the PTY size before the first\n * resize. Pure (string-building only) so it stays unit-testable in the SDK.\n */\nexport function ttydAuthFrame(opts?: { columns?: number; rows?: number }): string {\n  const frame: { AuthToken: string; columns?: number; rows?: number } = { AuthToken: \"\" };\n  if (opts?.columns && opts.columns > 0) frame.columns = opts.columns;\n  if (opts?.rows && opts.rows > 0) frame.rows = opts.rows;\n  return JSON.stringify(frame);\n}\n\n/** Build a client→server INPUT (stdin) frame: \"0\" + data. */\nexport function ttydInputFrame(data: string): string {\n  return TtydClientCommand.INPUT + data;\n}\n\n/** Build a client→server RESIZE frame: \"1\" + JSON.stringify({ columns, rows }). */\nexport function ttydResizeFrame(columns: number, rows: number): string {\n  return TtydClientCommand.RESIZE + JSON.stringify({ columns, rows });\n}\n","export const WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS = 262_144;\n\nexport type WorkspaceInstructionPolicyKind = \"charter\" | \"policy\";\nexport type WorkspaceInstructionPolicyScope = \"global\" | \"role\";\nexport type WorkspaceInstructionPolicyProvenanceSource =\n  | \"human\"\n  | \"onboarding\"\n  | \"agent_learning\"\n  | \"knowledge_proposal\"\n  | \"legacy_import\";\nexport type WorkspaceInstructionPolicyDraftProvenanceSource = Exclude<\n  WorkspaceInstructionPolicyProvenanceSource,\n  \"legacy_import\" | \"agent_learning\"\n>;\nexport type WorkspaceInstructionPolicyActivationType = \"activate\" | \"rollback\";\n\nexport function normalizeWorkspaceInstructionPolicyRoleKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n\nexport type WorkspaceInstructionPolicyTarget = {\n  kind: WorkspaceInstructionPolicyKind;\n  scope: WorkspaceInstructionPolicyScope;\n  roleKey: string | null;\n};\n\nexport type WorkspaceInstructionPolicyRevisionIdentity = {\n  id: string;\n  revision: number;\n  contentHash: string;\n};\n\nexport type WorkspaceInstructionPolicyRevision = WorkspaceInstructionPolicyRevisionIdentity &\n  WorkspaceInstructionPolicyTarget & {\n    operationId: string;\n    accountId: string;\n    workspaceId: string;\n    content: string;\n    provenance: {\n      source: WorkspaceInstructionPolicyProvenanceSource;\n      sourceId: string | null;\n    };\n    supersedesRevisionId: string | null;\n    createdBySubjectId: string;\n    createdAt: string;\n  };\n\nexport type WorkspaceInstructionPolicyHead = WorkspaceInstructionPolicyTarget & {\n  workspaceId: string;\n  revisionId: string;\n  revision: number;\n  contentHash: string;\n  activationVersion: number;\n  activatedAt: string;\n};\n\nexport type WorkspaceInstructionPolicyInactiveHead = WorkspaceInstructionPolicyTarget & {\n  workspaceId: string;\n  activationVersion: number;\n  deactivatedAt: string;\n};\n\nexport type WorkspaceInstructionPolicyActivationEvent = WorkspaceInstructionPolicyTarget & {\n  id: string;\n  operationId: string;\n  accountId: string;\n  workspaceId: string;\n  type: WorkspaceInstructionPolicyActivationType;\n  activationVersion: number;\n  oldRevision: WorkspaceInstructionPolicyRevisionIdentity | null;\n  newRevision: WorkspaceInstructionPolicyRevisionIdentity;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\n\nexport type WorkspaceInstructionPolicyDeactivationEvent = WorkspaceInstructionPolicyTarget & {\n  id: string;\n  operationId: string;\n  accountId: string;\n  workspaceId: string;\n  type: \"automatic_deactivate\";\n  activationVersion: number;\n  oldRevision: WorkspaceInstructionPolicyRevisionIdentity;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\n\nexport type CreateWorkspaceInstructionPolicyDraftRequest = WorkspaceInstructionPolicyTarget & {\n  operationId?: string;\n  content: string;\n  provenanceSource?: WorkspaceInstructionPolicyDraftProvenanceSource;\n  provenanceSourceId?: string | null;\n  supersedesRevisionId?: string | null;\n};\n\nexport type ImportLegacyWorkspaceInstructionPolicyDraftRequest = {\n  operationId?: string;\n  supersedesRevisionId?: string | null;\n};\n\nexport type WorkspaceInstructionPolicyListOptions = {\n  kind?: WorkspaceInstructionPolicyKind;\n  scope?: WorkspaceInstructionPolicyScope;\n  roleKey?: string;\n  afterRevision?: number;\n  limit?: number;\n};\n\nexport type WorkspaceInstructionPolicyListResponse = {\n  revisions: WorkspaceInstructionPolicyRevision[];\n  activeHeads: WorkspaceInstructionPolicyHead[];\n  /** Additive current inactive target boundaries; absent on pre-controller servers. */\n  inactiveHeads?: WorkspaceInstructionPolicyInactiveHead[];\n  inactiveHeadsTruncated?: boolean;\n  activationEvents: WorkspaceInstructionPolicyActivationEvent[];\n  /** Additive lifecycle history; absent on pre-controller servers. */\n  deactivationEvents?: WorkspaceInstructionPolicyDeactivationEvent[];\n  nextAfterRevision: number | null;\n};\n\nexport type WorkspaceInstructionPolicyDiffRequest = {\n  fromRevisionId: string;\n  toRevisionId: string;\n};\n\nexport type WorkspaceInstructionPolicyDiffResponse = {\n  from: WorkspaceInstructionPolicyRevision;\n  to: WorkspaceInstructionPolicyRevision;\n  format: \"unified\";\n  diff: string;\n};\n\nexport type ActivateWorkspaceInstructionPolicyRequest = {\n  operationId?: string;\n  expectedCurrentRevisionId: string | null;\n  expectedActivationVersion?: number;\n  reason: string;\n};\n\nexport type RollbackWorkspaceInstructionPolicyRequest = {\n  operationId?: string;\n  targetRevisionId: string;\n  expectedCurrentRevisionId: string;\n  expectedActivationVersion?: number;\n  reason: string;\n};\n\nexport type WorkspaceInstructionPolicyActivationResponse = {\n  head: WorkspaceInstructionPolicyHead;\n  event: WorkspaceInstructionPolicyActivationEvent;\n};\n\nexport type WorkspaceInstructionPolicyConflictResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_CONFLICT\";\n  message: string;\n  currentHead: WorkspaceInstructionPolicyHead | null;\n};\n\nexport type WorkspaceInstructionPolicyOperationReuseResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_OPERATION_REUSED\";\n  message: string;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalSource = {\n  id: string;\n  version: string;\n  confidenceBps: number;\n};\n\nexport type CreateWorkspaceInstructionPolicyOnboardingProposalRequest =\n  WorkspaceInstructionPolicyTarget & {\n    operationId?: string;\n    content: string;\n    sourceId: string;\n    sourceVersion: string;\n    confidenceBps: number;\n    expectedCurrentRevisionId: string | null;\n    expectedActivationVersion: number;\n  };\n\nexport type WorkspaceInstructionPolicyOnboardingProposal = WorkspaceInstructionPolicyTarget & {\n  id: string;\n  operationId: string;\n  accountId: string;\n  workspaceId: string;\n  source: WorkspaceInstructionPolicyOnboardingProposalSource;\n  baseline: WorkspaceInstructionPolicyHead | null;\n  draft: WorkspaceInstructionPolicyRevision;\n  status: \"proposed\";\n  createdBySubjectId: string;\n  createdAt: string;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalListOptions = {\n  limit?: number;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalListResponse = {\n  proposals: WorkspaceInstructionPolicyOnboardingProposal[];\n  truncated: boolean;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalContentErrorResponse = {\n  code:\n    | \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_EMPTY\"\n    | \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_OVERSIZED\";\n  message: string;\n  maxChars: number;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalStaleResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_STALE\";\n  message: string;\n  currentHead: WorkspaceInstructionPolicyHead | null;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalConflictResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_CONFLICT\";\n  message: string;\n  existingProposalId: string;\n  existingDraftRevisionId: string;\n};\n","export const COMPANY_PROFILE_SCALAR_MAX_CHARS = 2_048;\nexport const COMPANY_PROFILE_ENTRY_MAX_CHARS = 1_024;\nexport const COMPANY_PROFILE_ENTRY_MAX_COUNT = 16;\n\nexport type CompanyProfileEntry = { key: string; content: string };\nexport type CompanyProfileContent = {\n  identity: string | null;\n  mission: string | null;\n  products: CompanyProfileEntry[];\n  customers: CompanyProfileEntry[];\n  goals: CompanyProfileEntry[];\n  constraints: CompanyProfileEntry[];\n};\nexport type CompanyProfileRevisionIdentity = {\n  id: string;\n  revision: number;\n  contentHash: string;\n};\nexport type CompanyProfileRevision = CompanyProfileRevisionIdentity & {\n  operationId: string;\n  accountId: string;\n  intent: \"active\" | \"proposal\";\n  profile: CompanyProfileContent;\n  provenance: {\n    source: \"human\" | \"agent_admin\" | \"durable_learning\" | \"migration\";\n    sourceId: string | null;\n  };\n  supersedesRevisionId: string | null;\n  createdBySubjectId: string;\n  createdAt: string;\n};\nexport type CompanyProfileHead = {\n  accountId: string;\n  revisionId: string;\n  revision: number;\n  contentHash: string;\n  activationVersion: number;\n  activatedAt: string;\n};\nexport type CompanyProfileActivationEvent = {\n  id: string;\n  operationId: string;\n  accountId: string;\n  type: \"activate\" | \"rollback\";\n  activationVersion: number;\n  oldRevision: CompanyProfileRevisionIdentity | null;\n  newRevision: CompanyProfileRevisionIdentity | null;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\nexport type CompanyProfileListOptions = { afterRevision?: number; limit?: number };\nexport type CompanyProfileListResponse = {\n  current: CompanyProfileHead | null;\n  activeRevision: CompanyProfileRevision | null;\n  revisions: CompanyProfileRevision[];\n  activationEvents: CompanyProfileActivationEvent[];\n  nextAfterRevision: number | null;\n};\nexport type UpdateCompanyProfileRequest = {\n  operationId?: string;\n  profile: CompanyProfileContent;\n  expectedCurrentRevisionId: string | null;\n  expectedActivationVersion: number;\n  reason: string;\n};\nexport type ActivateCompanyProfileRevisionRequest = {\n  operationId?: string;\n  expectedCurrentRevisionId: string | null;\n  expectedActivationVersion: number;\n  reason: string;\n};\nexport type RollbackCompanyProfileRequest = {\n  operationId?: string;\n  targetRevisionId: string;\n  expectedCurrentRevisionId: string;\n  expectedActivationVersion: number;\n  reason: string;\n};\nexport type CompanyProfileMutationResponse = {\n  revision: CompanyProfileRevision | null;\n  head: CompanyProfileHead | null;\n  event: CompanyProfileActivationEvent | null;\n};\nexport type CompanyProfileAgentPolicyMode = \"off\" | \"suggest\" | \"automatic\";\nexport type CompanyProfileAgentPolicy = {\n  organizationId: string;\n  mode: CompanyProfileAgentPolicyMode;\n  version: number;\n  updatedAt: string;\n  changed?: boolean;\n};\nexport type UpdateCompanyProfileAgentPolicyRequest = {\n  mode: CompanyProfileAgentPolicyMode;\n  expectedVersion: number;\n  operationId: string;\n};\nexport type CompanyProfileDiffRequest = { fromRevisionId: string; toRevisionId: string };\nexport type CompanyProfileDiffResponse = {\n  from: CompanyProfileRevision;\n  to: CompanyProfileRevision;\n  format: \"unified_json\";\n  diff: string;\n};\n\nexport function normalizeCompanyProfileStableKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n","import type {\n  CompanyBrainContextReceiptPage as ContractCompanyBrainContextReceiptPage,\n  CompanyBrainKnowledgeProposalPage as ContractCompanyBrainKnowledgeProposalPage,\n  CompanyBrainOkfPackage as ContractCompanyBrainOkfPackage,\n} from \"@opengeni/contracts\";\n\nexport type CompanyBrainOkfPackage = ContractCompanyBrainOkfPackage;\nexport type CompanyBrainContextReceiptPage = ContractCompanyBrainContextReceiptPage;\nexport type CompanyBrainKnowledgeProposalPage = ContractCompanyBrainKnowledgeProposalPage;\n\nexport type CompanyBrainContextReceiptListOptions = {\n  attemptId?: string;\n  cursor?: string;\n  limit?: number;\n};\n\nexport type CompanyBrainKnowledgeProposalListOptions = {\n  limit?: number;\n};\n\nexport type CompanyBrainInspectorTransport = {\n  requestJson<T>(method: string, path: string, body?: unknown): Promise<T>;\n};\n\nfunction inspectorPath(workspaceId: string, suffix: string): string {\n  return `/v1/workspaces/${workspaceId}/company-brain/${suffix}`;\n}\n\nexport function listCompanyBrainContextReceipts(\n  client: CompanyBrainInspectorTransport,\n  workspaceId: string,\n  options: CompanyBrainContextReceiptListOptions = {},\n): Promise<CompanyBrainContextReceiptPage> {\n  const params = new URLSearchParams();\n  if (options.attemptId) params.set(\"attemptId\", options.attemptId);\n  if (options.cursor) params.set(\"cursor\", options.cursor);\n  if (options.limit !== undefined) params.set(\"limit\", String(options.limit));\n  const query = params.toString();\n  return client.requestJson(\n    \"GET\",\n    `${inspectorPath(workspaceId, \"context-receipts\")}${query ? `?${query}` : \"\"}`,\n  );\n}\n\nexport function listCompanyBrainKnowledgeProposals(\n  client: CompanyBrainInspectorTransport,\n  workspaceId: string,\n  options: CompanyBrainKnowledgeProposalListOptions = {},\n): Promise<CompanyBrainKnowledgeProposalPage> {\n  const query =\n    options.limit === undefined ? \"\" : `?limit=${encodeURIComponent(String(options.limit))}`;\n  return client.requestJson(\"GET\", `${inspectorPath(workspaceId, \"knowledge-proposals\")}${query}`);\n}\n\nexport type CompanyBrainOkfDownload = {\n  content: string;\n  contentType: string;\n  filename: string;\n};\n","export type PreferenceRegistryScope = \"organization\" | \"workspace\" | \"user\";\nexport type PreferenceRegistryStatus =\n  | \"proposed\"\n  | \"active\"\n  | \"inactive\"\n  | \"rejected\"\n  | \"superseded\"\n  | \"expired\";\nexport type PreferenceRegistryProvenanceSource =\n  | \"human\"\n  | \"onboarding\"\n  | \"knowledge_proposal\"\n  | \"agent\"\n  | \"portable_skill\"\n  | \"imported_document\"\n  | \"slack\"\n  | \"meeting_transcript\"\n  | \"call_transcript\";\nexport type PreferenceRegistryTrust =\n  | \"untrusted_proposal\"\n  | \"personal\"\n  | \"workspace_managed\"\n  | \"organization_managed\";\nexport type PreferenceRegistryConflictStrategy = \"override\" | \"merge\" | \"reject\" | \"inform\";\n\nexport function normalizePreferenceRegistryStableKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n\nexport type PreferenceRegistryScopeTarget = {\n  scope: PreferenceRegistryScope;\n  workspaceId: string | null;\n  subjectId: string | null;\n};\n\nexport type PreferenceRegistryPrecedence = {\n  tier: PreferenceRegistryScope;\n  rank: number;\n  conflictStrategy: PreferenceRegistryConflictStrategy;\n  conflictsWith: string[];\n};\n\nexport type PreferenceRegistryRevisionSummary = {\n  id: string;\n  preferenceId: string;\n  revision: number;\n  contentHash: string;\n  title: string;\n  description: string;\n  precedence: PreferenceRegistryPrecedence;\n  provenance: {\n    source: PreferenceRegistryProvenanceSource;\n    sourceId: string | null;\n    trust: PreferenceRegistryTrust;\n  };\n  expiresAt: string | null;\n  correctsRevisionId: string | null;\n  createdBySubjectId: string;\n  createdAt: string;\n};\n\nexport type PreferenceRegistryDescriptorProvenance = {\n  source: PreferenceRegistryProvenanceSource;\n  sourceIdHash: string | null;\n  trust: PreferenceRegistryTrust;\n};\n\nexport type PreferenceRegistryRecord = {\n  id: string;\n  accountId: string;\n  stableKey: string;\n  target: PreferenceRegistryScopeTarget;\n  status: PreferenceRegistryStatus;\n  scopeVersion: number;\n  activationVersion: number;\n  activeRevision: PreferenceRegistryRevisionSummary | null;\n  supersededByPreferenceId: string | null;\n  createdBySubjectId: string;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type PreferenceRegistryEvent = {\n  id: string;\n  accountId: string;\n  preferenceId: string;\n  type:\n    | \"proposal_created\"\n    | \"activated\"\n    | \"corrected\"\n    | \"rejected\"\n    | \"deactivated\"\n    | \"superseded\"\n    | \"scope_changed\";\n  version: number;\n  oldRevisionId: string | null;\n  newRevisionId: string | null;\n  oldTarget: PreferenceRegistryScopeTarget | null;\n  newTarget: PreferenceRegistryScopeTarget | null;\n  relatedPreferenceId: string | null;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\n\nexport type PreferenceRegistryActivationAuthority = \"human_confirmed\" | \"automatic\";\n\nexport type PreferenceRegistryDescriptor = {\n  id: string;\n  stableKey: string;\n  title: string;\n  description: string;\n  scope: PreferenceRegistryScope;\n  activeVersion: number;\n  revisionId: string;\n  contentHash: string;\n  precedence: PreferenceRegistryPrecedence;\n  provenance: PreferenceRegistryDescriptorProvenance;\n  /**\n   * How the active revision became active. `provenance.trust` stays the frozen\n   * creation-time fact; this is the separate activation question. Null when the\n   * revision became active outside governed learning, or when the descriptor\n   * predates this field.\n   */\n  activationAuthority: PreferenceRegistryActivationAuthority | null;\n  expiresAt: string | null;\n  retrievalHandle: string;\n};\n\nexport type PreferenceRegistrySnapshot = {\n  id: string;\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  initiatingHumanSubjectId: string;\n  descriptorHash: string;\n  descriptors: PreferenceRegistryDescriptor[];\n  truncated: boolean;\n  createdAt: string;\n};\n\nexport type PreferenceRegistryFullContent = {\n  descriptor: PreferenceRegistryDescriptor;\n  content: string;\n};\n\nexport type CreatePreferenceRegistryProposalRequest = {\n  stableKey: string;\n  scope: PreferenceRegistryScope;\n  title: string;\n  description: string;\n  content: string;\n  precedenceRank?: number;\n  conflictStrategy?: PreferenceRegistryConflictStrategy;\n  conflictsWith?: string[];\n  expiresAt?: string | null;\n  provenanceSource?: PreferenceRegistryProvenanceSource;\n  provenanceSourceId?: string | null;\n};\n\nexport type ActivatePreferenceRegistryRevisionRequest = {\n  revisionId: string;\n  expectedCurrentRevisionId: string | null;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type CorrectPreferenceRegistryRequest = {\n  expectedCurrentRevisionId: string;\n  expectedScopeVersion: number;\n  title: string;\n  description: string;\n  content: string;\n  precedenceRank?: number;\n  conflictStrategy?: PreferenceRegistryConflictStrategy;\n  conflictsWith?: string[];\n  expiresAt?: string | null;\n  reason: string;\n};\n\nexport type DeactivatePreferenceRegistryRequest = {\n  expectedCurrentRevisionId: string;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type ChangePreferenceRegistryScopeRequest = {\n  scope: PreferenceRegistryScope;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type SupersedePreferenceRegistryRequest = {\n  replacementPreferenceId: string;\n  expectedCurrentRevisionId: string;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type RejectPreferenceRegistryProposalRequest = {\n  revisionId: string;\n  expectedScopeVersion: number;\n  reason: string;\n};\nexport type PreferenceRegistryListOptions = {\n  scope?: PreferenceRegistryScope;\n  status?: PreferenceRegistryStatus;\n  limit?: number;\n};\nexport type PreferenceRegistryListResponse = { preferences: PreferenceRegistryRecord[] };\nexport type PreferenceRegistryDetailResponse = {\n  preference: PreferenceRegistryRecord;\n  revisions: PreferenceRegistryRevisionSummary[];\n  events: PreferenceRegistryEvent[];\n};\nexport type PreferenceRegistryMutationResponse = {\n  preference: PreferenceRegistryRecord;\n  event: PreferenceRegistryEvent;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,IAAM,SAAS,CAAC,UACd,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AACrE,IAAM,OAAO,CAAC,OAAgC,YAC5C,OAAO,KAAK,KAAK,EAAE,MAAM,CAAC,QAAQ,QAAQ,SAAS,GAAG,CAAC;AACzD,IAAM,OAAO,CAAC,OAAgB,KAAa,MAAM,MAC/C,OAAO,UAAU,YAAY,MAAM,UAAU,OAAO,MAAM,UAAU;AACtE,IAAM,cAAc,CAAC,OAAgB,QACnC,OAAO,UAAU,YAAY,KAAK,MAAM,KAAK,GAAG,GAAG;AACrD,IAAM,aAAa,CAAC,UAClB,KAAK,OAAO,OAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK;AAClD,IAAM,UAAU,CAAC,UACf,OAAO,UAAU,YAAY,+BAA+B,KAAK,KAAK;AACxE,IAAM,WAAW,CAAC,UAAoC;AACpD,MAAI,CAAC,KAAK,OAAO,IAAI,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,IAAI;AAAA,EAC5F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,2BAA2B,OAA8C;AACvF,MACE,CAAC,OAAO,KAAK,KACb,CAAC,KAAK,OAAO,CAAC,QAAQ,QAAQ,eAAe,aAAa,aAAa,UAAU,CAAC,KAClF,MAAM,SAAS,SACf,CAAC,YAAY,MAAM,MAAM,GAAG,KAC5B,CAAC,SAAS,MAAM,WAAW,KAC3B,CAAC,YAAY,MAAM,WAAW,GAAI;AAElC,WAAO;AACT,QAAM,OAAO;AAAA,IACX,MAAM;AAAA,IACN,MAAM,MAAM,KAAK,KAAK;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM,UAAU,KAAK;AAAA,EAClC;AACA,MAAI,MAAM,cAAc,UAAa,MAAM,aAAa,OAAW,QAAO;AAC1E,MAAI,MAAM,cAAc,cAAc,MAAM,cAAc,YAAa,QAAO;AAC9E,QAAM,QAAQ,MAAM;AACpB,MACE,CAAC,OAAO,KAAK,KACb,CAAC,KAAK,OAAO,CAAC,QAAQ,eAAe,WAAW,cAAc,CAAC,KAC/D,CAAC,YAAY,MAAM,MAAM,GAAG,KAC5B,MAAM,KAAK,KAAK,MAAM,KAAK,QAC3B,MAAM,gBAAgB,KAAK,eAC3B,CAAC,MAAM,QAAQ,MAAM,OAAO,KAC5B,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,SAAS,MACvB,CAAC,MAAM,QAAQ,MAAM,YAAY,KACjC,MAAM,aAAa,SAAS;AAE5B,WAAO;AACT,QAAM,SAA2C,CAAC;AAClD,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,SAAS,MAAM,cAAc;AACtC,QACE,CAAC,OAAO,KAAK,KACb,CAAC,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,KAC5B,CAAC,QAAQ,MAAM,EAAE,KACjB,CAAC,YAAY,MAAM,OAAO,GAAG,KAC7B,SAAS,IAAI,MAAM,EAAE;AAErB,aAAO;AACT,aAAS,IAAI,MAAM,EAAE;AACrB,WAAO,KAAK,EAAE,IAAI,MAAM,IAAI,OAAO,MAAM,MAAM,KAAK,EAAE,CAAC;AAAA,EACzD;AACA,QAAM,UAAuC,CAAC;AAC9C,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,UAAU,MAAM,SAAS;AAClC,QACE,CAAC,OAAO,MAAM,KACd,CAAC,KAAK,OAAO,MAAM,GAAG,KACtB,CAAC,gCAAgC,KAAK,OAAO,IAAI;AAEjD,aAAO;AACT,UAAM,OAAO,OAAO,KAAK,YAAY;AACrC,QAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAC5B,UAAM,IAAI,IAAI;AACd,QAAI,WAAW,QAAQ;AACrB,UACE,CAAC,KAAK,QAAQ,CAAC,QAAQ,OAAO,CAAC,KAC/B,CAAC,WAAW,OAAO,KAAK,KACxB,CAAC,OAAO,SACR,CAAC,iBAAiB,uBAAuB,UAAU,aAAa,SAAS,EAAE,SAAS,IAAI;AAExF,eAAO;AACT,cAAQ,KAAK,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,IACzD,OAAO;AACL,UACE,CAAC,KAAK,QAAQ,CAAC,QAAQ,UAAU,UAAU,QAAQ,CAAC,KACpD,CAAC,QAAQ,OAAO,MAAM,KACtB,CAAC,SAAS,IAAI,OAAO,MAAM,KAC1B,OAAO,WAAW,UAAa,CAAC,WAAW,OAAO,MAAM,KACxD,OAAO,WAAW,UAAa,CAAC,WAAW,OAAO,MAAM;AAEzD,eAAO;AACT,WAAK,IAAI,OAAO,MAAM;AACtB,cAAQ,KAAK;AAAA,QACX,MAAM,OAAO;AAAA,QACb,QAAQ,OAAO;AAAA,QACf,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAiB,IAAI,CAAC;AAAA,QACzE,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAiB,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,KAAK,SAAS,SAAS,KAAM,QAAO;AACxC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,MAAM;AAAA,IACjB,UAAU,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,SAAS,cAAc,OAAO;AAAA,EAC5F;AACF;;;ACpHA,IAAM,gBACJ;AACF,IAAM,uBAAuB,CAAC,KAAa,SAA4B,CAAC,MACtE,cAAc,KAAK,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG;AACxE,IAAM,QAAQ,CAAC,OAAe,UAC5B,MAAM,SAAS,QAAQ,GAAG,MAAM,MAAM,GAAG,KAAK,CAAC,WAAM;AAChD,SAAS,qBAAqB,KAAqB;AACxD,QAAM,QAAQ,IACX,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,UAAU,GAAG,EACrB,QAAQ,cAAc,CAAC,SAAU,KAAK,WAAW,IAAI,QAAQ,IAAK,EAClE;AAAA,IACC;AAAA,IACA,CAAC,OAAO,MAAc,WAAmB,GAAG,KAAK,YAAY,CAAC,GAAG,MAAM;AAAA,EACzE,EAEC;AAAA,IACC;AAAA,IACA,CAAC,OAAO,OAAe,SAAiB,GAAG,MAAM,YAAY,CAAC,GAAG,IAAI;AAAA,EACvE,EACC,KAAK;AACR,SAAO,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC;AACtD;AACO,SAAS,sBAAsB,OAAgD;AAEpF,MAAI,UAAU;AACd,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO;AAAA,IAC9B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAClE,UACD;AACN;AACO,SAAS,gBACd,OACA,MAAM,IACN,kBAAqC,CAAC,GACtC,QAAQ,GACC;AACT,MAAI,qBAAqB,KAAK,eAAe,EAAG,QAAO;AACvD,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,MAAM,QAAQ,KAAK;AACrB,WAAO,MAAM,IAAI,CAAC,UAAU,gBAAgB,OAAO,IAAI,iBAAiB,QAAQ,CAAC,CAAC;AACpF,MAAI,SAAS,OAAO,UAAU;AAC5B,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,QAC3C;AAAA,QACA,gBAAgB,OAAO,MAAM,iBAAiB,QAAQ,CAAC;AAAA,MACzD,CAAC;AAAA,IACH;AACF,SAAO;AACT;AACA,SAAS,UAAU,OAAwB;AACzC,SAAO,OAAO,UAAU,WACpB,QACA,UAAU,OACR,SACA,OAAO,UAAU,YACf,QACE,QACA,OACD,KAAK,UAAU,KAAK,KAAK;AACpC;AACA,IAAM,UAAU,CAAC,SAAiB,IAAI,KAAK,WAAW,KAAK,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;AAGtF,IAAM,eAAe,CAAC,KAAa,OAAe,SAAS,OACzD,QAAQ,GAAG,EAAE,SAAS,OAAO,OAAO,SAAS,QAAQ,GAAG,EAAE,SAAS,OAC/D,MAAM,KAAK,KACX,QAAQ,GAAG;AAEV,SAAS,iBACd,gBACA,SAC4D;AAC5D,QAAM,OAAO,sBAAsB,cAAc;AACjD,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,CAAC,GAAG,YAAY,EAAE;AAC9C,QAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,MAAI,SAAS,OAAO;AAClB,UAAM,QAAQ,iBAAiB,QAAQ,KAAK;AAC5C,UAAM,WAAW,iBAAiB,MAAM,EAAE,GAAG,SAAS,OAAO,OAAU,CAAC;AACxE,UAAM,SAAS;AAAA,MACb,GAAG,MAAM,OACN;AAAA,QACC,CAAC,UACC,MAAM,SAAS,oBAAoB,MAAM,SAAS,eAAe,MAAM,YAAY;AAAA,MACvF,EACC,IAAI,CAAC,WAAW;AAAA,QACf,GAAG;AAAA,QACH,OAAO,MAAM,SAAS,cAAc,YAAY,MAAM;AAAA,QACtD,MAAM,UAAU,MAAM,IAAI;AAAA,QAC1B,GAAI,MAAM,SAAS,iBACf;AAAA,UACE,SAAS,QACN,MAAO,YAAY,IAAI,CAAC,eAAe,WAAW,IAAI,EACtD,KAAK,IAAI,EACT,MAAM,GAAG,GAAG;AAAA,QACjB,IACA,CAAC;AAAA,MACP,EAAE;AAAA,MACJ,GAAG,SAAS,OAAO;AAAA,QACjB,CAAC,UACC,CAAC;AAAA,UACC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,SAAS,MAAM,IAAI;AAAA,MACzB;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ,OAAO,MAAM,GAAG,EAAE;AAAA,MAC1B,YAAY,SAAS,aAAa,KAAK,IAAI,GAAG,OAAO,SAAS,EAAE;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,KAAK,IAAI,GAAG,QAAQ,SAAS,EAAE;AAAA,IAC3C,QAAQ,QAAQ,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,UAAU;AACxD,YAAM,SAAS,qBAAqB,KAAK,SAAS,eAAe;AACjE,YAAM,OAAO,SAAS,sBAAsB;AAC5C,YAAM,QAAQ,CAAC,UAAU,MAAM,QAAQ,KAAK,IAAI,MAAM,SAAS;AAC/D,YAAM,cACJ,CAAC,UACD,MAAM,QAAQ,KAAK,KACnB,MAAM,SAAS,KACf,MAAM,UAAU,KAChB,MAAM;AAAA,QACJ,CAAC,UACC,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU;AAAA,MAC/E,IACI,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,IAC9B;AACN,YAAMA,QACJ,gBAAgB,SACZ,cACA,UAAU,SACR,GAAG,MAAM,eAAe,OAAO,CAAC,QAAQ,UAAU,IAAI,KAAK,GAAG,KAC9D,QAAQ,OAAO,SAAS,WACtB,GAAG,OAAO,KAAK,IAAI,EAAE,MAAM,SAAS,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,KAAK,GAAG,KAC7E,UAAU,IAAI;AACxB,aAAO;AAAA,QACL,MAAM,aAAa,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA,WACJ,SAAS,eAAe,OAAO,OAAO,QAAQ,aAAa,GAAG,IAC3D,QAAQ,YAAY,GAAG,IACvB,WAAc,qBAAqB,GAAG;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,SAAS,MAAMA,OAAM,GAAG;AAAA,QACxB,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,QACvC,WACE,CAAC,WACAA,MAAK,SAAS,OACZ,gBAAgB,UAAa,OAAO,UAAU,YAAY,UAAU;AAAA,QACzE,GAAI,SAAS,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,MACtC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAGO,SAAS,iBACd,UACA,gBACA,SAIA;AACA,QAAM,WAAW;AAAA,IACf,OACE,SAAS,SACT;AAAA,MACE;AAAA,QACE,SAAS,QAAQ,gBAAgB,EAAE,EAAE,QAAQ,wBAAwB,EAAE;AAAA,MACzE;AAAA,MACA;AAAA,IACF;AAAA,IACF,cAAc;AAAA,IACd,SAAS,CAAC;AAAA,EACZ;AACA,MAAI,SAAS,SAAS,QAAS,QAAO;AACtC,QAAM,OAAO,sBAAsB,cAAc;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,SAAS,SAAS,SAAS;AAC1C,QAAM,gBAAgB,SAAU,YAAuB;AACvD,QAAM,MACJ,UAAU,OAAO,KAAK,aAAa,WAC/B,CAAC,KAAK,QAAQ,IACd,MAAM,QAAQ,KAAK,UAAU,IAC3B,KAAK,aACL,OAAO,KAAK,cAAc,WACxB,CAAC,KAAK,SAAS,IACf;AACV,QAAM,iBAAiB,KAAK,MAAM,CAAC,OAAO,OAAO,OAAO,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,OAAO;AACxF,QAAM,OACJ,mBAAmB,SACf,SACE,kBACA,aACF,GAAG,eAAe,eAAe,OAAO,CAAC,IAAI,SAAS,iBAAiB,SAAS,GAAG,mBAAmB,IAAI,KAAK,GAAG;AACxH,QAAM,YAAY,SAAS,WAAW,QAAQ,IAAI,KAAK,WAAW,KAAK;AACvE,QAAM,OAAO,MAAM,QAAQ,SAAS,IAChC,UAAU,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC1D,CAAC;AACL,QAAM,eAAe,SAAS,WAAW,UAAU,IAAI,KAAK,WAAW,KAAK;AAC5E,QAAM,UAAU,MAAM,QAAQ,YAAY,IACtC,aAAa,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;AACL,QAAM,cAAc,CAAC,OAAe,WAA4B;AAC9D,UAAM,QAA0C;AAAA,MAC9C,OAAO,CAAC,iBAAiB,mBAAmB;AAAA,MAC5C,OAAO,CAAC,iBAAiB,mBAAmB;AAAA,MAC5C,QAAQ,CAAC,kBAAkB,cAAc;AAAA,MACzC,SAAS,CAAC,YAAY,aAAa;AAAA,MACnC,MAAM,CAAC,gBAAgB,kBAAkB;AAAA,MACzC,WAAW,CAAC,qBAAqB,mBAAmB;AAAA,IACtD;AACA,YACG,OAAO,OAAO,OAAO,KAAK,IAAI,MAAM,KAAK,IAAI,SAAS,IAAI,CAAC,IAAI,WAChE,GAAG,SAAS,QAAQ,QAAQ,UAAU,MAAM,OAAO,GAAG,CAAC;AAAA,EAE3D;AACA,QAAM,UAAU;AAAA,IACd,GAAG,KAAK,IAAI,CAAC,OAAO,YAAY,IAAI,IAAI,CAAC;AAAA,IACzC,GAAG,QAAQ,IAAI,CAAC,OAAO,YAAY,IAAI,KAAK,CAAC;AAAA,EAC/C;AACA,MACE;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,QAAQ,GACnB;AACA,UAAM,QAAQ,KAAK,SAAS,OAAO;AACnC,WAAO;AAAA,MACL,OAAO,QAAQ,QAAQ,IAAI,cAAc,UAAU,IAAI;AAAA,MACvD,cAAc,QAAQ,kBAAkB;AAAA,MACxC;AAAA,MACA,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,cAAc;AAAA,MACxE,GAAI,QACA,EAAE,aAAa,+DAA+D,IAC9E,SACE,EAAE,aAAa,gDAAgD,IAC/D,CAAC;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,mBAAmB,gBAAgB,gBAAgB,EAAE,SAAS,QAAQ;AAC1F,WAAO;AAAA,MACL,OAAO,SAAS,WAAW,QAAQ,IAAI,QAAQ,IAAI,cAAc,UAAU,IAAI;AAAA,MAC/E,cAAc,SAAS,WAAW,QAAQ,IAAI,kBAAkB;AAAA,MAChE;AAAA,MACA,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,cAAc;AAAA,IAC1E;AACF,QAAM,QAA0C;AAAA,IAC9C,cAAc,CAAC,cAAc,YAAY;AAAA,IACzC,YAAY,CAAC,cAAc,YAAY;AAAA,IACvC,cAAc,CAAC,sBAAsB,cAAc;AAAA,IACnD,cAAc,CAAC,sBAAsB,cAAc;AAAA,IACnD,cAAc,CAAC,sBAAsB,cAAc;AAAA,IACnD,cAAc,CAAC,gBAAgB,cAAc;AAAA,IAC7C,cAAc,CAAC,gBAAgB,cAAc;AAAA,IAC7C,cAAc,CAAC,gBAAgB,cAAc;AAAA,EAC/C;AACA,QAAM,SAAS,OAAO,OAAO,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAClE,SAAO,SAAS,EAAE,OAAO,OAAO,CAAC,GAAG,cAAc,OAAO,CAAC,GAAG,QAAQ,IAAI;AAC3E;AAGO,SAAS,kBACd,gBACA,SACA,MACA,QACA,QAAQ,IACwD;AAChE,MACE,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,KACT,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ;AAER,UAAM,IAAI,MAAM,qBAAqB;AACvC,QAAM,OAAO,sBAAsB,cAAc;AACjD,MAAI,QAAiB,SAAS,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAC3E,MAAI,SAAS,IAAI;AACf,QAAI,CAAC,KAAK,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,sBAAsB;AACjE,eAAW,WAAW,KAAK,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AAC9C,UAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,YAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,gBAAM,IAAI,MAAM,wBAAwB;AAC1C,cAAM,WAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,QAAQ,MAAM,CAAC,CAAC,CAAC;AAC/D,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,wBAAwB;AACvD,gBAAQ;AAAA,UACN,WAAW,SAAS,CAAC;AAAA,UACrB,OAAO,qBAAqB,SAAS,CAAC,GAAG,SAAS,eAAe,IAC7D,sBACA,SAAS,CAAC;AAAA,QAChB;AACA;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,WAAW,MAAM,GAAG,EAAE,WAAW,MAAM,GAAG;AAC9D,UAAI,qBAAqB,KAAK,SAAS,eAAe,GAAG;AACvD,gBAAQ;AACR;AAAA,MACF;AACA,UAAI,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO,OAAO,GAAG;AAClE,cAAM,IAAI,MAAM,wBAAwB;AAC1C,cAAS,MAAkC,GAAG;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,UAAU,CACd,OACA,KACA,cACqD;AACrD,UAAM,SAAS,qBAAqB,KAAK,SAAS,eAAe;AACjE,QAAI,CAAC,UAAU,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC1D,YAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,SAAS,OAAO,KAAK,KAAK,EAAE;AACvE,aAAO;AAAA,QACL,OAAO,GAAG,MAAM,eAAe,OAAO,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAK,UAAU,IAAI,SAAS,UAAW,UAAU,IAAI,UAAU,QAAQ;AAAA,QACrI,MAAM;AAAA,QACN,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAMA,QAAO,UAAU,gBAAgB,OAAO,KAAK,SAAS,eAAe,CAAC;AAC5E,WAAO;AAAA,MACL,OAAO,MAAMA,OAAM,GAAI;AAAA,MACvB,GAAI,SAAS,CAAC,IAAI,EAAE,MAAM,UAAU;AAAA,MACpC,WAAW,CAAC,UAAUA,MAAK,SAAS;AAAA,IACtC;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAQ,MAAM;AACd,YAAQ,MAAM,MAAM,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC,OAAO,WAAW;AAAA,MACjE,OAAO,GAAG,SAAS,QAAQ,CAAC;AAAA,MAC5B,GAAG,QAAQ,OAAO,IAAI,GAAG,IAAI,IAAI,SAAS,KAAK,EAAE;AAAA,IACnD,EAAE;AAAA,EACJ,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,UAAM,UAAU,OAAO,QAAQ,KAAK;AACpC,YAAQ,QAAQ;AAChB,YAAQ,QAAQ,MAAM,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,WAAW;AAAA,MAC1E,OAAO;AAAA,SACJ,SAAS,eAAe,OAAO,OAAO,QAAQ,aAAa,GAAG,IAC3D,QAAQ,YAAY,GAAG,IACvB,WAAc,qBAAqB,GAAG;AAAA,QAC1C;AAAA,MACF;AAAA,MACA,GAAG,QAAQ,OAAO,KAAK,GAAG,IAAI,GAAG,aAAa,KAAK,SAAS,OAAO,IAAI,CAAC,EAAE;AAAA,IAC5E,EAAE;AAAA,EACJ,OAAO;AACL,UAAMA,QAAO,UAAU,KAAK;AAC5B,YAAQ,KAAK,IAAI,GAAG,KAAK,KAAKA,MAAK,SAAS,GAAI,CAAC;AACjD,YAAQ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,OAAO,QAAQ,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,WAAW;AAAA,MAC1F,OAAO,QAAQ,SAAS,QAAQ,CAAC;AAAA,MACjC,OAAOA,MAAK,OAAO,SAAS,SAAS,MAAO,SAAS,QAAQ,KAAK,GAAI;AAAA,IACxE,EAAE;AAAA,EACJ;AACA,SAAO,EAAE,MAAM,OAAO,OAAO,YAAY,SAAS,QAAQ,QAAQ,SAAS,QAAQ,KAAK;AAC1F;;;AC/XO,SAAS,oBAAoB,OAAiD;AACnF,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,UAAU,OAAO,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,SAAU,QAAO;AACxF,QAAI,OAAO;AACX,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,2BAA2B,QAIzB;AAChB,MAAI,OAAO,cAAc,WAAW,CAAC,OAAO,SAAU,QAAO;AAC7D,MACE,OAAO,aACP,CAAC,CAAC,QAAQ,mBAAmB,iBAAiB,EAAE,SAAS,OAAO,SAAS;AAEzE,WAAO,4BAA4B,OAAO;AAC5C,MAAI,OAAO,yBAAyB,OAAO,SAAS,SAAS,GAAG;AAC9D,WAAO;AACT,QAAMC,YAAW,oBAAoB,OAAO,QAAQ;AACpD,MAAI,CAACA,WAAU,WAAW,UAAU,EAAG,QAAO;AAC9C,SAAO;AACT;;;AC1BO,SAAS,yBAAyB,OAAiD;AACxF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,OAAO;AACb,MACE,OAAO,KAAK,IAAI,EAAE;AAAA,IAChB,CAAC,QAAQ,CAAC,CAAC,YAAY,SAAS,gBAAgB,aAAa,gBAAgB,EAAE,SAAS,GAAG;AAAA,EAC7F;AAEA,WAAO;AACT,QAAMC,QAAO,CAAC,GAAY,QACxB,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,EAAE,UAAU;AACvD,MAAI,CAACA,MAAK,KAAK,UAAU,GAAG,KAAK,yBAAyB,KAAK,KAAK,QAAQ,EAAG,QAAO;AACtF,MAAI,KAAK,UAAU,UAAa,CAACA,MAAK,KAAK,OAAO,GAAG,EAAG,QAAO;AAC/D,MAAI,KAAK,iBAAiB,UAAa,CAACA,MAAK,KAAK,cAAc,IAAI,EAAG,QAAO;AAC9E,MAAI,KAAK,cAAc,UAAa,CAACA,MAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,MAAI,KAAK,mBAAmB,UAAa,CAACA,MAAK,KAAK,gBAAgB,GAAG,EAAG,QAAO;AACjF,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAgB,IAAI,CAAC;AAAA,IAClE,GAAI,KAAK,iBAAiB,SAAY,EAAE,cAAc,KAAK,aAAuB,IAAI,CAAC;AAAA,IACvF,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAoB,IAAI,CAAC;AAAA,IAC9E,GAAI,KAAK,mBAAmB,SAAY,EAAE,gBAAgB,KAAK,eAAyB,IAAI,CAAC;AAAA,EAC/F;AACF;;;ACZA,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB,oBAAI,IAAI,CAAC,UAAU,WAAW,WAAW,MAAM,OAAO,CAAC;AAG7E,SAAS,mBAAmB,QAAsC;AACvE,QAAM,aAAa,eAAe,QAAQ,GAAG,oBAAI,IAAY,CAAC;AAC9D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,WAAW;AAAA,IAClB,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,EACtB;AACF;AAIA,SAAS,eAAe,OAAgB,OAAe,WAAyC;AAC9F,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO,EAAE,OAAO,MAAM,IAAI,SAAS,MAAM;AAAA,EAC3C;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,cAAc,OAAO,OAAO,SAAS;AAAA,EAC9C;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,OAAO,MAAM,OAAO,KAAK,GAAG,SAAS,MAAM;AAAA,EACtD;AACA,MAAI,SAAS,wBAAwB,UAAU,IAAI,KAAK,GAAG;AACzD,WAAO,EAAE,OAAO,MAAM,cAAc,KAAK,GAAG,SAAS,MAAM;AAAA,EAC7D;AAEA,YAAU,IAAI,KAAK;AACnB,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,EAAE,OAAO,MAAM,cAAc,KAAK,GAAG,SAAS,MAAM;AAAA,IAC7D;AAEA,UAAMC,UAAS;AACf,UAAM,gBAAgBA,QAAO,YAAY;AAEzC,QAAIA,QAAO,SAAS,UAAU,OAAOA,QAAO,SAAS,UAAU;AAC7D,YAAM,aAAa,cAAcA,QAAO,MAAM,QAAQ,GAAG,SAAS;AAClE,aAAO;AAAA,QACL,OAAO,WAAW;AAAA,QAClB,MAAMA,QAAO;AAAA,QACb,SAAS,iBAAiB,WAAW;AAAA,MACvC;AAAA,IACF;AAEA,QAAI,uBAAuBA,SAAQ;AACjC,YAAM,aAAa,eAAeA,QAAO,mBAAmB,QAAQ,GAAG,SAAS;AAChF,aAAO;AAAA,QACL,OAAO,WAAW;AAAA,QAClB,MAAM,aAAaA,QAAO,OAAO,KAAK,WAAW;AAAA,QACjD,SAAS,iBAAiB,WAAW;AAAA,MACvC;AAAA,IACF;AAEA,QAAI,aAAaA,QAAO,OAAO,GAAG;AAChC,YAAMC,QAAO,aAAaD,QAAO,OAAO;AACxC,UAAIC,UAAS,MAAM;AACjB,cAAM,aAAa,cAAcA,OAAM,QAAQ,GAAG,SAAS;AAC3D,eAAO;AAAA,UACL,OAAO,WAAW;AAAA,UAClB,MAAAA;AAAA,UACA,SAAS,iBAAiB,WAAW;AAAA,QACvC;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,MAAM,cAAc,KAAK;AAAA,QACzB,SAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,iBAAiBD,OAAM,GAAG;AAC5B,YAAM,aAAa,eAAeA,QAAO,QAAQ,QAAQ,GAAG,SAAS;AACrE,aAAO;AAAA,QACL,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,iBAAiB,WAAW;AAAA,MACvC;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM,cAAc,KAAK;AAAA,MACzB,SAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,cAAU,OAAO,KAAK;AAAA,EACxB;AACF;AAEA,SAAS,cAAcC,OAAc,OAAe,WAAyC;AAC3F,MAAI;AACF,UAAM,SAAkB,KAAK,MAAMA,KAAI;AACvC,UAAM,aAAa,eAAe,QAAQ,QAAQ,GAAG,SAAS;AAC9D,WAAO;AAAA,MACL,OAAO,WAAW;AAAA,MAClB,MAAAA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAOA,OAAM,MAAAA,OAAM,SAAS,MAAM;AAAA,EAC7C;AACF;AAEA,SAAS,aAAa,OAA6D;AACjF,SACE,MAAM,QAAQ,KAAK,KACnB,MAAM;AAAA,IACJ,CAAC,SACC,SAAS,QACT,OAAO,SAAS,YAChB,OAAQ,KAA4B,SAAS;AAAA,EACjD;AAEJ;AAEA,SAAS,aAAa,OAA+B;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QACE,SAAS,QACT,OAAO,SAAS,YACf,KAA4B,SAAS,UACtC,OAAQ,KAA4B,SAAS,UAC7C;AACA,aAAQ,KAA0B;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiBD,SAA0C;AAClE,SAAO,YAAYA,WAAU,OAAO,KAAKA,OAAM,EAAE,MAAM,CAAC,QAAQ,qBAAqB,IAAI,GAAG,CAAC;AAC/F;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,WAAO,KAAK,UAAU,KAAK,KAAK;AAAA,EAClC,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AACF;;;ACtIO,SAAS,iBAAiB,KAAmD;AAClF,MAAI,CAAC,IAAI,KAAK;AACZ,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,IAAI,IAAI,IAAI,IAAI,GAAG;AAEzB,MAAI,EAAE,aAAa,UAAU;AAC3B,MAAE,WAAW;AAAA,EACf,WAAW,EAAE,aAAa,SAAS;AACjC,MAAE,WAAW;AAAA,EACf;AAIA,MAAI,uBAAuB,KAAK,EAAE,QAAQ,GAAG;AAC3C,MAAE,WAAW,EAAE,SAAS,QAAQ,wBAAwB,aAAa;AACrE,MAAE,SAAS;AACX,MAAE,OAAO;AAAA,EACX;AACA,SAAO,EAAE,SAAS;AACpB;AAqEO,SAAS,iBACd,SACA,IACwB;AACxB,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,YAAY,cAAc,aAAa;AAAA,IAChD,KAAK;AAEH,aAAO,YAAY,UAAU,UAAU;AAAA,IACzC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAgBO,SAAS,iBACd,KACA,SACA,YACU;AACV,MAAI,QAAQ,aAAa,YAAY;AACnC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,KAAK,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,UAAU;AACxF;;;AC1IO,SAAS,kBAAkB,KAA8C;AAC9E,MAAI,CAAC,IAAI,KAAK;AACZ,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,IAAI,IAAI,IAAI,IAAI,GAAG;AAEzB,MAAI,EAAE,aAAa,UAAU;AAC3B,MAAE,WAAW;AAAA,EACf,WAAW,EAAE,aAAa,SAAS;AACjC,MAAE,WAAW;AAAA,EACf;AACA,SAAO,EAAE,SAAS;AACpB;AAQO,IAAM,mBAAmB;AAGzB,IAAM,oBAAoB;AAAA;AAAA,EAE/B,OAAO;AAAA;AAAA,EAEP,QAAQ;AAAA;AAAA,EAER,OAAO;AAAA;AAAA,EAEP,QAAQ;AACV;AAGO,IAAM,oBAAoB;AAAA;AAAA,EAE/B,QAAQ;AAAA;AAAA,EAER,kBAAkB;AAAA;AAAA,EAElB,iBAAiB;AACnB;AAUO,SAAS,cAAc,MAAoD;AAChF,QAAM,QAAgE,EAAE,WAAW,GAAG;AACtF,MAAI,MAAM,WAAW,KAAK,UAAU,EAAG,OAAM,UAAU,KAAK;AAC5D,MAAI,MAAM,QAAQ,KAAK,OAAO,EAAG,OAAM,OAAO,KAAK;AACnD,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,eAAe,MAAsB;AACnD,SAAO,kBAAkB,QAAQ;AACnC;AAGO,SAAS,gBAAgB,SAAiB,MAAsB;AACrE,SAAO,kBAAkB,SAAS,KAAK,UAAU,EAAE,SAAS,KAAK,CAAC;AACpE;;;AC1FO,IAAM,iDAAiD;AAgBvD,SAAS,2CAA2C,OAAuB;AAChF,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;;;AClBO,IAAM,mCAAmC;AACzC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AAuGxC,SAAS,iCAAiC,OAAuB;AACtE,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;;;ACnFA,SAAS,cAAc,aAAqB,QAAwB;AAClE,SAAO,kBAAkB,WAAW,kBAAkB,MAAM;AAC9D;AAEO,SAAS,gCACd,QACA,aACA,UAAiD,CAAC,GACT;AACzC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,QAAQ,UAAW,QAAO,IAAI,aAAa,QAAQ,SAAS;AAChE,MAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,QAAQ,MAAM;AACvD,MAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAM,QAAQ,OAAO,SAAS;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,GAAG,cAAc,aAAa,kBAAkB,CAAC,GAAG,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,EAC9E;AACF;AAEO,SAAS,mCACd,QACA,aACA,UAAoD,CAAC,GACT;AAC5C,QAAM,QACJ,QAAQ,UAAU,SAAY,KAAK,UAAU,mBAAmB,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxF,SAAO,OAAO,YAAY,OAAO,GAAG,cAAc,aAAa,qBAAqB,CAAC,GAAG,KAAK,EAAE;AACjG;;;AC3BO,SAAS,qCAAqC,OAAuB;AAC1E,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;","names":["text","endpoint","text","record","text"]}
+{"version":3,"sources":["../src/prepared-mcp-setup.ts","../../contracts/src/tool-review-presentation.ts","../../contracts/src/mcp-endpoint.ts","../src/tool-display-metadata.ts","../src/mcp-output.ts","../src/desktop.ts","../src/terminal.ts","../src/workspace-instruction-policies.ts","../src/company-profile.ts","../src/company-brain.ts","../src/preference-registry.ts"],"sourcesContent":["import type {\n  CustomMcpSetupRequest,\n  PreparedMcpSetup,\n} from \"@opengeni/contracts/prepared-mcp-setup\";\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst keys = (value: Record<string, unknown>, allowed: string[]) =>\n  Object.keys(value).every((key) => allowed.includes(key));\nconst text = (value: unknown, max: number, min = 1): value is string =>\n  typeof value === \"string\" && value.length >= min && value.length <= max;\nconst trimmedText = (value: unknown, max: number): value is string =>\n  typeof value === \"string\" && text(value.trim(), max);\nconst headerPart = (value: unknown): value is string =>\n  text(value, 16_384, 0) && !/[\\r\\n\\0]/.test(value);\nconst fieldId = (value: unknown): value is string =>\n  typeof value === \"string\" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(value);\nconst endpoint = (value: unknown): value is string => {\n  if (!text(value, 2048)) return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" && !url.username && !url.password && !url.search && !url.hash;\n  } catch {\n    return false;\n  }\n};\n\n/** Browser/native-safe display projection. The API owns authoritative schema\n * validation; parity tests keep this lightweight parser aligned without pulling\n * schema runtimes into the SDK or replaying unknown fields into a secret form. */\nexport function parseCustomMcpSetupRequest(value: unknown): CustomMcpSetupRequest | null {\n  if (\n    !record(value) ||\n    !keys(value, [\"kind\", \"name\", \"endpointUrl\", \"rationale\", \"ownership\", \"mcpSetup\"]) ||\n    value.kind !== \"mcp\" ||\n    !trimmedText(value.name, 256) ||\n    !endpoint(value.endpointUrl) ||\n    !trimmedText(value.rationale, 2000)\n  )\n    return null;\n  const base = {\n    kind: \"mcp\" as const,\n    name: value.name.trim(),\n    endpointUrl: value.endpointUrl,\n    rationale: value.rationale.trim(),\n  };\n  if (value.ownership === undefined && value.mcpSetup === undefined) return base;\n  if (value.ownership !== \"personal\" && value.ownership !== \"workspace\") return null;\n  const setup = value.mcpSetup;\n  if (\n    !record(setup) ||\n    !keys(setup, [\"name\", \"endpointUrl\", \"headers\", \"secretFields\"]) ||\n    !trimmedText(setup.name, 256) ||\n    setup.name.trim() !== base.name ||\n    setup.endpointUrl !== base.endpointUrl ||\n    !Array.isArray(setup.headers) ||\n    setup.headers.length < 1 ||\n    setup.headers.length > 32 ||\n    !Array.isArray(setup.secretFields) ||\n    setup.secretFields.length > 32\n  )\n    return null;\n  const fields: PreparedMcpSetup[\"secretFields\"] = [];\n  const fieldIds = new Set<string>();\n  for (const field of setup.secretFields) {\n    if (\n      !record(field) ||\n      !keys(field, [\"id\", \"label\"]) ||\n      !fieldId(field.id) ||\n      !trimmedText(field.label, 256) ||\n      fieldIds.has(field.id)\n    )\n      return null;\n    fieldIds.add(field.id);\n    fields.push({ id: field.id, label: field.label.trim() });\n  }\n  const headers: PreparedMcpSetup[\"headers\"] = [];\n  const names = new Set<string>();\n  const used = new Set<string>();\n  for (const header of setup.headers) {\n    if (\n      !record(header) ||\n      !text(header.name, 256) ||\n      !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(header.name)\n    )\n      return null;\n    const name = header.name.toLowerCase();\n    if (names.has(name)) return null;\n    names.add(name);\n    if (\"value\" in header) {\n      if (\n        !keys(header, [\"name\", \"value\"]) ||\n        !headerPart(header.value) ||\n        !header.value ||\n        [\"authorization\", \"proxy-authorization\", \"cookie\", \"x-api-key\", \"api-key\"].includes(name)\n      )\n        return null;\n      headers.push({ name: header.name, value: header.value });\n    } else {\n      if (\n        !keys(header, [\"name\", \"secret\", \"prefix\", \"suffix\"]) ||\n        !fieldId(header.secret) ||\n        !fieldIds.has(header.secret) ||\n        (header.prefix !== undefined && !headerPart(header.prefix)) ||\n        (header.suffix !== undefined && !headerPart(header.suffix))\n      )\n        return null;\n      used.add(header.secret);\n      headers.push({\n        name: header.name,\n        secret: header.secret,\n        ...(header.prefix !== undefined ? { prefix: header.prefix as string } : {}),\n        ...(header.suffix !== undefined ? { suffix: header.suffix as string } : {}),\n      });\n    }\n  }\n  if (used.size !== fieldIds.size) return null;\n  return {\n    ...base,\n    ownership: value.ownership,\n    mcpSetup: { name: base.name, endpointUrl: base.endpointUrl, headers, secretFields: fields },\n  };\n}\n","import type {\n  ToolActionReview,\n  ToolReviewContext,\n  ToolReviewDetailsPage,\n} from \"./tool-action-review\";\n\nconst protectedName =\n  /password|passwd|secret|credential|authorization|cookie|(^|[_-])token($|[_-])|api[_-]?key|accessToken|refreshToken|privateKey/i;\nconst protectedReviewField = (key: string, fields: readonly string[] = []) =>\n  protectedName.test(key) || fields.includes(key) || fields.includes(\"*\");\nconst bound = (value: string, limit: number) =>\n  value.length > limit ? `${value.slice(0, limit)}…` : value;\nexport function toolReviewFieldLabel(key: string): string {\n  const label = key\n    .replace(/([a-z0-9])([A-Z])/g, \"$1 $2\")\n    .replace(/[_-]+/g, \" \")\n    .replace(/\\bids?\\b/gi, (word) => (word.length === 3 ? \"IDs\" : \"ID\"))\n    .replace(\n      /\\b(api|url|uri|http|https|ip|sql|json|html)(s?)\\b/gi,\n      (_word, name: string, plural: string) => `${name.toUpperCase()}${plural}`,\n    )\n    // Sentence case, keeping acronyms: \"Working Directory\" → \"Working directory\".\n    .replace(\n      /(?<=\\S\\s+)([A-Z])([a-z]+)\\b/g,\n      (_word, first: string, rest: string) => `${first.toLowerCase()}${rest}`,\n    )\n    .trim();\n  return label.charAt(0).toUpperCase() + label.slice(1);\n}\nexport function decodeReviewArguments(value: unknown): Record<string, unknown> | null {\n  // Historical SDK entries sometimes wrapped arguments in JSON. Decode only once.\n  let decoded = value;\n  if (typeof decoded === \"string\") {\n    try {\n      decoded = JSON.parse(decoded);\n    } catch {\n      return null;\n    }\n  }\n  return decoded && typeof decoded === \"object\" && !Array.isArray(decoded)\n    ? (decoded as Record<string, unknown>)\n    : null;\n}\nexport function safeReviewValue(\n  value: unknown,\n  key = \"\",\n  protectedFields: readonly string[] = [],\n  depth = 0,\n): unknown {\n  if (protectedReviewField(key, protectedFields)) return \"[Protected value]\";\n  if (depth > 20) return \"[Nested value; open this field for details]\";\n  if (Array.isArray(value))\n    return value.map((entry) => safeReviewValue(entry, \"\", protectedFields, depth + 1));\n  if (value && typeof value === \"object\")\n    return Object.fromEntries(\n      Object.entries(value).map(([name, entry]) => [\n        name,\n        safeReviewValue(entry, name, protectedFields, depth + 1),\n      ]),\n    );\n  return value;\n}\nfunction valueText(value: unknown): string {\n  return typeof value === \"string\"\n    ? value\n    : value === null\n      ? \"None\"\n      : typeof value === \"boolean\"\n        ? value\n          ? \"Yes\"\n          : \"No\"\n        : (JSON.stringify(value) ?? \"Unavailable\");\n}\nconst pointer = (name: string) => `/${name.replaceAll(\"~\", \"~0\").replaceAll(\"/\", \"~1\")}`;\n// Long arbitrary property names remain readable without placing them in every\n// preview or URL. An indexed segment opens their saved name and value together.\nconst fieldPointer = (key: string, index: number, parent = \"\") =>\n  pointer(key).length > 256 || parent.length + pointer(key).length > 1024\n    ? `/~2${index}`\n    : pointer(key);\n\nexport function toolReviewFields(\n  argumentsValue: unknown,\n  context?: ToolReviewContext,\n): { fields: ToolActionReview[\"fields\"]; moreFields: number } {\n  const args = decodeReviewArguments(argumentsValue);\n  if (!args) return { fields: [], moreFields: 0 };\n  const entries = Object.entries(args);\n  if (context?.email) {\n    const email = toolReviewFields(context.email);\n    const original = toolReviewFields(args, { ...context, email: undefined });\n    const fields = [\n      ...email.fields\n        .filter(\n          (field) =>\n            field.path !== \"/contentSha256\" && field.path !== \"/htmlBody\" && field.preview !== \"\",\n        )\n        .map((field) => ({\n          ...field,\n          label: field.path === \"/textBody\" ? \"Message\" : field.label,\n          path: `/$email${field.path}`,\n          ...(field.path === \"/attachments\"\n            ? {\n                preview: context\n                  .email!.attachments.map((attachment) => attachment.name)\n                  .join(\", \")\n                  .slice(0, 240),\n              }\n            : {}),\n        })),\n      ...original.fields.filter(\n        (field) =>\n          ![\n            \"/raw\",\n            \"/expectedContentSha256\",\n            \"/from\",\n            \"/to\",\n            \"/cc\",\n            \"/bcc\",\n            \"/subject\",\n            \"/body\",\n            \"/textBody\",\n            \"/htmlBody\",\n            \"/attachments\",\n          ].includes(field.path),\n      ),\n    ];\n    return {\n      fields: fields.slice(0, 16),\n      moreFields: original.moreFields + Math.max(0, fields.length - 16),\n    };\n  }\n  return {\n    moreFields: Math.max(0, entries.length - 16),\n    fields: entries.slice(0, 16).map(([key, value], index) => {\n      const hidden = protectedReviewField(key, context?.protectedFields);\n      const safe = hidden ? \"[Protected value]\" : value;\n      const count = !hidden && Array.isArray(value) ? value.length : undefined;\n      const compactList =\n        !hidden &&\n        Array.isArray(value) &&\n        value.length > 0 &&\n        value.length <= 4 &&\n        value.every(\n          (entry) =>\n            typeof entry === \"string\" || typeof entry === \"number\" || typeof entry === \"boolean\",\n        )\n          ? value.map(valueText).join(\", \")\n          : undefined;\n      const text =\n        compactList !== undefined\n          ? compactList\n          : count !== undefined\n            ? `${count.toLocaleString(\"en-US\")} item${count === 1 ? \"\" : \"s\"}`\n            : safe && typeof safe === \"object\"\n              ? `${Object.keys(safe).length} field${Object.keys(safe).length === 1 ? \"\" : \"s\"}`\n              : valueText(safe);\n      return {\n        path: fieldPointer(key, index),\n        label: bound(\n          (context?.fieldLabels && Object.hasOwn(context.fieldLabels, key)\n            ? context.fieldLabels[key]\n            : undefined) ?? toolReviewFieldLabel(key),\n          256,\n        ),\n        preview: bound(text, 240),\n        ...(count !== undefined ? { count } : {}),\n        truncated:\n          !hidden &&\n          (text.length > 240 ||\n            (compactList === undefined && typeof value === \"object\" && value !== null)),\n        ...(hidden ? { protected: true } : {}),\n      };\n    }),\n  };\n}\n\n/** Deterministic consequences from the reviewed bytes. Unknown fields remain visible. */\nexport function toolReviewAction(\n  toolName: string,\n  argumentsValue: unknown,\n  context?: ToolReviewContext,\n): Pick<\n  ToolActionReview,\n  \"title\" | \"approveLabel\" | \"effects\" | \"consequence\" | \"selectionCount\" | \"selectionKind\"\n> {\n  const fallback = {\n    title:\n      context?.title ??\n      bound(\n        toolReviewFieldLabel(\n          toolName.replace(/^mcp_[^_]+__/, \"\").replace(/^batch[_-](?=[a-z])/i, \"\"),\n        ),\n        256,\n      ),\n    approveLabel: \"Approve action\",\n    effects: [] as string[],\n  };\n  if (context?.kind !== \"gmail\") return fallback;\n  const args = decodeReviewArguments(argumentsValue);\n  if (!args) return fallback;\n  const thread = toolName.endsWith(\"_thread\");\n  const selectionKind = thread ? (\"threads\" as const) : (\"messages\" as const);\n  const ids =\n    thread && typeof args.threadId === \"string\"\n      ? [args.threadId]\n      : Array.isArray(args.messageIds)\n        ? args.messageIds\n        : typeof args.messageId === \"string\"\n          ? [args.messageId]\n          : null;\n  const selectionCount = ids?.every((id) => typeof id === \"string\") ? new Set(ids).size : undefined;\n  const noun =\n    selectionCount === undefined\n      ? thread\n        ? \"conversations\"\n        : \"messages\"\n      : `${selectionCount.toLocaleString(\"en-US\")} ${thread ? \"conversation\" : \"message\"}${selectionCount === 1 ? \"\" : \"s\"}`;\n  const addValues = toolName.startsWith(\"label_\") ? args.labelIds : args.addLabelIds;\n  const adds = Array.isArray(addValues)\n    ? addValues.filter((v): v is string => typeof v === \"string\")\n    : [];\n  const removeValues = toolName.startsWith(\"unlabel_\") ? args.labelIds : args.removeLabelIds;\n  const removes = Array.isArray(removeValues)\n    ? removeValues.filter((v): v is string => typeof v === \"string\")\n    : [];\n  const labelEffect = (label: string, adding: boolean): string => {\n    const known: Record<string, [string, string]> = {\n      TRASH: [\"Move to Trash\", \"Remove from Trash\"],\n      INBOX: [\"Move to Inbox\", \"Remove from Inbox\"],\n      UNREAD: [\"Mark as unread\", \"Mark as read\"],\n      STARRED: [\"Add star\", \"Remove star\"],\n      SPAM: [\"Mark as spam\", \"Remove from Spam\"],\n      IMPORTANT: [\"Mark as important\", \"Remove importance\"],\n    };\n    return (\n      (Object.hasOwn(known, label) ? known[label]?.[adding ? 0 : 1] : undefined) ??\n      `${adding ? \"Add\" : \"Remove\"} label ${bound(label, 120)}`\n    );\n  };\n  const effects = [\n    ...adds.map((id) => labelEffect(id, true)),\n    ...removes.map((id) => labelEffect(id, false)),\n  ];\n  if (\n    [\n      \"batch_modify_messages\",\n      \"modify_message\",\n      \"modify_thread\",\n      \"label_message\",\n      \"label_thread\",\n      \"unlabel_message\",\n      \"unlabel_thread\",\n    ].includes(toolName)\n  ) {\n    const trash = adds.includes(\"TRASH\");\n    return {\n      title: trash ? `Move ${noun} to Trash` : `Update ${noun}`,\n      approveLabel: trash ? \"Move to Trash\" : \"Apply changes\",\n      effects,\n      ...(selectionCount === undefined ? {} : { selectionCount, selectionKind }),\n      ...(trash\n        ? { consequence: \"Messages stay recoverable in Trash until Gmail deletes them.\" }\n        : thread\n          ? { consequence: \"Applies to every message in the conversation.\" }\n          : {}),\n    };\n  }\n  if ([\"trash_message\", \"restore_message\", \"trash_thread\", \"restore_thread\"].includes(toolName))\n    return {\n      title: toolName.startsWith(\"trash_\") ? `Move ${noun} to Trash` : `Remove ${noun} from Trash`,\n      approveLabel: toolName.startsWith(\"trash_\") ? \"Move to Trash\" : \"Remove from Trash\",\n      effects,\n      ...(selectionCount === undefined ? {} : { selectionCount, selectionKind }),\n    };\n  const named: Record<string, [string, string]> = {\n    send_message: [\"Send email\", \"Send email\"],\n    send_draft: [\"Send draft\", \"Send draft\"],\n    create_draft: [\"Create email draft\", \"Create draft\"],\n    update_draft: [\"Update email draft\", \"Update draft\"],\n    delete_draft: [\"Delete email draft\", \"Delete draft\"],\n    create_label: [\"Create label\", \"Create label\"],\n    update_label: [\"Update label\", \"Update label\"],\n    delete_label: [\"Delete label\", \"Delete label\"],\n  };\n  const action = Object.hasOwn(named, toolName) ? named[toolName] : undefined;\n  return action ? { title: action[0], approveLabel: action[1], effects } : fallback;\n}\n\n/** A bounded slice of the immutable saved arguments; never evaluates a fresh provider query. */\nexport function toolReviewDetails(\n  argumentsValue: unknown,\n  context: ToolReviewContext | undefined,\n  path: string,\n  offset: number,\n  limit = 25,\n): Omit<ToolReviewDetailsPage, \"id\" | \"actionDigest\" | \"version\"> {\n  if (\n    !Number.isSafeInteger(offset) ||\n    offset < 0 ||\n    !Number.isSafeInteger(limit) ||\n    limit < 1 ||\n    limit > 50\n  )\n    throw new Error(\"Invalid review page\");\n  const args = decodeReviewArguments(argumentsValue);\n  let value: unknown = context?.email ? { ...args, $email: context.email } : args;\n  if (path !== \"\") {\n    if (!path.startsWith(\"/\")) throw new Error(\"Invalid review field\");\n    for (const escaped of path.slice(1).split(\"/\")) {\n      if (/^~2\\d+$/.test(escaped)) {\n        if (!value || typeof value !== \"object\" || Array.isArray(value))\n          throw new Error(\"Review field not found\");\n        const selected = Object.entries(value)[Number(escaped.slice(2))];\n        if (!selected) throw new Error(\"Review field not found\");\n        value = {\n          fieldName: selected[0],\n          value: protectedReviewField(selected[0], context?.protectedFields)\n            ? \"[Protected value]\"\n            : selected[1],\n        };\n        continue;\n      }\n      const key = escaped.replaceAll(\"~1\", \"/\").replaceAll(\"~0\", \"~\");\n      if (protectedReviewField(key, context?.protectedFields)) {\n        value = \"[Protected value]\";\n        break;\n      }\n      if (!value || typeof value !== \"object\" || !Object.hasOwn(value, key))\n        throw new Error(\"Review field not found\");\n      value = (value as Record<string, unknown>)[key];\n    }\n  }\n  type DetailItem = ToolReviewDetailsPage[\"items\"][number];\n  const preview = (\n    entry: unknown,\n    key: string,\n    childPath: string,\n  ): Pick<DetailItem, \"value\" | \"truncated\" | \"path\"> => {\n    const hidden = protectedReviewField(key, context?.protectedFields);\n    if (!hidden && entry !== null && typeof entry === \"object\") {\n      const count = Array.isArray(entry) ? entry.length : Object.keys(entry).length;\n      return {\n        value: `${count.toLocaleString(\"en-US\")} ${Array.isArray(entry) ? (count === 1 ? \"item\" : \"items\") : count === 1 ? \"field\" : \"fields\"}`,\n        path: childPath,\n        truncated: true,\n      };\n    }\n    const text = valueText(safeReviewValue(entry, key, context?.protectedFields));\n    return {\n      value: bound(text, 4000),\n      ...(hidden ? {} : { path: childPath }),\n      truncated: !hidden && text.length > 4000,\n    };\n  };\n  let total: number;\n  let items: DetailItem[];\n  if (Array.isArray(value)) {\n    total = value.length;\n    items = value.slice(offset, offset + limit).map((entry, index) => ({\n      label: `${offset + index + 1}`,\n      ...preview(entry, \"\", `${path}/${offset + index}`),\n    }));\n  } else if (value && typeof value === \"object\") {\n    const entries = Object.entries(value);\n    total = entries.length;\n    items = entries.slice(offset, offset + limit).map(([key, entry], index) => ({\n      label: bound(\n        (context?.fieldLabels && Object.hasOwn(context.fieldLabels, key)\n          ? context.fieldLabels[key]\n          : undefined) ?? toolReviewFieldLabel(key),\n        256,\n      ),\n      ...preview(entry, key, `${path}${fieldPointer(key, offset + index, path)}`),\n    }));\n  } else {\n    const text = valueText(value);\n    total = Math.max(1, Math.ceil(text.length / 4000));\n    items = Array.from({ length: Math.max(0, Math.min(limit, total - offset)) }, (_, index) => ({\n      label: `Part ${offset + index + 1}`,\n      value: text.slice((offset + index) * 4000, (offset + index + 1) * 4000),\n    }));\n  }\n  return { path, items, total, nextOffset: offset + limit < total ? offset + limit : null };\n}\n","/** Exact endpoint identity: normalize URL syntax, preserve paths and query parameters. */\nexport function mcpEndpointIdentity(value: string | null | undefined): string | null {\n  if (!value) return null;\n  try {\n    const url = new URL(value);\n    if (![\"https:\", \"http:\"].includes(url.protocol) || url.username || url.password) return null;\n    url.hash = \"\";\n    return url.href;\n  } catch {\n    return null;\n  }\n}\n\nexport function pluginMcpUnavailableReason(server: {\n  endpoint: string | null;\n  transport?: string;\n  requiresConfiguration?: boolean;\n}): string | null {\n  if (server.transport === \"stdio\" || !server.endpoint) return \"Requires a local runtime\";\n  if (\n    server.transport &&\n    ![\"http\", \"streamable-http\", \"streamable_http\"].includes(server.transport)\n  )\n    return \"Unsupported transport: \" + server.transport;\n  if (server.requiresConfiguration || server.endpoint.includes(\"{\"))\n    return \"Requires custom connection configuration\";\n  const endpoint = mcpEndpointIdentity(server.endpoint);\n  if (!endpoint?.startsWith(\"https://\")) return \"Requires a valid HTTPS endpoint\";\n  return null;\n}\n","import type { ToolDisplayMetadata } from \"@opengeni/contracts\";\n\n/** Browser/native-safe event projection; do not import server schema runtimes. */\nexport function parseToolDisplayMetadata(value: unknown): ToolDisplayMetadata | undefined {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined;\n  const item = value as Record<string, unknown>;\n  if (\n    Object.keys(item).some(\n      (key) => ![\"toolName\", \"title\", \"accountLabel\", \"connector\", \"providerDomain\"].includes(key),\n    )\n  )\n    return undefined;\n  const text = (v: unknown, max: number): v is string =>\n    typeof v === \"string\" && v.length > 0 && v.length <= max;\n  if (!text(item.toolName, 512) || /[\\u0000-\\u001f\\u007f]/u.test(item.toolName)) return undefined;\n  if (item.title !== undefined && !text(item.title, 512)) return undefined;\n  if (item.accountLabel !== undefined && !text(item.accountLabel, 1024)) return undefined;\n  if (item.connector !== undefined && !text(item.connector, 512)) return undefined;\n  if (item.providerDomain !== undefined && !text(item.providerDomain, 253)) return undefined;\n  return {\n    toolName: item.toolName,\n    ...(item.title !== undefined ? { title: item.title as string } : {}),\n    ...(item.accountLabel !== undefined ? { accountLabel: item.accountLabel as string } : {}),\n    ...(item.connector !== undefined ? { connector: item.connector as string } : {}),\n    ...(item.providerDomain !== undefined ? { providerDomain: item.providerDomain as string } : {}),\n  };\n}\n","/**\n * A transport-tolerant MCP tool result.\n *\n * `value` is the canonical machine-readable payload after recognized MCP/JSON\n * envelopes are removed. `text` is the best presentation string without\n * discarding structured data. `raw` always retains the original evidence.\n */\nexport type NormalizedMcpOutput = Readonly<{\n  raw: unknown;\n  value: unknown;\n  text: string;\n  isError: boolean;\n}>;\n\nconst MAX_MCP_OUTPUT_DEPTH = 8;\nconst RESULT_ENVELOPE_KEYS = new Set([\"result\", \"isError\", \"jsonrpc\", \"id\", \"_meta\"]);\n\n/** Normalize common direct, JSON, and standard MCP result envelopes without throwing. */\nexport function normalizeMcpOutput(output: unknown): NormalizedMcpOutput {\n  const normalized = normalizeValue(output, 0, new Set<object>());\n  return {\n    raw: output,\n    value: normalized.value,\n    text: normalized.text,\n    isError: normalized.isError,\n  };\n}\n\ntype NormalizedValue = Omit<NormalizedMcpOutput, \"raw\">;\n\nfunction normalizeValue(value: unknown, depth: number, ancestors: Set<object>): NormalizedValue {\n  if (value === null || value === undefined) {\n    return { value, text: \"\", isError: false };\n  }\n  if (typeof value === \"string\") {\n    return normalizeText(value, depth, ancestors);\n  }\n  if (typeof value !== \"object\") {\n    return { value, text: String(value), isError: false };\n  }\n  if (depth >= MAX_MCP_OUTPUT_DEPTH || ancestors.has(value)) {\n    return { value, text: safeStringify(value), isError: false };\n  }\n\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value)) {\n      return { value, text: safeStringify(value), isError: false };\n    }\n\n    const record = value as Record<string, unknown>;\n    const envelopeError = record.isError === true;\n\n    if (record.type === \"text\" && typeof record.text === \"string\") {\n      const normalized = normalizeText(record.text, depth + 1, ancestors);\n      return {\n        value: normalized.value,\n        text: record.text,\n        isError: envelopeError || normalized.isError,\n      };\n    }\n\n    if (\"structuredContent\" in record) {\n      const normalized = normalizeValue(record.structuredContent, depth + 1, ancestors);\n      return {\n        value: normalized.value,\n        text: firstMcpText(record.content) ?? normalized.text,\n        isError: envelopeError || normalized.isError,\n      };\n    }\n\n    if (isMcpContent(record.content)) {\n      const text = firstMcpText(record.content);\n      if (text !== null) {\n        const normalized = normalizeText(text, depth + 1, ancestors);\n        return {\n          value: normalized.value,\n          text,\n          isError: envelopeError || normalized.isError,\n        };\n      }\n      return {\n        value,\n        text: safeStringify(value),\n        isError: envelopeError,\n      };\n    }\n\n    if (isResultEnvelope(record)) {\n      const normalized = normalizeValue(record.result, depth + 1, ancestors);\n      return {\n        value: normalized.value,\n        text: normalized.text,\n        isError: envelopeError || normalized.isError,\n      };\n    }\n\n    return {\n      value,\n      text: safeStringify(value),\n      isError: envelopeError,\n    };\n  } finally {\n    ancestors.delete(value);\n  }\n}\n\nfunction normalizeText(text: string, depth: number, ancestors: Set<object>): NormalizedValue {\n  try {\n    const parsed: unknown = JSON.parse(text);\n    const normalized = normalizeValue(parsed, depth + 1, ancestors);\n    return {\n      value: normalized.value,\n      text,\n      isError: normalized.isError,\n    };\n  } catch {\n    return { value: text, text, isError: false };\n  }\n}\n\nfunction isMcpContent(value: unknown): value is readonly Record<string, unknown>[] {\n  return (\n    Array.isArray(value) &&\n    value.some(\n      (part) =>\n        part !== null &&\n        typeof part === \"object\" &&\n        typeof (part as { type?: unknown }).type === \"string\",\n    )\n  );\n}\n\nfunction firstMcpText(value: unknown): string | null {\n  if (!Array.isArray(value)) {\n    return null;\n  }\n  for (const part of value) {\n    if (\n      part !== null &&\n      typeof part === \"object\" &&\n      (part as { type?: unknown }).type === \"text\" &&\n      typeof (part as { text?: unknown }).text === \"string\"\n    ) {\n      return (part as { text: string }).text;\n    }\n  }\n  return null;\n}\n\nfunction isResultEnvelope(record: Record<string, unknown>): boolean {\n  return \"result\" in record && Object.keys(record).every((key) => RESULT_ENVELOPE_KEYS.has(key));\n}\n\nfunction safeStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value) ?? \"\";\n  } catch {\n    return String(value);\n  }\n}\n","// Zero-dependency desktop (noVNC) transport contract.\n//\n// The actual `@novnc/novnc` RFB import is a browser-only DOM dependency and\n// lives in `@opengeni/react` (lazily imported, SSR-safe). The framework-agnostic\n// SDK ships only the transport CONTRACT: a URL assembler, the minimal RFB\n// surface the component drives, the connection state machine, and the\n// rotation/fence reducers — all pure and unit-testable, with no DOM and no deps.\n//\n// Channel A (terminal-as-events, files, git) needs NO new transport here: those\n// are event projections + the synchronous fs/git/terminal point queries on\n// `OpenGeniClient`. Only the desktop pixel plane (Channel B, direct-to-provider)\n// needs this.\n\nimport type { DesktopStreamCapability, StreamUrlRotatedPayload } from \"./types\";\n\n/**\n * Translate the negotiated desktop capability into the WebSocket URL the noVNC\n * RFB client connects to. The scoped provider token is ALREADY embedded in the\n * minted `url` (Modal tunnel host, Blaxel `bl_preview_token`, Daytona signed\n * preview) by `session.resolveExposedPort(6080)` — we do NOT append `cap.token`\n * as a query param (that double-auth was an adversarial-review bug: the box runs\n * `-nopw` in v1, so the RFB password is meaningless and the real auth is the\n * tunnel token in the host). We only normalize the scheme to `ws`/`wss` and, when\n * the minted URL points at a `vnc.html` viewer page, rewrite it to the\n * websockify socket path noVNC actually dials.\n */\nexport function desktopSocketUrl(cap: Pick<DesktopStreamCapability, \"url\">): string {\n  if (!cap.url) {\n    throw new Error(\"desktop capability has no url (transport is null)\");\n  }\n  const u = new URL(cap.url);\n  // https → wss, http → ws (noVNC dials a WebSocket, not the HTTP viewer page).\n  if (u.protocol === \"https:\") {\n    u.protocol = \"wss:\";\n  } else if (u.protocol === \"http:\") {\n    u.protocol = \"ws:\";\n  }\n  // A minted `…/vnc.html` (or `…/vnc_lite.html`) viewer page → the websockify\n  // socket the page itself would open (`…/websockify`). A bare host/path with no\n  // viewer page is already the socket path; leave it untouched.\n  if (/\\/vnc(_lite)?\\.html$/.test(u.pathname)) {\n    u.pathname = u.pathname.replace(/\\/vnc(_lite)?\\.html$/, \"/websockify\");\n    u.search = \"\";\n    u.hash = \"\";\n  }\n  return u.toString();\n}\n\n/**\n * The minimal RFB surface the React component drives. Lets tests (and 3rd\n * parties swapping noVNC for a WebRTC client in v3) provide a fake without the\n * DOM. Matches `@novnc/novnc`'s RFB constructor + lifecycle.\n */\nexport interface DesktopRfbLike {\n  viewOnly: boolean;\n  scaleViewport: boolean;\n  /**\n   * 1:1 viewport clipping. We always drive this FALSE: with clipping on, noVNC\n   * paints the framebuffer pixel-for-pixel and scrolls/crops to the container\n   * (the \"zoomed in\" look). FALSE lets `scaleViewport` shrink the 1280x800 frame\n   * to fit the panel (aspect-preserved). Declared so the hook can pin it instead\n   * of relying on noVNC's default — `scaleViewport=true` forces clip off\n   * internally, but a stale/partial state on reconnect could leave it on.\n   */\n  clipViewport: boolean;\n  addEventListener(\n    type: \"connect\" | \"disconnect\" | \"securityfailure\",\n    cb: (e?: unknown) => void,\n  ): void;\n  removeEventListener?: (\n    type: \"connect\" | \"disconnect\" | \"securityfailure\",\n    cb: (e?: unknown) => void,\n  ) => void;\n  /** Send clipboard text over the already-open RFB connection. */\n  clipboardPasteFrom?(text: string): void;\n  /** Send one RFB key event. A missing `down` emits a complete key press. */\n  sendKey?(keysym: number, code: string, down?: boolean): void;\n  /** Focus or release the RFB keyboard sink without reconnecting. */\n  focus?(options?: FocusOptions): void;\n  blur?(): void;\n  disconnect(): void;\n}\n\nexport type DesktopRfbFactory = (\n  target: HTMLElement,\n  url: string,\n  opts: {\n    credentials?: { password?: string | undefined } | undefined;\n    wsProtocols?: string[] | undefined;\n  },\n) => DesktopRfbLike;\n\nexport type DesktopConnectionState =\n  | \"idle\"\n  | \"negotiating\"\n  | \"connecting\"\n  | \"connected\"\n  | \"rotating\"\n  | \"reconnecting\"\n  | \"error\"\n  | \"ended\";\n\nexport type DesktopStreamEvent =\n  | { type: \"negotiated\" }\n  | { type: \"connected\" }\n  | { type: \"disconnected\" }\n  | { type: \"rotate\" }\n  | { type: \"fail\" }\n  | { type: \"abort\" };\n\n/**\n * Pure reducer for the desktop connection lifecycle. The component owns the RFB\n * object + DOM; this owns the transitions so they are unit-testable. Mirrors the\n * Channel-A stream reducer discipline.\n */\nexport function nextDesktopState(\n  current: DesktopConnectionState,\n  ev: DesktopStreamEvent,\n): DesktopConnectionState {\n  switch (ev.type) {\n    case \"negotiated\":\n      return \"connecting\";\n    case \"connected\":\n      return \"connected\";\n    case \"rotate\":\n      return current === \"connected\" ? \"rotating\" : current;\n    case \"disconnected\":\n      // A deliberate teardown (ended) stays ended; everything else reconnects.\n      return current === \"ended\" ? \"ended\" : \"reconnecting\";\n    case \"fail\":\n      return \"error\";\n    case \"abort\":\n      return \"ended\";\n    default:\n      return current;\n  }\n}\n\n// `DesktopStreamCapability` is the desktop cell of `SessionCapabilities`; alias\n// it for the rotation reducer below without depending on the whole doc.\nexport type DesktopStreamCapabilityLike = {\n  url: string | null;\n  token: string | null;\n  expiresAt: string | null;\n};\n\n/**\n * Apply a `stream.url.rotated` event onto a desktop capability, fencing on\n * leaseEpoch (split-brain). A rotation minted under an epoch the client has\n * already advanced PAST is from a superseded owner and is dropped (returns\n * null); otherwise the fresh url/token/expiresAt are folded in.\n */\nexport function applyUrlRotation<T extends DesktopStreamCapabilityLike>(\n  cap: T,\n  payload: StreamUrlRotatedPayload,\n  knownEpoch: number,\n): T | null {\n  if (payload.leaseEpoch < knownEpoch) {\n    return null;\n  }\n  return { ...cap, url: payload.url, token: payload.token, expiresAt: payload.expiresAt };\n}\n","// Zero-dependency interactive-terminal (ttyd PTY-over-websocket) transport\n// contract. Symmetric with `desktop.ts`: the SDK ships only the pure transport\n// CONTRACT (a URL assembler + the ttyd wire-protocol frame codec), with no DOM\n// and no deps. The actual WebSocket open + xterm attach lives in `@opengeni/react`\n// (`use-terminal-stream.ts`).\n//\n// The interactive terminal is a REAL PTY streamed over the SAME Modal raw-TLS\n// tunnel as the desktop noVNC, with the SAME scoped stream-token mechanism. The\n// box bakes `ttyd` on `TERMINAL_STREAM_PORT` (7681); `session.resolveExposedPort`\n// mints the tunnel URL. The Terminal capability cell carries transport \"pty-ws\" +\n// that url + the scoped token when the box is warm and a viewer is attached.\n\nimport type { TerminalCapability } from \"./types\";\n\n/**\n * Translate the negotiated `pty-ws` Terminal capability into the WebSocket URL\n * the ttyd client dials. The scoped provider token is ALREADY embedded in the\n * minted `url` (the Modal tunnel host) by `session.resolveExposedPort(7681)` —\n * we do NOT append `cap.token` (identical posture to the desktop: the gate is the\n * unguessable short-TTL tunnel URL + the server-recorded scoped stream token; ttyd\n * runs `--writable` with no `-c` credential in v1). We only normalize the scheme\n * to `ws`/`wss`; a bare host is already the ttyd websocket endpoint.\n */\nexport function terminalSocketUrl(cap: Pick<TerminalCapability, \"url\">): string {\n  if (!cap.url) {\n    throw new Error(\"terminal capability has no url (transport is not pty-ws)\");\n  }\n  const u = new URL(cap.url);\n  // https → wss, http → ws (ttyd is dialed as a WebSocket, not an HTTP page).\n  if (u.protocol === \"https:\") {\n    u.protocol = \"wss:\";\n  } else if (u.protocol === \"http:\") {\n    u.protocol = \"ws:\";\n  }\n  return u.toString();\n}\n\n// ── ttyd wire protocol ───────────────────────────────────────────────────────\n// ttyd frames are a single ASCII command char + payload. These mirror ttyd's\n// `protocol.h` Command enum. Client→server and server→client share the byte 0/1/2\n// values but mean different things per direction (see below).\n\n/** ttyd subprotocol — REQUIRED on the WebSocket handshake or ttyd refuses it. */\nexport const TTYD_SUBPROTOCOL = \"tty\";\n\n/** Client→server command bytes (the first char of each outbound text frame). */\nexport const TtydClientCommand = {\n  /** stdin: \"0\" + raw input bytes. */\n  INPUT: \"0\",\n  /** window resize: \"1\" + JSON.stringify({ columns, rows }). */\n  RESIZE: \"1\",\n  /** flow-control pause (back-pressure): \"2\". */\n  PAUSE: \"2\",\n  /** flow-control resume: \"3\". */\n  RESUME: \"3\",\n} as const;\n\n/** Server→client command bytes (the first char of each inbound frame). */\nexport const TtydServerCommand = {\n  /** stdout/stderr: \"0\" + raw output bytes (write the rest into xterm). */\n  OUTPUT: \"0\",\n  /** set the window title: \"1\" + title string. */\n  SET_WINDOW_TITLE: \"1\",\n  /** ttyd client preferences JSON: \"2\" + json (ignored by us). */\n  SET_PREFERENCES: \"2\",\n} as const;\n\n/**\n * The ttyd handshake's first frame: an auth message. ttyd expects\n * `JSON.stringify({ AuthToken })` as the FIRST text frame on the socket. We send\n * an empty token — our gate is the tunnel URL + scoped stream token, NOT a ttyd\n * `-c` basic-auth credential (which the box does not set in v1). Optional ttyd\n * `columns`/`rows` can ride this frame to seed the PTY size before the first\n * resize. Pure (string-building only) so it stays unit-testable in the SDK.\n */\nexport function ttydAuthFrame(opts?: { columns?: number; rows?: number }): string {\n  const frame: { AuthToken: string; columns?: number; rows?: number } = { AuthToken: \"\" };\n  if (opts?.columns && opts.columns > 0) frame.columns = opts.columns;\n  if (opts?.rows && opts.rows > 0) frame.rows = opts.rows;\n  return JSON.stringify(frame);\n}\n\n/** Build a client→server INPUT (stdin) frame: \"0\" + data. */\nexport function ttydInputFrame(data: string): string {\n  return TtydClientCommand.INPUT + data;\n}\n\n/** Build a client→server RESIZE frame: \"1\" + JSON.stringify({ columns, rows }). */\nexport function ttydResizeFrame(columns: number, rows: number): string {\n  return TtydClientCommand.RESIZE + JSON.stringify({ columns, rows });\n}\n","export const WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS = 262_144;\n\nexport type WorkspaceInstructionPolicyKind = \"charter\" | \"policy\";\nexport type WorkspaceInstructionPolicyScope = \"global\" | \"role\";\nexport type WorkspaceInstructionPolicyProvenanceSource =\n  | \"human\"\n  | \"onboarding\"\n  | \"agent_learning\"\n  | \"knowledge_proposal\"\n  | \"legacy_import\";\nexport type WorkspaceInstructionPolicyDraftProvenanceSource = Exclude<\n  WorkspaceInstructionPolicyProvenanceSource,\n  \"legacy_import\" | \"agent_learning\"\n>;\nexport type WorkspaceInstructionPolicyActivationType = \"activate\" | \"rollback\";\n\nexport function normalizeWorkspaceInstructionPolicyRoleKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n\nexport type WorkspaceInstructionPolicyTarget = {\n  kind: WorkspaceInstructionPolicyKind;\n  scope: WorkspaceInstructionPolicyScope;\n  roleKey: string | null;\n};\n\nexport type WorkspaceInstructionPolicyRevisionIdentity = {\n  id: string;\n  revision: number;\n  contentHash: string;\n};\n\nexport type WorkspaceInstructionPolicyRevision = WorkspaceInstructionPolicyRevisionIdentity &\n  WorkspaceInstructionPolicyTarget & {\n    operationId: string;\n    accountId: string;\n    workspaceId: string;\n    content: string;\n    provenance: {\n      source: WorkspaceInstructionPolicyProvenanceSource;\n      sourceId: string | null;\n    };\n    supersedesRevisionId: string | null;\n    createdBySubjectId: string;\n    createdAt: string;\n  };\n\nexport type WorkspaceInstructionPolicyHead = WorkspaceInstructionPolicyTarget & {\n  workspaceId: string;\n  revisionId: string;\n  revision: number;\n  contentHash: string;\n  activationVersion: number;\n  activatedAt: string;\n};\n\nexport type WorkspaceInstructionPolicyInactiveHead = WorkspaceInstructionPolicyTarget & {\n  workspaceId: string;\n  activationVersion: number;\n  deactivatedAt: string;\n};\n\nexport type WorkspaceInstructionPolicyActivationEvent = WorkspaceInstructionPolicyTarget & {\n  id: string;\n  operationId: string;\n  accountId: string;\n  workspaceId: string;\n  type: WorkspaceInstructionPolicyActivationType;\n  activationVersion: number;\n  oldRevision: WorkspaceInstructionPolicyRevisionIdentity | null;\n  newRevision: WorkspaceInstructionPolicyRevisionIdentity;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\n\nexport type WorkspaceInstructionPolicyDeactivationEvent = WorkspaceInstructionPolicyTarget & {\n  id: string;\n  operationId: string;\n  accountId: string;\n  workspaceId: string;\n  type: \"automatic_deactivate\";\n  activationVersion: number;\n  oldRevision: WorkspaceInstructionPolicyRevisionIdentity;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\n\nexport type CreateWorkspaceInstructionPolicyDraftRequest = WorkspaceInstructionPolicyTarget & {\n  operationId?: string;\n  content: string;\n  provenanceSource?: WorkspaceInstructionPolicyDraftProvenanceSource;\n  provenanceSourceId?: string | null;\n  supersedesRevisionId?: string | null;\n};\n\nexport type ImportLegacyWorkspaceInstructionPolicyDraftRequest = {\n  operationId?: string;\n  supersedesRevisionId?: string | null;\n};\n\nexport type WorkspaceInstructionPolicyListOptions = {\n  kind?: WorkspaceInstructionPolicyKind;\n  scope?: WorkspaceInstructionPolicyScope;\n  roleKey?: string;\n  afterRevision?: number;\n  limit?: number;\n};\n\nexport type WorkspaceInstructionPolicyListResponse = {\n  revisions: WorkspaceInstructionPolicyRevision[];\n  activeHeads: WorkspaceInstructionPolicyHead[];\n  /** Additive current inactive target boundaries; absent on pre-controller servers. */\n  inactiveHeads?: WorkspaceInstructionPolicyInactiveHead[];\n  inactiveHeadsTruncated?: boolean;\n  activationEvents: WorkspaceInstructionPolicyActivationEvent[];\n  /** Additive lifecycle history; absent on pre-controller servers. */\n  deactivationEvents?: WorkspaceInstructionPolicyDeactivationEvent[];\n  nextAfterRevision: number | null;\n};\n\nexport type WorkspaceInstructionPolicyDiffRequest = {\n  fromRevisionId: string;\n  toRevisionId: string;\n};\n\nexport type WorkspaceInstructionPolicyDiffResponse = {\n  from: WorkspaceInstructionPolicyRevision;\n  to: WorkspaceInstructionPolicyRevision;\n  format: \"unified\";\n  diff: string;\n};\n\nexport type ActivateWorkspaceInstructionPolicyRequest = {\n  operationId?: string;\n  expectedCurrentRevisionId: string | null;\n  expectedActivationVersion?: number;\n  reason: string;\n};\n\nexport type RollbackWorkspaceInstructionPolicyRequest = {\n  operationId?: string;\n  targetRevisionId: string;\n  expectedCurrentRevisionId: string;\n  expectedActivationVersion?: number;\n  reason: string;\n};\n\nexport type WorkspaceInstructionPolicyActivationResponse = {\n  head: WorkspaceInstructionPolicyHead;\n  event: WorkspaceInstructionPolicyActivationEvent;\n};\n\nexport type WorkspaceInstructionPolicyConflictResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_CONFLICT\";\n  message: string;\n  currentHead: WorkspaceInstructionPolicyHead | null;\n};\n\nexport type WorkspaceInstructionPolicyOperationReuseResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_OPERATION_REUSED\";\n  message: string;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalSource = {\n  id: string;\n  version: string;\n  confidenceBps: number;\n};\n\nexport type CreateWorkspaceInstructionPolicyOnboardingProposalRequest =\n  WorkspaceInstructionPolicyTarget & {\n    operationId?: string;\n    content: string;\n    sourceId: string;\n    sourceVersion: string;\n    confidenceBps: number;\n    expectedCurrentRevisionId: string | null;\n    expectedActivationVersion: number;\n  };\n\nexport type WorkspaceInstructionPolicyOnboardingProposal = WorkspaceInstructionPolicyTarget & {\n  id: string;\n  operationId: string;\n  accountId: string;\n  workspaceId: string;\n  source: WorkspaceInstructionPolicyOnboardingProposalSource;\n  baseline: WorkspaceInstructionPolicyHead | null;\n  draft: WorkspaceInstructionPolicyRevision;\n  status: \"proposed\";\n  createdBySubjectId: string;\n  createdAt: string;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalListOptions = {\n  limit?: number;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalListResponse = {\n  proposals: WorkspaceInstructionPolicyOnboardingProposal[];\n  truncated: boolean;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalContentErrorResponse = {\n  code:\n    | \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_EMPTY\"\n    | \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_OVERSIZED\";\n  message: string;\n  maxChars: number;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalStaleResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_STALE\";\n  message: string;\n  currentHead: WorkspaceInstructionPolicyHead | null;\n};\n\nexport type WorkspaceInstructionPolicyOnboardingProposalConflictResponse = {\n  code: \"WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_CONFLICT\";\n  message: string;\n  existingProposalId: string;\n  existingDraftRevisionId: string;\n};\n","export const COMPANY_PROFILE_SCALAR_MAX_CHARS = 2_048;\nexport const COMPANY_PROFILE_ENTRY_MAX_CHARS = 1_024;\nexport const COMPANY_PROFILE_ENTRY_MAX_COUNT = 16;\n\nexport type CompanyProfileEntry = { key: string; content: string };\nexport type CompanyProfileContent = {\n  identity: string | null;\n  mission: string | null;\n  products: CompanyProfileEntry[];\n  customers: CompanyProfileEntry[];\n  goals: CompanyProfileEntry[];\n  constraints: CompanyProfileEntry[];\n};\nexport type CompanyProfileRevisionIdentity = {\n  id: string;\n  revision: number;\n  contentHash: string;\n};\nexport type CompanyProfileRevision = CompanyProfileRevisionIdentity & {\n  operationId: string;\n  accountId: string;\n  intent: \"active\" | \"proposal\";\n  profile: CompanyProfileContent;\n  provenance: {\n    source: \"human\" | \"agent_admin\" | \"durable_learning\" | \"migration\";\n    sourceId: string | null;\n  };\n  supersedesRevisionId: string | null;\n  createdBySubjectId: string;\n  createdAt: string;\n};\nexport type CompanyProfileHead = {\n  accountId: string;\n  revisionId: string;\n  revision: number;\n  contentHash: string;\n  activationVersion: number;\n  activatedAt: string;\n};\nexport type CompanyProfileActivationEvent = {\n  id: string;\n  operationId: string;\n  accountId: string;\n  type: \"activate\" | \"rollback\";\n  activationVersion: number;\n  oldRevision: CompanyProfileRevisionIdentity | null;\n  newRevision: CompanyProfileRevisionIdentity | null;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\nexport type CompanyProfileListOptions = { afterRevision?: number; limit?: number };\nexport type CompanyProfileListResponse = {\n  current: CompanyProfileHead | null;\n  activeRevision: CompanyProfileRevision | null;\n  revisions: CompanyProfileRevision[];\n  activationEvents: CompanyProfileActivationEvent[];\n  nextAfterRevision: number | null;\n};\nexport type UpdateCompanyProfileRequest = {\n  operationId?: string;\n  profile: CompanyProfileContent;\n  expectedCurrentRevisionId: string | null;\n  expectedActivationVersion: number;\n  reason: string;\n};\nexport type ActivateCompanyProfileRevisionRequest = {\n  operationId?: string;\n  expectedCurrentRevisionId: string | null;\n  expectedActivationVersion: number;\n  reason: string;\n};\nexport type RollbackCompanyProfileRequest = {\n  operationId?: string;\n  targetRevisionId: string;\n  expectedCurrentRevisionId: string;\n  expectedActivationVersion: number;\n  reason: string;\n};\nexport type CompanyProfileMutationResponse = {\n  revision: CompanyProfileRevision | null;\n  head: CompanyProfileHead | null;\n  event: CompanyProfileActivationEvent | null;\n};\nexport type CompanyProfileAgentPolicyMode = \"off\" | \"suggest\" | \"automatic\";\nexport type CompanyProfileAgentPolicy = {\n  organizationId: string;\n  mode: CompanyProfileAgentPolicyMode;\n  version: number;\n  updatedAt: string;\n  changed?: boolean;\n};\nexport type UpdateCompanyProfileAgentPolicyRequest = {\n  mode: CompanyProfileAgentPolicyMode;\n  expectedVersion: number;\n  operationId: string;\n};\nexport type CompanyProfileDiffRequest = { fromRevisionId: string; toRevisionId: string };\nexport type CompanyProfileDiffResponse = {\n  from: CompanyProfileRevision;\n  to: CompanyProfileRevision;\n  format: \"unified_json\";\n  diff: string;\n};\n\nexport function normalizeCompanyProfileStableKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n","import type {\n  CompanyBrainContextReceiptPage as ContractCompanyBrainContextReceiptPage,\n  CompanyBrainKnowledgeProposalPage as ContractCompanyBrainKnowledgeProposalPage,\n  CompanyBrainOkfPackage as ContractCompanyBrainOkfPackage,\n} from \"@opengeni/contracts\";\n\nexport type CompanyBrainOkfPackage = ContractCompanyBrainOkfPackage;\nexport type CompanyBrainContextReceiptPage = ContractCompanyBrainContextReceiptPage;\nexport type CompanyBrainKnowledgeProposalPage = ContractCompanyBrainKnowledgeProposalPage;\n\nexport type CompanyBrainContextReceiptListOptions = {\n  attemptId?: string;\n  cursor?: string;\n  limit?: number;\n};\n\nexport type CompanyBrainKnowledgeProposalListOptions = {\n  limit?: number;\n};\n\nexport type CompanyBrainInspectorTransport = {\n  requestJson<T>(method: string, path: string, body?: unknown): Promise<T>;\n};\n\nfunction inspectorPath(workspaceId: string, suffix: string): string {\n  return `/v1/workspaces/${workspaceId}/company-brain/${suffix}`;\n}\n\nexport function listCompanyBrainContextReceipts(\n  client: CompanyBrainInspectorTransport,\n  workspaceId: string,\n  options: CompanyBrainContextReceiptListOptions = {},\n): Promise<CompanyBrainContextReceiptPage> {\n  const params = new URLSearchParams();\n  if (options.attemptId) params.set(\"attemptId\", options.attemptId);\n  if (options.cursor) params.set(\"cursor\", options.cursor);\n  if (options.limit !== undefined) params.set(\"limit\", String(options.limit));\n  const query = params.toString();\n  return client.requestJson(\n    \"GET\",\n    `${inspectorPath(workspaceId, \"context-receipts\")}${query ? `?${query}` : \"\"}`,\n  );\n}\n\nexport function listCompanyBrainKnowledgeProposals(\n  client: CompanyBrainInspectorTransport,\n  workspaceId: string,\n  options: CompanyBrainKnowledgeProposalListOptions = {},\n): Promise<CompanyBrainKnowledgeProposalPage> {\n  const query =\n    options.limit === undefined ? \"\" : `?limit=${encodeURIComponent(String(options.limit))}`;\n  return client.requestJson(\"GET\", `${inspectorPath(workspaceId, \"knowledge-proposals\")}${query}`);\n}\n\nexport type CompanyBrainOkfDownload = {\n  content: string;\n  contentType: string;\n  filename: string;\n};\n","export type PreferenceRegistryScope = \"organization\" | \"workspace\" | \"user\";\nexport type PreferenceRegistryStatus =\n  | \"proposed\"\n  | \"active\"\n  | \"inactive\"\n  | \"rejected\"\n  | \"superseded\"\n  | \"expired\";\nexport type PreferenceRegistryProvenanceSource =\n  | \"human\"\n  | \"onboarding\"\n  | \"knowledge_proposal\"\n  | \"agent\"\n  | \"portable_skill\"\n  | \"imported_document\"\n  | \"slack\"\n  | \"meeting_transcript\"\n  | \"call_transcript\";\nexport type PreferenceRegistryTrust =\n  | \"untrusted_proposal\"\n  | \"personal\"\n  | \"workspace_managed\"\n  | \"organization_managed\";\nexport type PreferenceRegistryConflictStrategy = \"override\" | \"merge\" | \"reject\" | \"inform\";\n\nexport function normalizePreferenceRegistryStableKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n\nexport type PreferenceRegistryScopeTarget = {\n  scope: PreferenceRegistryScope;\n  workspaceId: string | null;\n  subjectId: string | null;\n};\n\nexport type PreferenceRegistryPrecedence = {\n  tier: PreferenceRegistryScope;\n  rank: number;\n  conflictStrategy: PreferenceRegistryConflictStrategy;\n  conflictsWith: string[];\n};\n\nexport type PreferenceRegistryRevisionSummary = {\n  id: string;\n  preferenceId: string;\n  revision: number;\n  contentHash: string;\n  title: string;\n  description: string;\n  precedence: PreferenceRegistryPrecedence;\n  provenance: {\n    source: PreferenceRegistryProvenanceSource;\n    sourceId: string | null;\n    trust: PreferenceRegistryTrust;\n  };\n  expiresAt: string | null;\n  correctsRevisionId: string | null;\n  createdBySubjectId: string;\n  createdAt: string;\n};\n\nexport type PreferenceRegistryDescriptorProvenance = {\n  source: PreferenceRegistryProvenanceSource;\n  sourceIdHash: string | null;\n  trust: PreferenceRegistryTrust;\n};\n\nexport type PreferenceRegistryRecord = {\n  id: string;\n  accountId: string;\n  stableKey: string;\n  target: PreferenceRegistryScopeTarget;\n  status: PreferenceRegistryStatus;\n  scopeVersion: number;\n  activationVersion: number;\n  activeRevision: PreferenceRegistryRevisionSummary | null;\n  supersededByPreferenceId: string | null;\n  createdBySubjectId: string;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type PreferenceRegistryEvent = {\n  id: string;\n  accountId: string;\n  preferenceId: string;\n  type:\n    | \"proposal_created\"\n    | \"activated\"\n    | \"corrected\"\n    | \"rejected\"\n    | \"deactivated\"\n    | \"superseded\"\n    | \"scope_changed\";\n  version: number;\n  oldRevisionId: string | null;\n  newRevisionId: string | null;\n  oldTarget: PreferenceRegistryScopeTarget | null;\n  newTarget: PreferenceRegistryScopeTarget | null;\n  relatedPreferenceId: string | null;\n  actorSubjectId: string;\n  reason: string;\n  createdAt: string;\n};\n\nexport type PreferenceRegistryActivationAuthority = \"human_confirmed\" | \"automatic\";\n\nexport type PreferenceRegistryDescriptor = {\n  id: string;\n  stableKey: string;\n  title: string;\n  description: string;\n  scope: PreferenceRegistryScope;\n  activeVersion: number;\n  revisionId: string;\n  contentHash: string;\n  precedence: PreferenceRegistryPrecedence;\n  provenance: PreferenceRegistryDescriptorProvenance;\n  /**\n   * How the active revision became active. `provenance.trust` stays the frozen\n   * creation-time fact; this is the separate activation question. Null when the\n   * revision became active outside governed learning, or when the descriptor\n   * predates this field.\n   */\n  activationAuthority: PreferenceRegistryActivationAuthority | null;\n  expiresAt: string | null;\n  retrievalHandle: string;\n};\n\nexport type PreferenceRegistrySnapshot = {\n  id: string;\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  initiatingHumanSubjectId: string;\n  descriptorHash: string;\n  descriptors: PreferenceRegistryDescriptor[];\n  truncated: boolean;\n  createdAt: string;\n};\n\nexport type PreferenceRegistryFullContent = {\n  descriptor: PreferenceRegistryDescriptor;\n  content: string;\n};\n\nexport type CreatePreferenceRegistryProposalRequest = {\n  stableKey: string;\n  scope: PreferenceRegistryScope;\n  title: string;\n  description: string;\n  content: string;\n  precedenceRank?: number;\n  conflictStrategy?: PreferenceRegistryConflictStrategy;\n  conflictsWith?: string[];\n  expiresAt?: string | null;\n  provenanceSource?: PreferenceRegistryProvenanceSource;\n  provenanceSourceId?: string | null;\n};\n\nexport type ActivatePreferenceRegistryRevisionRequest = {\n  revisionId: string;\n  expectedCurrentRevisionId: string | null;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type CorrectPreferenceRegistryRequest = {\n  expectedCurrentRevisionId: string;\n  expectedScopeVersion: number;\n  title: string;\n  description: string;\n  content: string;\n  precedenceRank?: number;\n  conflictStrategy?: PreferenceRegistryConflictStrategy;\n  conflictsWith?: string[];\n  expiresAt?: string | null;\n  reason: string;\n};\n\nexport type DeactivatePreferenceRegistryRequest = {\n  expectedCurrentRevisionId: string;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type ChangePreferenceRegistryScopeRequest = {\n  scope: PreferenceRegistryScope;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type SupersedePreferenceRegistryRequest = {\n  replacementPreferenceId: string;\n  expectedCurrentRevisionId: string;\n  expectedScopeVersion: number;\n  reason: string;\n};\n\nexport type RejectPreferenceRegistryProposalRequest = {\n  revisionId: string;\n  expectedScopeVersion: number;\n  reason: string;\n};\nexport type PreferenceRegistryListOptions = {\n  scope?: PreferenceRegistryScope;\n  status?: PreferenceRegistryStatus;\n  limit?: number;\n};\nexport type PreferenceRegistryListResponse = { preferences: PreferenceRegistryRecord[] };\nexport type PreferenceRegistryDetailResponse = {\n  preference: PreferenceRegistryRecord;\n  revisions: PreferenceRegistryRevisionSummary[];\n  events: PreferenceRegistryEvent[];\n};\nexport type PreferenceRegistryMutationResponse = {\n  preference: PreferenceRegistryRecord;\n  event: PreferenceRegistryEvent;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,IAAM,SAAS,CAAC,UACd,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AACrE,IAAM,OAAO,CAAC,OAAgC,YAC5C,OAAO,KAAK,KAAK,EAAE,MAAM,CAAC,QAAQ,QAAQ,SAAS,GAAG,CAAC;AACzD,IAAM,OAAO,CAAC,OAAgB,KAAa,MAAM,MAC/C,OAAO,UAAU,YAAY,MAAM,UAAU,OAAO,MAAM,UAAU;AACtE,IAAM,cAAc,CAAC,OAAgB,QACnC,OAAO,UAAU,YAAY,KAAK,MAAM,KAAK,GAAG,GAAG;AACrD,IAAM,aAAa,CAAC,UAClB,KAAK,OAAO,OAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK;AAClD,IAAM,UAAU,CAAC,UACf,OAAO,UAAU,YAAY,+BAA+B,KAAK,KAAK;AACxE,IAAM,WAAW,CAAC,UAAoC;AACpD,MAAI,CAAC,KAAK,OAAO,IAAI,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,IAAI;AAAA,EAC5F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,2BAA2B,OAA8C;AACvF,MACE,CAAC,OAAO,KAAK,KACb,CAAC,KAAK,OAAO,CAAC,QAAQ,QAAQ,eAAe,aAAa,aAAa,UAAU,CAAC,KAClF,MAAM,SAAS,SACf,CAAC,YAAY,MAAM,MAAM,GAAG,KAC5B,CAAC,SAAS,MAAM,WAAW,KAC3B,CAAC,YAAY,MAAM,WAAW,GAAI;AAElC,WAAO;AACT,QAAM,OAAO;AAAA,IACX,MAAM;AAAA,IACN,MAAM,MAAM,KAAK,KAAK;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM,UAAU,KAAK;AAAA,EAClC;AACA,MAAI,MAAM,cAAc,UAAa,MAAM,aAAa,OAAW,QAAO;AAC1E,MAAI,MAAM,cAAc,cAAc,MAAM,cAAc,YAAa,QAAO;AAC9E,QAAM,QAAQ,MAAM;AACpB,MACE,CAAC,OAAO,KAAK,KACb,CAAC,KAAK,OAAO,CAAC,QAAQ,eAAe,WAAW,cAAc,CAAC,KAC/D,CAAC,YAAY,MAAM,MAAM,GAAG,KAC5B,MAAM,KAAK,KAAK,MAAM,KAAK,QAC3B,MAAM,gBAAgB,KAAK,eAC3B,CAAC,MAAM,QAAQ,MAAM,OAAO,KAC5B,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,SAAS,MACvB,CAAC,MAAM,QAAQ,MAAM,YAAY,KACjC,MAAM,aAAa,SAAS;AAE5B,WAAO;AACT,QAAM,SAA2C,CAAC;AAClD,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,SAAS,MAAM,cAAc;AACtC,QACE,CAAC,OAAO,KAAK,KACb,CAAC,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,KAC5B,CAAC,QAAQ,MAAM,EAAE,KACjB,CAAC,YAAY,MAAM,OAAO,GAAG,KAC7B,SAAS,IAAI,MAAM,EAAE;AAErB,aAAO;AACT,aAAS,IAAI,MAAM,EAAE;AACrB,WAAO,KAAK,EAAE,IAAI,MAAM,IAAI,OAAO,MAAM,MAAM,KAAK,EAAE,CAAC;AAAA,EACzD;AACA,QAAM,UAAuC,CAAC;AAC9C,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,UAAU,MAAM,SAAS;AAClC,QACE,CAAC,OAAO,MAAM,KACd,CAAC,KAAK,OAAO,MAAM,GAAG,KACtB,CAAC,gCAAgC,KAAK,OAAO,IAAI;AAEjD,aAAO;AACT,UAAM,OAAO,OAAO,KAAK,YAAY;AACrC,QAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAC5B,UAAM,IAAI,IAAI;AACd,QAAI,WAAW,QAAQ;AACrB,UACE,CAAC,KAAK,QAAQ,CAAC,QAAQ,OAAO,CAAC,KAC/B,CAAC,WAAW,OAAO,KAAK,KACxB,CAAC,OAAO,SACR,CAAC,iBAAiB,uBAAuB,UAAU,aAAa,SAAS,EAAE,SAAS,IAAI;AAExF,eAAO;AACT,cAAQ,KAAK,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,IACzD,OAAO;AACL,UACE,CAAC,KAAK,QAAQ,CAAC,QAAQ,UAAU,UAAU,QAAQ,CAAC,KACpD,CAAC,QAAQ,OAAO,MAAM,KACtB,CAAC,SAAS,IAAI,OAAO,MAAM,KAC1B,OAAO,WAAW,UAAa,CAAC,WAAW,OAAO,MAAM,KACxD,OAAO,WAAW,UAAa,CAAC,WAAW,OAAO,MAAM;AAEzD,eAAO;AACT,WAAK,IAAI,OAAO,MAAM;AACtB,cAAQ,KAAK;AAAA,QACX,MAAM,OAAO;AAAA,QACb,QAAQ,OAAO;AAAA,QACf,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAiB,IAAI,CAAC;AAAA,QACzE,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAiB,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,KAAK,SAAS,SAAS,KAAM,QAAO;AACxC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,MAAM;AAAA,IACjB,UAAU,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,SAAS,cAAc,OAAO;AAAA,EAC5F;AACF;;;ACpHA,IAAM,gBACJ;AACF,IAAM,uBAAuB,CAAC,KAAa,SAA4B,CAAC,MACtE,cAAc,KAAK,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG;AACxE,IAAM,QAAQ,CAAC,OAAe,UAC5B,MAAM,SAAS,QAAQ,GAAG,MAAM,MAAM,GAAG,KAAK,CAAC,WAAM;AAChD,SAAS,qBAAqB,KAAqB;AACxD,QAAM,QAAQ,IACX,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,UAAU,GAAG,EACrB,QAAQ,cAAc,CAAC,SAAU,KAAK,WAAW,IAAI,QAAQ,IAAK,EAClE;AAAA,IACC;AAAA,IACA,CAAC,OAAO,MAAc,WAAmB,GAAG,KAAK,YAAY,CAAC,GAAG,MAAM;AAAA,EACzE,EAEC;AAAA,IACC;AAAA,IACA,CAAC,OAAO,OAAe,SAAiB,GAAG,MAAM,YAAY,CAAC,GAAG,IAAI;AAAA,EACvE,EACC,KAAK;AACR,SAAO,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC;AACtD;AACO,SAAS,sBAAsB,OAAgD;AAEpF,MAAI,UAAU;AACd,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO;AAAA,IAC9B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAClE,UACD;AACN;AACO,SAAS,gBACd,OACA,MAAM,IACN,kBAAqC,CAAC,GACtC,QAAQ,GACC;AACT,MAAI,qBAAqB,KAAK,eAAe,EAAG,QAAO;AACvD,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,MAAM,QAAQ,KAAK;AACrB,WAAO,MAAM,IAAI,CAAC,UAAU,gBAAgB,OAAO,IAAI,iBAAiB,QAAQ,CAAC,CAAC;AACpF,MAAI,SAAS,OAAO,UAAU;AAC5B,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,QAC3C;AAAA,QACA,gBAAgB,OAAO,MAAM,iBAAiB,QAAQ,CAAC;AAAA,MACzD,CAAC;AAAA,IACH;AACF,SAAO;AACT;AACA,SAAS,UAAU,OAAwB;AACzC,SAAO,OAAO,UAAU,WACpB,QACA,UAAU,OACR,SACA,OAAO,UAAU,YACf,QACE,QACA,OACD,KAAK,UAAU,KAAK,KAAK;AACpC;AACA,IAAM,UAAU,CAAC,SAAiB,IAAI,KAAK,WAAW,KAAK,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;AAGtF,IAAM,eAAe,CAAC,KAAa,OAAe,SAAS,OACzD,QAAQ,GAAG,EAAE,SAAS,OAAO,OAAO,SAAS,QAAQ,GAAG,EAAE,SAAS,OAC/D,MAAM,KAAK,KACX,QAAQ,GAAG;AAEV,SAAS,iBACd,gBACA,SAC4D;AAC5D,QAAM,OAAO,sBAAsB,cAAc;AACjD,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,CAAC,GAAG,YAAY,EAAE;AAC9C,QAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,MAAI,SAAS,OAAO;AAClB,UAAM,QAAQ,iBAAiB,QAAQ,KAAK;AAC5C,UAAM,WAAW,iBAAiB,MAAM,EAAE,GAAG,SAAS,OAAO,OAAU,CAAC;AACxE,UAAM,SAAS;AAAA,MACb,GAAG,MAAM,OACN;AAAA,QACC,CAAC,UACC,MAAM,SAAS,oBAAoB,MAAM,SAAS,eAAe,MAAM,YAAY;AAAA,MACvF,EACC,IAAI,CAAC,WAAW;AAAA,QACf,GAAG;AAAA,QACH,OAAO,MAAM,SAAS,cAAc,YAAY,MAAM;AAAA,QACtD,MAAM,UAAU,MAAM,IAAI;AAAA,QAC1B,GAAI,MAAM,SAAS,iBACf;AAAA,UACE,SAAS,QACN,MAAO,YAAY,IAAI,CAAC,eAAe,WAAW,IAAI,EACtD,KAAK,IAAI,EACT,MAAM,GAAG,GAAG;AAAA,QACjB,IACA,CAAC;AAAA,MACP,EAAE;AAAA,MACJ,GAAG,SAAS,OAAO;AAAA,QACjB,CAAC,UACC,CAAC;AAAA,UACC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,SAAS,MAAM,IAAI;AAAA,MACzB;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ,OAAO,MAAM,GAAG,EAAE;AAAA,MAC1B,YAAY,SAAS,aAAa,KAAK,IAAI,GAAG,OAAO,SAAS,EAAE;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,KAAK,IAAI,GAAG,QAAQ,SAAS,EAAE;AAAA,IAC3C,QAAQ,QAAQ,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,UAAU;AACxD,YAAM,SAAS,qBAAqB,KAAK,SAAS,eAAe;AACjE,YAAM,OAAO,SAAS,sBAAsB;AAC5C,YAAM,QAAQ,CAAC,UAAU,MAAM,QAAQ,KAAK,IAAI,MAAM,SAAS;AAC/D,YAAM,cACJ,CAAC,UACD,MAAM,QAAQ,KAAK,KACnB,MAAM,SAAS,KACf,MAAM,UAAU,KAChB,MAAM;AAAA,QACJ,CAAC,UACC,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU;AAAA,MAC/E,IACI,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,IAC9B;AACN,YAAMA,QACJ,gBAAgB,SACZ,cACA,UAAU,SACR,GAAG,MAAM,eAAe,OAAO,CAAC,QAAQ,UAAU,IAAI,KAAK,GAAG,KAC9D,QAAQ,OAAO,SAAS,WACtB,GAAG,OAAO,KAAK,IAAI,EAAE,MAAM,SAAS,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,KAAK,GAAG,KAC7E,UAAU,IAAI;AACxB,aAAO;AAAA,QACL,MAAM,aAAa,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA,WACJ,SAAS,eAAe,OAAO,OAAO,QAAQ,aAAa,GAAG,IAC3D,QAAQ,YAAY,GAAG,IACvB,WAAc,qBAAqB,GAAG;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,SAAS,MAAMA,OAAM,GAAG;AAAA,QACxB,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,QACvC,WACE,CAAC,WACAA,MAAK,SAAS,OACZ,gBAAgB,UAAa,OAAO,UAAU,YAAY,UAAU;AAAA,QACzE,GAAI,SAAS,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,MACtC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAGO,SAAS,iBACd,UACA,gBACA,SAIA;AACA,QAAM,WAAW;AAAA,IACf,OACE,SAAS,SACT;AAAA,MACE;AAAA,QACE,SAAS,QAAQ,gBAAgB,EAAE,EAAE,QAAQ,wBAAwB,EAAE;AAAA,MACzE;AAAA,MACA;AAAA,IACF;AAAA,IACF,cAAc;AAAA,IACd,SAAS,CAAC;AAAA,EACZ;AACA,MAAI,SAAS,SAAS,QAAS,QAAO;AACtC,QAAM,OAAO,sBAAsB,cAAc;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,SAAS,SAAS,SAAS;AAC1C,QAAM,gBAAgB,SAAU,YAAuB;AACvD,QAAM,MACJ,UAAU,OAAO,KAAK,aAAa,WAC/B,CAAC,KAAK,QAAQ,IACd,MAAM,QAAQ,KAAK,UAAU,IAC3B,KAAK,aACL,OAAO,KAAK,cAAc,WACxB,CAAC,KAAK,SAAS,IACf;AACV,QAAM,iBAAiB,KAAK,MAAM,CAAC,OAAO,OAAO,OAAO,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,OAAO;AACxF,QAAM,OACJ,mBAAmB,SACf,SACE,kBACA,aACF,GAAG,eAAe,eAAe,OAAO,CAAC,IAAI,SAAS,iBAAiB,SAAS,GAAG,mBAAmB,IAAI,KAAK,GAAG;AACxH,QAAM,YAAY,SAAS,WAAW,QAAQ,IAAI,KAAK,WAAW,KAAK;AACvE,QAAM,OAAO,MAAM,QAAQ,SAAS,IAChC,UAAU,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC1D,CAAC;AACL,QAAM,eAAe,SAAS,WAAW,UAAU,IAAI,KAAK,WAAW,KAAK;AAC5E,QAAM,UAAU,MAAM,QAAQ,YAAY,IACtC,aAAa,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;AACL,QAAM,cAAc,CAAC,OAAe,WAA4B;AAC9D,UAAM,QAA0C;AAAA,MAC9C,OAAO,CAAC,iBAAiB,mBAAmB;AAAA,MAC5C,OAAO,CAAC,iBAAiB,mBAAmB;AAAA,MAC5C,QAAQ,CAAC,kBAAkB,cAAc;AAAA,MACzC,SAAS,CAAC,YAAY,aAAa;AAAA,MACnC,MAAM,CAAC,gBAAgB,kBAAkB;AAAA,MACzC,WAAW,CAAC,qBAAqB,mBAAmB;AAAA,IACtD;AACA,YACG,OAAO,OAAO,OAAO,KAAK,IAAI,MAAM,KAAK,IAAI,SAAS,IAAI,CAAC,IAAI,WAChE,GAAG,SAAS,QAAQ,QAAQ,UAAU,MAAM,OAAO,GAAG,CAAC;AAAA,EAE3D;AACA,QAAM,UAAU;AAAA,IACd,GAAG,KAAK,IAAI,CAAC,OAAO,YAAY,IAAI,IAAI,CAAC;AAAA,IACzC,GAAG,QAAQ,IAAI,CAAC,OAAO,YAAY,IAAI,KAAK,CAAC;AAAA,EAC/C;AACA,MACE;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,QAAQ,GACnB;AACA,UAAM,QAAQ,KAAK,SAAS,OAAO;AACnC,WAAO;AAAA,MACL,OAAO,QAAQ,QAAQ,IAAI,cAAc,UAAU,IAAI;AAAA,MACvD,cAAc,QAAQ,kBAAkB;AAAA,MACxC;AAAA,MACA,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,cAAc;AAAA,MACxE,GAAI,QACA,EAAE,aAAa,+DAA+D,IAC9E,SACE,EAAE,aAAa,gDAAgD,IAC/D,CAAC;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,mBAAmB,gBAAgB,gBAAgB,EAAE,SAAS,QAAQ;AAC1F,WAAO;AAAA,MACL,OAAO,SAAS,WAAW,QAAQ,IAAI,QAAQ,IAAI,cAAc,UAAU,IAAI;AAAA,MAC/E,cAAc,SAAS,WAAW,QAAQ,IAAI,kBAAkB;AAAA,MAChE;AAAA,MACA,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,cAAc;AAAA,IAC1E;AACF,QAAM,QAA0C;AAAA,IAC9C,cAAc,CAAC,cAAc,YAAY;AAAA,IACzC,YAAY,CAAC,cAAc,YAAY;AAAA,IACvC,cAAc,CAAC,sBAAsB,cAAc;AAAA,IACnD,cAAc,CAAC,sBAAsB,cAAc;AAAA,IACnD,cAAc,CAAC,sBAAsB,cAAc;AAAA,IACnD,cAAc,CAAC,gBAAgB,cAAc;AAAA,IAC7C,cAAc,CAAC,gBAAgB,cAAc;AAAA,IAC7C,cAAc,CAAC,gBAAgB,cAAc;AAAA,EAC/C;AACA,QAAM,SAAS,OAAO,OAAO,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAClE,SAAO,SAAS,EAAE,OAAO,OAAO,CAAC,GAAG,cAAc,OAAO,CAAC,GAAG,QAAQ,IAAI;AAC3E;AAGO,SAAS,kBACd,gBACA,SACA,MACA,QACA,QAAQ,IACwD;AAChE,MACE,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,KACT,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ;AAER,UAAM,IAAI,MAAM,qBAAqB;AACvC,QAAM,OAAO,sBAAsB,cAAc;AACjD,MAAI,QAAiB,SAAS,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAC3E,MAAI,SAAS,IAAI;AACf,QAAI,CAAC,KAAK,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,sBAAsB;AACjE,eAAW,WAAW,KAAK,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AAC9C,UAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,YAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,gBAAM,IAAI,MAAM,wBAAwB;AAC1C,cAAM,WAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,QAAQ,MAAM,CAAC,CAAC,CAAC;AAC/D,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,wBAAwB;AACvD,gBAAQ;AAAA,UACN,WAAW,SAAS,CAAC;AAAA,UACrB,OAAO,qBAAqB,SAAS,CAAC,GAAG,SAAS,eAAe,IAC7D,sBACA,SAAS,CAAC;AAAA,QAChB;AACA;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,WAAW,MAAM,GAAG,EAAE,WAAW,MAAM,GAAG;AAC9D,UAAI,qBAAqB,KAAK,SAAS,eAAe,GAAG;AACvD,gBAAQ;AACR;AAAA,MACF;AACA,UAAI,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO,OAAO,GAAG;AAClE,cAAM,IAAI,MAAM,wBAAwB;AAC1C,cAAS,MAAkC,GAAG;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,UAAU,CACd,OACA,KACA,cACqD;AACrD,UAAM,SAAS,qBAAqB,KAAK,SAAS,eAAe;AACjE,QAAI,CAAC,UAAU,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC1D,YAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,SAAS,OAAO,KAAK,KAAK,EAAE;AACvE,aAAO;AAAA,QACL,OAAO,GAAG,MAAM,eAAe,OAAO,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAK,UAAU,IAAI,SAAS,UAAW,UAAU,IAAI,UAAU,QAAQ;AAAA,QACrI,MAAM;AAAA,QACN,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAMA,QAAO,UAAU,gBAAgB,OAAO,KAAK,SAAS,eAAe,CAAC;AAC5E,WAAO;AAAA,MACL,OAAO,MAAMA,OAAM,GAAI;AAAA,MACvB,GAAI,SAAS,CAAC,IAAI,EAAE,MAAM,UAAU;AAAA,MACpC,WAAW,CAAC,UAAUA,MAAK,SAAS;AAAA,IACtC;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAQ,MAAM;AACd,YAAQ,MAAM,MAAM,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC,OAAO,WAAW;AAAA,MACjE,OAAO,GAAG,SAAS,QAAQ,CAAC;AAAA,MAC5B,GAAG,QAAQ,OAAO,IAAI,GAAG,IAAI,IAAI,SAAS,KAAK,EAAE;AAAA,IACnD,EAAE;AAAA,EACJ,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,UAAM,UAAU,OAAO,QAAQ,KAAK;AACpC,YAAQ,QAAQ;AAChB,YAAQ,QAAQ,MAAM,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,WAAW;AAAA,MAC1E,OAAO;AAAA,SACJ,SAAS,eAAe,OAAO,OAAO,QAAQ,aAAa,GAAG,IAC3D,QAAQ,YAAY,GAAG,IACvB,WAAc,qBAAqB,GAAG;AAAA,QAC1C;AAAA,MACF;AAAA,MACA,GAAG,QAAQ,OAAO,KAAK,GAAG,IAAI,GAAG,aAAa,KAAK,SAAS,OAAO,IAAI,CAAC,EAAE;AAAA,IAC5E,EAAE;AAAA,EACJ,OAAO;AACL,UAAMA,QAAO,UAAU,KAAK;AAC5B,YAAQ,KAAK,IAAI,GAAG,KAAK,KAAKA,MAAK,SAAS,GAAI,CAAC;AACjD,YAAQ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,OAAO,QAAQ,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,WAAW;AAAA,MAC1F,OAAO,QAAQ,SAAS,QAAQ,CAAC;AAAA,MACjC,OAAOA,MAAK,OAAO,SAAS,SAAS,MAAO,SAAS,QAAQ,KAAK,GAAI;AAAA,IACxE,EAAE;AAAA,EACJ;AACA,SAAO,EAAE,MAAM,OAAO,OAAO,YAAY,SAAS,QAAQ,QAAQ,SAAS,QAAQ,KAAK;AAC1F;;;AC/XO,SAAS,oBAAoB,OAAiD;AACnF,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,UAAU,OAAO,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,SAAU,QAAO;AACxF,QAAI,OAAO;AACX,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,2BAA2B,QAIzB;AAChB,MAAI,OAAO,cAAc,WAAW,CAAC,OAAO,SAAU,QAAO;AAC7D,MACE,OAAO,aACP,CAAC,CAAC,QAAQ,mBAAmB,iBAAiB,EAAE,SAAS,OAAO,SAAS;AAEzE,WAAO,4BAA4B,OAAO;AAC5C,MAAI,OAAO,yBAAyB,OAAO,SAAS,SAAS,GAAG;AAC9D,WAAO;AACT,QAAMC,YAAW,oBAAoB,OAAO,QAAQ;AACpD,MAAI,CAACA,WAAU,WAAW,UAAU,EAAG,QAAO;AAC9C,SAAO;AACT;;;AC1BO,SAAS,yBAAyB,OAAiD;AACxF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,OAAO;AACb,MACE,OAAO,KAAK,IAAI,EAAE;AAAA,IAChB,CAAC,QAAQ,CAAC,CAAC,YAAY,SAAS,gBAAgB,aAAa,gBAAgB,EAAE,SAAS,GAAG;AAAA,EAC7F;AAEA,WAAO;AACT,QAAMC,QAAO,CAAC,GAAY,QACxB,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,EAAE,UAAU;AACvD,MAAI,CAACA,MAAK,KAAK,UAAU,GAAG,KAAK,yBAAyB,KAAK,KAAK,QAAQ,EAAG,QAAO;AACtF,MAAI,KAAK,UAAU,UAAa,CAACA,MAAK,KAAK,OAAO,GAAG,EAAG,QAAO;AAC/D,MAAI,KAAK,iBAAiB,UAAa,CAACA,MAAK,KAAK,cAAc,IAAI,EAAG,QAAO;AAC9E,MAAI,KAAK,cAAc,UAAa,CAACA,MAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,MAAI,KAAK,mBAAmB,UAAa,CAACA,MAAK,KAAK,gBAAgB,GAAG,EAAG,QAAO;AACjF,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAgB,IAAI,CAAC;AAAA,IAClE,GAAI,KAAK,iBAAiB,SAAY,EAAE,cAAc,KAAK,aAAuB,IAAI,CAAC;AAAA,IACvF,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAoB,IAAI,CAAC;AAAA,IAC9E,GAAI,KAAK,mBAAmB,SAAY,EAAE,gBAAgB,KAAK,eAAyB,IAAI,CAAC;AAAA,EAC/F;AACF;;;ACZA,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB,oBAAI,IAAI,CAAC,UAAU,WAAW,WAAW,MAAM,OAAO,CAAC;AAG7E,SAAS,mBAAmB,QAAsC;AACvE,QAAM,aAAa,eAAe,QAAQ,GAAG,oBAAI,IAAY,CAAC;AAC9D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,WAAW;AAAA,IAClB,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,EACtB;AACF;AAIA,SAAS,eAAe,OAAgB,OAAe,WAAyC;AAC9F,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO,EAAE,OAAO,MAAM,IAAI,SAAS,MAAM;AAAA,EAC3C;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,cAAc,OAAO,OAAO,SAAS;AAAA,EAC9C;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,OAAO,MAAM,OAAO,KAAK,GAAG,SAAS,MAAM;AAAA,EACtD;AACA,MAAI,SAAS,wBAAwB,UAAU,IAAI,KAAK,GAAG;AACzD,WAAO,EAAE,OAAO,MAAM,cAAc,KAAK,GAAG,SAAS,MAAM;AAAA,EAC7D;AAEA,YAAU,IAAI,KAAK;AACnB,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,EAAE,OAAO,MAAM,cAAc,KAAK,GAAG,SAAS,MAAM;AAAA,IAC7D;AAEA,UAAMC,UAAS;AACf,UAAM,gBAAgBA,QAAO,YAAY;AAEzC,QAAIA,QAAO,SAAS,UAAU,OAAOA,QAAO,SAAS,UAAU;AAC7D,YAAM,aAAa,cAAcA,QAAO,MAAM,QAAQ,GAAG,SAAS;AAClE,aAAO;AAAA,QACL,OAAO,WAAW;AAAA,QAClB,MAAMA,QAAO;AAAA,QACb,SAAS,iBAAiB,WAAW;AAAA,MACvC;AAAA,IACF;AAEA,QAAI,uBAAuBA,SAAQ;AACjC,YAAM,aAAa,eAAeA,QAAO,mBAAmB,QAAQ,GAAG,SAAS;AAChF,aAAO;AAAA,QACL,OAAO,WAAW;AAAA,QAClB,MAAM,aAAaA,QAAO,OAAO,KAAK,WAAW;AAAA,QACjD,SAAS,iBAAiB,WAAW;AAAA,MACvC;AAAA,IACF;AAEA,QAAI,aAAaA,QAAO,OAAO,GAAG;AAChC,YAAMC,QAAO,aAAaD,QAAO,OAAO;AACxC,UAAIC,UAAS,MAAM;AACjB,cAAM,aAAa,cAAcA,OAAM,QAAQ,GAAG,SAAS;AAC3D,eAAO;AAAA,UACL,OAAO,WAAW;AAAA,UAClB,MAAAA;AAAA,UACA,SAAS,iBAAiB,WAAW;AAAA,QACvC;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,MAAM,cAAc,KAAK;AAAA,QACzB,SAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,iBAAiBD,OAAM,GAAG;AAC5B,YAAM,aAAa,eAAeA,QAAO,QAAQ,QAAQ,GAAG,SAAS;AACrE,aAAO;AAAA,QACL,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,iBAAiB,WAAW;AAAA,MACvC;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM,cAAc,KAAK;AAAA,MACzB,SAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,cAAU,OAAO,KAAK;AAAA,EACxB;AACF;AAEA,SAAS,cAAcC,OAAc,OAAe,WAAyC;AAC3F,MAAI;AACF,UAAM,SAAkB,KAAK,MAAMA,KAAI;AACvC,UAAM,aAAa,eAAe,QAAQ,QAAQ,GAAG,SAAS;AAC9D,WAAO;AAAA,MACL,OAAO,WAAW;AAAA,MAClB,MAAAA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAOA,OAAM,MAAAA,OAAM,SAAS,MAAM;AAAA,EAC7C;AACF;AAEA,SAAS,aAAa,OAA6D;AACjF,SACE,MAAM,QAAQ,KAAK,KACnB,MAAM;AAAA,IACJ,CAAC,SACC,SAAS,QACT,OAAO,SAAS,YAChB,OAAQ,KAA4B,SAAS;AAAA,EACjD;AAEJ;AAEA,SAAS,aAAa,OAA+B;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QACE,SAAS,QACT,OAAO,SAAS,YACf,KAA4B,SAAS,UACtC,OAAQ,KAA4B,SAAS,UAC7C;AACA,aAAQ,KAA0B;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiBD,SAA0C;AAClE,SAAO,YAAYA,WAAU,OAAO,KAAKA,OAAM,EAAE,MAAM,CAAC,QAAQ,qBAAqB,IAAI,GAAG,CAAC;AAC/F;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,WAAO,KAAK,UAAU,KAAK,KAAK;AAAA,EAClC,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AACF;;;ACtIO,SAAS,iBAAiB,KAAmD;AAClF,MAAI,CAAC,IAAI,KAAK;AACZ,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,IAAI,IAAI,IAAI,IAAI,GAAG;AAEzB,MAAI,EAAE,aAAa,UAAU;AAC3B,MAAE,WAAW;AAAA,EACf,WAAW,EAAE,aAAa,SAAS;AACjC,MAAE,WAAW;AAAA,EACf;AAIA,MAAI,uBAAuB,KAAK,EAAE,QAAQ,GAAG;AAC3C,MAAE,WAAW,EAAE,SAAS,QAAQ,wBAAwB,aAAa;AACrE,MAAE,SAAS;AACX,MAAE,OAAO;AAAA,EACX;AACA,SAAO,EAAE,SAAS;AACpB;AAqEO,SAAS,iBACd,SACA,IACwB;AACxB,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,YAAY,cAAc,aAAa;AAAA,IAChD,KAAK;AAEH,aAAO,YAAY,UAAU,UAAU;AAAA,IACzC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAgBO,SAAS,iBACd,KACA,SACA,YACU;AACV,MAAI,QAAQ,aAAa,YAAY;AACnC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,KAAK,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,UAAU;AACxF;;;AC1IO,SAAS,kBAAkB,KAA8C;AAC9E,MAAI,CAAC,IAAI,KAAK;AACZ,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,IAAI,IAAI,IAAI,IAAI,GAAG;AAEzB,MAAI,EAAE,aAAa,UAAU;AAC3B,MAAE,WAAW;AAAA,EACf,WAAW,EAAE,aAAa,SAAS;AACjC,MAAE,WAAW;AAAA,EACf;AACA,SAAO,EAAE,SAAS;AACpB;AAQO,IAAM,mBAAmB;AAGzB,IAAM,oBAAoB;AAAA;AAAA,EAE/B,OAAO;AAAA;AAAA,EAEP,QAAQ;AAAA;AAAA,EAER,OAAO;AAAA;AAAA,EAEP,QAAQ;AACV;AAGO,IAAM,oBAAoB;AAAA;AAAA,EAE/B,QAAQ;AAAA;AAAA,EAER,kBAAkB;AAAA;AAAA,EAElB,iBAAiB;AACnB;AAUO,SAAS,cAAc,MAAoD;AAChF,QAAM,QAAgE,EAAE,WAAW,GAAG;AACtF,MAAI,MAAM,WAAW,KAAK,UAAU,EAAG,OAAM,UAAU,KAAK;AAC5D,MAAI,MAAM,QAAQ,KAAK,OAAO,EAAG,OAAM,OAAO,KAAK;AACnD,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,eAAe,MAAsB;AACnD,SAAO,kBAAkB,QAAQ;AACnC;AAGO,SAAS,gBAAgB,SAAiB,MAAsB;AACrE,SAAO,kBAAkB,SAAS,KAAK,UAAU,EAAE,SAAS,KAAK,CAAC;AACpE;;;AC1FO,IAAM,iDAAiD;AAgBvD,SAAS,2CAA2C,OAAuB;AAChF,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;;;AClBO,IAAM,mCAAmC;AACzC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AAuGxC,SAAS,iCAAiC,OAAuB;AACtE,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;;;ACnFA,SAAS,cAAc,aAAqB,QAAwB;AAClE,SAAO,kBAAkB,WAAW,kBAAkB,MAAM;AAC9D;AAEO,SAAS,gCACd,QACA,aACA,UAAiD,CAAC,GACT;AACzC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,QAAQ,UAAW,QAAO,IAAI,aAAa,QAAQ,SAAS;AAChE,MAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,QAAQ,MAAM;AACvD,MAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAM,QAAQ,OAAO,SAAS;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,GAAG,cAAc,aAAa,kBAAkB,CAAC,GAAG,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,EAC9E;AACF;AAEO,SAAS,mCACd,QACA,aACA,UAAoD,CAAC,GACT;AAC5C,QAAM,QACJ,QAAQ,UAAU,SAAY,KAAK,UAAU,mBAAmB,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxF,SAAO,OAAO,YAAY,OAAO,GAAG,cAAc,aAAa,qBAAqB,CAAC,GAAG,KAAK,EAAE;AACjG;;;AC3BO,SAAS,qCAAqC,OAAuB;AAC1E,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;","names":["text","endpoint","text","record","text"]}

package/dist/site-bridge-host.js

@@ -12,9 +12,9 @@ import {
   sanitizeOpenGeniSiteToolCallRequest,
   sanitizeOpenGeniSiteToolInvokeRequest,
   serveSiteHttp
-} from "./chunk-JXXCTW5W.js";
+} from "./chunk-PBVUAXSU.js";
 import "./chunk-P7UWKORG.js";
-import "./chunk-NEM5N6C6.js";
+import "./chunk-JKG75TTU.js";
 import "./chunk-VPVMLM7Q.js";
 import "./chunk-4AHR4KGA.js";
 import "./chunk-KADZ5PGG.js";