@rubytech/create-maxy-code 0.1.311 → 0.1.313

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -55,7 +55,7 @@ either is a regression.
 
 **`/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. A third section, **Your specialists**, shows the account's installed roster — every `*.md` under `data/accounts/<accountId>/specialists/agents/`, core and `--`-prefixed premium files alike — shown by frontmatter `name` + `summary` (fallback `description`), empty dir → "No specialists installed". The roster read (`app/lib/claude-agent/specialist-roster.ts`) is isolated from the graph fallback: malformed files are skipped (`op=specialist-skipped file=<name> reason=<…>`), a whole-roster failure degrades to `specialists: []` inside the `ok: true` payload (`op=specialists-read-failed`). Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> specialists=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
 
-**`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble with only the message text (no label, no per-turn time); all agent output renders as plain prose (the reply-document filename line stays, as prose); a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx` unmodified, `app/chat/__tests__/transcript-render.test.tsx` new).
+**`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx` unmodified, `app/chat/__tests__/transcript-render.test.tsx` new).
 
 **maxy title for public sessions.** A `role=public` webchat spawn never produces a useful Claude Code `ai-title` (an anonymous one-line visitor turn), so every public row would otherwise read identically. The webchat route (`chat.ts`) composes a deterministic title — `Web · <senderId[:8]>[ · <personId>] · <UTC YYYY-MM-DD HH:mm>` (personId present only for gated visitors) — and threads it through the native webchat gateway's public spawn (`handleInbound` → `buildPublicWebchatSpawnRequest` → `managerSpawn`) to the manager `POST /public-spawn` body as `name`. `/spawn` validates it with `validateUserTitle` and, for `role=public` only, writes it into `UserTitleStore` so it occupies the operator-rename tier and wins over `ai-title`. Admin (`/rc-spawn`) and WhatsApp titling are unchanged. Observability: every public spawn logs `[spawn] role=public … title="…"` (or `title=missing`); the manager's row builder emits `[public-title] sessionId=… unexpected titleSource=<ai|null>` on the next list read for any public row that did not resolve from the user tier.
 
@@ -78,7 +78,7 @@ either is a regression.
 | `/sidebar-artefact-content` | Reads a single artefact's bytes for the artefact pane. |
 | `/sidebar-artefact-save` | Persists an artefact edit. |
 | `/attachment` | Per-attachment binary fetch (images, PDFs, etc.). |
-| `/files` | File browser CRUD (list, download, upload, delete). Listings put directories first, then files newest-first by `mtime` (name tie-break) so a just-changed file leads the panel. |
+| `/files` | File browser CRUD (list, download, upload, delete). Listings put directories first, then files newest-first by `mtime` (name tie-break) so a just-changed file leads the panel. Upload is a raw-body stream (file bytes are the request body; `session_key`/`path`/`filename` in the query) written to disk without buffering — ceiling 2 GB (`MAX_DATA_UPLOAD_BYTES`), over-ceiling bodies abort mid-stream with `413`; the client shows a determinate progress bar. Distinct from the 50 MB in-memory chat-attachment cap. |
 
 **Artefact download resolution.** Clicking a sidebar Artefacts row
 streams the `KnowledgeDocument`'s real backing file, which can live in one of
@@ -106,6 +106,24 @@ that folder instead of snapping back to the data root; the hash never reaches
 the server and `/data` has no client router, so the channel is isolated.
 `path=` is cleared at the root for a clean URL.
 
+**`/data` upload — button and drag-drop.** Besides the Upload button (one OS-picked
+file, stored under a timestamped name), files and whole folders can be dragged
+onto the file-browser body to upload into the open folder. A dropped folder's
+subtree is recreated under the open folder and every contained file uploaded,
+preserving source names and relative paths (a same-named file in an existing
+folder is overwritten; empty source subfolders are skipped). The drop region
+shows an active outline while a drag is over it and is inert wherever the open
+folder is not writable (outside the operator's own `accounts/<id>/…` subtree),
+rejecting the drop with the same "Open a folder inside your account to upload"
+guidance as the button. Each drop reports an uploaded/skipped summary; a file
+that fails the 50 MB limit, the MIME allowlist, or its HTTP write is skipped
+individually without aborting the rest, and every uploaded file is indexed for
+search exactly as the button path is. The server `/files/upload` endpoint takes
+an optional `relpath` form field (the file's path relative to the drop root); it
+recreates that path's directories under the open folder, scope-checked level by
+level, and writes the file under its original basename. A flat upload (no
+`relpath`) is unchanged.
+
 **`/data` operator surface.** `/data` mounts the operator
 `HeaderMenu` (logo-left / name-centre / burger-right; flyout = Chat / Data /
 Log out) above the toolbar — the burger's Chat item returns to `/`, replacing
@@ -284,7 +302,7 @@ authoritative. This section names the surfaces and what backs each.
 | `+ New session` button | Opens `NewSessionModal`, which POSTs `{channel, permissionMode, model, initialMessage}` to `/api/admin/claude-sessions`. | `claude-sessions.ts` |
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
-| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
+| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). Below a 400 px list width each row's action icons collapse to a single `MoreHorizontal` ellipsis trigger; its popover menu lists the same actions as the inline icons but labels them with concise verbs (`Resume in claude.ai/code`, `Open in webchat`, `Stop`, `Archive` / `Unarchive`, `Rename`, `Delete`) rather than the inline icon buttons' verbose per-session aria-labels — the inline buttons keep those verbose labels because an icon-only control needs the full descriptive accessible name. | `/claude-sessions/events`, `/claude-sessions` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/plugins/docs/references/quickbooks.md

@@ -0,0 +1,29 @@
+# QuickBooks Online
+
+Connect QuickBooks Online so the agent can read your books and create records — invoices, customers, bills, payments, and reports — over Intuit's REST API.
+
+QuickBooks Online is the cloud product. Your books live in Intuit's cloud, so every request proves two things: that the connecting app is yours, and that someone authorized it to touch a specific company. {{productName}} ships to your own machine and never runs a shared backend, so it cannot hold one master QuickBooks identity for everyone. Instead you bring your own Intuit app, and its keys are stored only on your install.
+
+## What you do once
+
+**1. Register an Intuit app.** Go to [developer.intuit.com](https://developer.intuit.com), create an app, and turn on the Accounting scope. Copy the app's **client ID** and **client secret**. In the app's OAuth settings, add a **redirect URI**: your public agent address followed by `/api/quickbooks/callback`. Intuit does not allow `localhost` for live use, which is why the address is your public one. Start with the free **sandbox** keys (Intuit gives you up to five practice companies) before moving to real books.
+
+**2. Hand the keys to the agent.** Tell the agent your client ID and secret, and whether they are sandbox or production. The agent stores them on your install only.
+
+**3. Authorize each company.** Ask the agent to start a connection. It gives you a link; you open it, sign in to Intuit, and approve one company. That is the only manual step per company. An accountant with several companies under one app just repeats this for each.
+
+## What the agent does after that
+
+Everything else is automatic. The agent keeps the connection alive on its own, refreshing access behind the scenes, and can:
+
+- **Read** anything — "show me unpaid invoices since January", "list my customers", "what bills are due this week".
+- **Pull reports** — profit and loss, balance sheet, aged receivables, for any date range.
+- **Create and update records** — raise an invoice, add a customer, enter a bill, record a payment.
+
+## Keeping it healthy
+
+A QuickBooks connection goes stale if it sits unused for about 100 days, or if you revoke access from your Intuit account. Ask the agent to run a connection audit now and then; if a company shows as not alive, just re-authorize it with a fresh link. Reading has a generous free monthly allowance and writing is free, so the agent favours precise lookups over pulling everything.
+
+## Moving to real books
+
+Switching your Intuit app from sandbox to production requires passing Intuit's own production security review. That is between you and Intuit; it is not something the agent does for you.

package/payload/platform/plugins/quickbooks/.claude-plugin/plugin.json

@@ -0,0 +1,21 @@
+{
+  "name": "quickbooks",
+  "description": "QuickBooks Online connector — operator-owned Intuit app, OAuth consent relay, then agent-driven read/write over the QBO REST API.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Rubytech LLC"
+  },
+  "mcpServers": {
+    "quickbooks": {
+      "type": "stdio",
+      "command": "node",
+      "args": [
+        "${CLAUDE_PLUGIN_ROOT}/lib/mcp-spawn-tee/index.js",
+        "${CLAUDE_PLUGIN_ROOT}/mcp/dist/index.js"
+      ],
+      "env": {
+        "MCP_SPAWN_TEE_NAME": "quickbooks"
+      }
+    }
+  }
+}

package/payload/platform/plugins/quickbooks/PLUGIN.md

@@ -0,0 +1,91 @@
+---
+name: quickbooks
+description: "QuickBooks Online connector — operator-owned Intuit app, OAuth consent relay, then agent-driven read/write over the QBO REST API."
+tools:
+  - name: quickbooks-credentials-set
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: quickbooks-authorize-url
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: quickbooks-connections
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: quickbooks-token-audit
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: quickbooks-disconnect
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: quickbooks-query
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-report
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-invoice-create
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-invoice-update
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-customer-create
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-customer-update
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-bill-create
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-payment-create
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-entity-create
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: quickbooks-entity-update
+    publicAllowlist: false
+    adminAllowlist: false
+skills:
+  - skills/quickbooks/SKILL.md
+metadata: {"platform":{"optional":true,"pluginKey":"quickbooks"}}
+mcp:
+  command: node
+  args:
+    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
+    - ${PLATFORM_ROOT}/plugins/quickbooks/mcp/dist/index.js
+  env:
+    MCP_SPAWN_TEE_NAME: quickbooks
+    LOG_DIR: ${LOG_DIR}
+    PLATFORM_ROOT: ${PLATFORM_ROOT}
+    ACCOUNT_ID: ${ACCOUNT_ID}
+    SESSION_ID: ${SESSION_ID}
+mcp-manifest: auto
+---
+
+# QuickBooks Online
+
+Connects to QuickBooks **Online** — the cloud accounting product (REST/JSON, OAuth 2.0). There is no local company file; the books live in Intuit's cloud, so every call proves app identity plus per-company consent.
+
+Maxy ships installs and walks away, so Maxy is **never** the OAuth app owner. The operator registers their **own** Intuit app; its client ID/secret is a per-brand secret like the Cloudflare token. Two steps are irreducibly human and are relayed, never auto-clicked: registering the app at developer.intuit.com, and clicking the consent link for each company. Everything after — code→token exchange, access-token refresh, every REST call — is agent-driven.
+
+## Capabilities
+
+- **quickbooks-credentials-set** — store the operator's Intuit app client ID + secret (sandbox or production).
+- **quickbooks-authorize-url** — mint a consent URL for a human to click; one company per click.
+- **quickbooks-connections** — list connected companies and the age of each refresh token.
+- **quickbooks-token-audit** — probe each refresh token; surfaces a dead connection before a customer-facing call hits it.
+- **quickbooks-disconnect** — drop one company's stored token.
+- **quickbooks-query** — read any entity via the QBO query language (invoices, customers, bills, …).
+- **quickbooks-report** — fetch a named report (ProfitAndLoss, BalanceSheet, …).
+- **quickbooks-invoice-create / -update**, **quickbooks-customer-create / -update**, **quickbooks-bill-create**, **quickbooks-payment-create** — entity-specific writes.
+- **quickbooks-entity-create / -update** — generic write for any other entity (Vendor, Item, Estimate, …).
+
+## Setup
+
+Connecting QuickBooks runs through the `quickbooks` skill (`skills/quickbooks/SKILL.md`): register the Intuit app, paste the credentials, then relay the consent link. The skill is the operator-facing procedure; load it and follow its instructions.
+
+## Credentials and isolation
+
+Credentials and per-company refresh tokens live only in this account's secrets directory (`secrets/quickbooks.json`, mode `0600`), inside the brand-isolated install. No Intuit app identity is shared across brands. Token refresh is automatic until a refresh token expires (~100 days of inactivity) or is revoked.

package/payload/platform/plugins/quickbooks/lib/mcp-spawn-tee/index.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * MCP spawn-tee — parent-side stderr capture + lifecycle observability.
+ *
+ * Claude Code spawns each MCP server itself; the platform never holds a
+ * ChildProcess handle. This wrapper sits between Claude Code and the real
+ * MCP server: Claude Code runs `node <this> <real-entry>`, and the wrapper
+ * spawns the real entry with `stdio:['inherit','inherit','pipe']` so stdin
+ * and stdout (the JSON-RPC channel) pass through byte-identical. Only stderr
+ * is intercepted, and only for logging.
+ *
+ * Because the wrapper IS the helper's parent, it observes the helper's true
+ * exit code, signal, and lifetime for every death mode — including a SIGKILL
+ * or a transport-layer crash that an in-process handler would miss.
+ *
+ *   Claude Code CLI → wrapper (this file) → child = node <real-entry>
+ *        child stdin/stdout : inherited (Claude Code pipe, untouched)
+ *        child stderr       : piped → per-date log + per-session log + passthrough
+ *
+ * Destinations (Task 706):
+ *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
+ *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
+ *     lines; wrapper-only, so it never mixes the enumeration copy with the
+ *     live copy. Authoritative sink. Absent when SESSION_ID is unset
+ *     (enumeration spawn) — then the per-date file is the fallback.
+ *   - `server.log` via the loopback log-ingest route — best-effort mirror of
+ *     the [mcp-helper] lifecycle lines. A dropped POST loses nothing because
+ *     the per-session file already holds the line (written synchronously).
+ *
+ * Lifecycle lines, correlation key `session=<id8> server=<name>`:
+ *   [mcp-helper] op=spawn ... pid= entry=
+ *   [mcp-helper] op=boot  ... head=<first stderr bytes>
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=   (always)
+ *
+ * The wrapper never writes to fd 1 (stdout) — that is the JSON-RPC channel.
+ * SIGTERM/SIGINT are forwarded to the child so a Claude Code shutdown does
+ * not orphan it; the child exit code/signal is propagated verbatim.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const SERVER_NAME = process.env.MCP_SPAWN_TEE_NAME ?? "unknown";
+const LOG_DIR = process.env.LOG_DIR;
+const SESSION_ID = process.env.SESSION_ID;
+const PLATFORM_PORT = process.env.PLATFORM_PORT;
+const ENTRY = process.argv[2];
+const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
+const spawnStamp = Date.now();
+// Per-session raw + lifecycle log (Task 706). Wrapper-only. Empty SESSION_ID
+// (enumeration spawn) → undefined, and the per-date file is the fallback.
+const perSessionPath = LOG_DIR && SESSION_ID
+    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
+    : undefined;
+const perDatePath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
+    : undefined;
+// Rolling tail of child stderr for op=exit. Capped so a chatty child cannot
+// grow the buffer without bound.
+const TAIL_CAP = 2048;
+let stderrTail = "";
+let bootEmitted = false;
+function appendSafe(path, data) {
+    if (!path || !LOG_DIR)
+        return;
+    try {
+        (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+        (0, node_fs_1.appendFileSync)(path, data);
+    }
+    catch {
+        /* unwritable destination — never mask primary output */
+    }
+}
+// Best-effort mirror of a lifecycle line to server.log via the loopback
+// log-ingest route. Fire-and-forget: the per-session file is authoritative,
+// so a dropped POST (unreachable port, process exiting) loses nothing.
+function postToServerLog(suffix, level) {
+    if (!PLATFORM_PORT)
+        return;
+    try {
+        const ctrl = new AbortController();
+        const t = setTimeout(() => ctrl.abort(), 500);
+        t.unref?.(); // never let the abort timer keep the wrapper's event loop alive
+        void fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/log-ingest`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ tag: "mcp-helper", level, line: suffix }),
+            signal: ctrl.signal,
+        }).then(() => clearTimeout(t)).catch(() => clearTimeout(t));
+    }
+    catch {
+        /* fetch threw synchronously — best-effort only */
+    }
+}
+// Emit one [mcp-helper] lifecycle line: authoritative per-session file (sync,
+// survives process.exit), the wrapper's own stderr (journald / Claude Code
+// visibility), and a best-effort server.log mirror. `suffix` is the line body
+// after the tag and carries no newline (the log-ingest route rejects newlines).
+function emitLifecycle(suffix, level) {
+    const line = `[mcp-helper] ${suffix}\n`;
+    appendSafe(perSessionPath, line);
+    try {
+        process.stderr.write(line);
+    }
+    catch { /* stderr closed */ }
+    postToServerLog(suffix, level);
+}
+if (!ENTRY) {
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
+    process.exit(2);
+}
+const child = (0, node_child_process_1.spawn)(process.execPath, [ENTRY], {
+    stdio: ["inherit", "inherit", "pipe"],
+    env: process.env,
+});
+emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} entry=${ENTRY}`, "info");
+child.on("error", (err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`spawn error: ${msg}`)}`, "error");
+    process.exit(127);
+});
+if (child.stderr) {
+    child.stderr.on("data", (chunk) => {
+        appendSafe(perDatePath, chunk); // per-date raw (back-compat)
+        appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+        try {
+            process.stderr.write(chunk);
+        }
+        catch { /* stderr closed */ } // passthrough
+        stderrTail = (stderrTail + chunk.toString("utf8")).slice(-TAIL_CAP);
+        if (!bootEmitted) {
+            bootEmitted = true;
+            const head = chunk.toString("utf8").split("\n")[0].slice(0, 200);
+            emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+        }
+    });
+}
+const forward = (signal) => { if (!child.killed)
+    child.kill(signal); };
+process.on("SIGTERM", () => forward("SIGTERM"));
+process.on("SIGINT", () => forward("SIGINT"));
+// Signal → number, so a signal-killed child propagates as 128+signum (the
+// shell convention). `code` is null on a signal exit, so `128 + (code ?? 0)`
+// would collapse every signal to 128 and lose the signal identity in the
+// wrapper's own exit status.
+const SIGNUM = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 };
+child.on("exit", (code, signal) => {
+    const lifetimeMs = Date.now() - spawnStamp;
+    const tail = stderrTail.slice(-200);
+    const level = signal || (code ?? 0) !== 0 ? "error" : "info";
+    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} ` +
+        `code=${code ?? "—"} signal=${signal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+    if (signal)
+        process.exit(128 + (SIGNUM[signal] ?? 0));
+    process.exit(code ?? 0);
+});
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/quickbooks/lib/mcp-spawn-tee/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/payload/platform/plugins/quickbooks/mcp/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/quickbooks/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/quickbooks/mcp/dist/index.js

@@ -0,0 +1,218 @@
+import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
+initStderrTee("quickbooks");
+import { randomBytes } from "node:crypto";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { readStore, setCredentials, removeConnection, writePending, } from "./lib/secrets.js";
+import { buildAuthorizeUrl } from "./lib/oauth.js";
+import { qboQuery, qboCreate, qboUpdate, qboReport, auditConnection } from "./lib/qbo-client.js";
+// Plugin-system boot tolerance — see Task 202. Module-init must never throw;
+// the plugin-system enumerates tools/list with no env, so per-account context
+// is resolved per call and a missing account refuses, never crashes.
+const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
+const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? null;
+process.stderr.write(`[quickbooks] boot accountId=${ACCOUNT_ID ?? "null"} platformRoot=${PLATFORM_ROOT ?? "null"}\n`);
+const CONSENT_TTL_MS = 15 * 60 * 1000;
+function refuseNoAccount(toolName) {
+    process.stderr.write(`[quickbooks] tool=${toolName} refuse reason=no-account-context\n`);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `${toolName} cannot execute: this MCP instance was launched without ACCOUNT_ID/PLATFORM_ROOT (plugin-system metadata-only mode). Per-account access requires both at spawn.`,
+            },
+        ],
+        isError: true,
+    };
+}
+function ok(data) {
+    return {
+        content: [
+            { type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) },
+        ],
+    };
+}
+function fail(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+const server = new McpServer({ name: "quickbooks", version: "0.1.0" });
+// Arbitrary QBO resource body (the caller assembles it per Intuit's entity
+// schema; the connector does not model every field).
+const resourceBody = z.record(z.unknown());
+// ---------------------------------------------------------------------------
+// Connection management
+// ---------------------------------------------------------------------------
+server.tool("quickbooks-credentials-set", "Store the operator's own Intuit app credentials (client ID + secret) for this account. Get these by registering an app at developer.intuit.com — Maxy is never the OAuth app owner. environment is 'sandbox' for an Intuit sandbox company or 'production' for real books.", {
+    clientId: z.string().describe("Intuit app client ID"),
+    clientSecret: z.string().describe("Intuit app client secret"),
+    environment: z.enum(["sandbox", "production"]).describe("Which QBO environment these credentials target"),
+}, async ({ clientId, clientSecret, environment }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-credentials-set");
+    try {
+        setCredentials(PLATFORM_ROOT, ACCOUNT_ID, { clientId, clientSecret, environment });
+        return ok(`Stored Intuit ${environment} credentials. Next: run quickbooks-authorize-url and have a human authorize each company.`);
+    }
+    catch (err) {
+        return fail(`quickbooks-credentials-set failed: ${err.message}`);
+    }
+});
+server.tool("quickbooks-authorize-url", "Generate the Intuit consent URL for a human to click. Returns a URL — hand it to a person; they sign in and authorize one company. Intuit then redirects to the callback, which stores the refresh token. redirectUri MUST exactly match the redirect URI registered in the Intuit app (the brand's public host + /api/quickbooks/callback).", {
+    redirectUri: z.string().describe("The exact redirect URI registered in the Intuit app, e.g. https://<public-host>/api/quickbooks/callback"),
+    realmHint: z.string().optional().describe("Optional human label for which company is being connected (recorded for correlation only)"),
+}, async ({ redirectUri, realmHint }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-authorize-url");
+    try {
+        const store = readStore(PLATFORM_ROOT, ACCOUNT_ID);
+        if (!store)
+            return fail("No credentials set. Run quickbooks-credentials-set first.");
+        const state = randomBytes(24).toString("base64url");
+        const now = Date.now();
+        writePending(PLATFORM_ROOT, ACCOUNT_ID, {
+            state,
+            redirectUri,
+            realmHint,
+            createdAt: now,
+            expiresAt: now + CONSENT_TTL_MS,
+        });
+        const url = buildAuthorizeUrl({ clientId: store.clientId, redirectUri, state });
+        process.stderr.write(`[quickbooks] op=authorize-url state=${state} realmHint=${realmHint ?? ""}\n`);
+        return ok(`Hand this URL to a person to authorize the company (valid 15 minutes):\n\n${url}`);
+    }
+    catch (err) {
+        return fail(`quickbooks-authorize-url failed: ${err.message}`);
+    }
+});
+server.tool("quickbooks-connections", "List the QuickBooks companies (realmIds) this account is connected to, with the age of each stored refresh token.", {}, async () => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-connections");
+    const store = readStore(PLATFORM_ROOT, ACCOUNT_ID);
+    if (!store)
+        return ok("No credentials set.");
+    const now = Date.now();
+    const connections = Object.entries(store.connections).map(([realmId, c]) => ({
+        realmId,
+        lastRefresh: c.lastRefresh,
+        ageDays: c.lastRefresh > 0 ? Math.floor((now - c.lastRefresh) / 86_400_000) : null,
+        refreshTokenExpiry: c.refreshTokenExpiry,
+    }));
+    return ok({ environment: store.environment, connections });
+});
+server.tool("quickbooks-token-audit", "Probe every connected company's refresh token and report which are still alive. Run periodically: a refresh token dies silently after ~100 days of inactivity or operator revocation. alive=false means that company needs operator re-consent before any customer-facing call.", {
+    realmId: z.string().optional().describe("Audit just this company; omit to audit all"),
+}, async ({ realmId }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-token-audit");
+    const store = readStore(PLATFORM_ROOT, ACCOUNT_ID);
+    if (!store)
+        return ok("No credentials set.");
+    const realms = realmId ? [realmId] : Object.keys(store.connections);
+    const results = [];
+    for (const r of realms) {
+        results.push({ realmId: r, ...(await auditConnection(PLATFORM_ROOT, ACCOUNT_ID, r)) });
+    }
+    return ok({ audited: results });
+});
+server.tool("quickbooks-disconnect", "Remove the stored refresh token for one company. The operator can re-authorize later with quickbooks-authorize-url.", { realmId: z.string().describe("The company realmId to disconnect") }, async ({ realmId }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-disconnect");
+    removeConnection(PLATFORM_ROOT, ACCOUNT_ID, realmId);
+    return ok(`Disconnected realmId=${realmId}.`);
+});
+// ---------------------------------------------------------------------------
+// Read
+// ---------------------------------------------------------------------------
+server.tool("quickbooks-query", "Run a QuickBooks query (the QBO SQL-like language) against a company. Covers every readable entity: e.g. SELECT * FROM Invoice WHERE TxnDate > '2026-01-01', SELECT * FROM Customer, SELECT * FROM Bill.", {
+    realmId: z.string().describe("The company realmId"),
+    query: z.string().describe("A QBO query, e.g. \"SELECT * FROM Invoice MAXRESULTS 20\""),
+}, async ({ realmId, query }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-query");
+    try {
+        return ok(await qboQuery({ platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID, realmId, query }));
+    }
+    catch (err) {
+        return fail(`quickbooks-query failed: ${err.message}`);
+    }
+});
+server.tool("quickbooks-report", "Fetch a named QuickBooks report for a company, e.g. ProfitAndLoss, BalanceSheet, CustomerBalance, AgedReceivables. Params are report-specific (start_date, end_date, etc).", {
+    realmId: z.string().describe("The company realmId"),
+    report: z.string().describe("Report name, e.g. ProfitAndLoss"),
+    params: z.record(z.string()).optional().describe("Report parameters, e.g. { start_date: '2026-01-01', end_date: '2026-03-31' }"),
+}, async ({ realmId, report, params }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-report");
+    try {
+        return ok(await qboReport({ platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID, realmId, report, params }));
+    }
+    catch (err) {
+        return fail(`quickbooks-report failed: ${err.message}`);
+    }
+});
+// ---------------------------------------------------------------------------
+// Write — entity-specific convenience tools + a generic fallback.
+// All updates require Id + SyncToken in the body (QBO's optimistic-lock token).
+// ---------------------------------------------------------------------------
+function createTool(toolName, entity, description) {
+    server.tool(toolName, description, { realmId: z.string().describe("The company realmId"), body: resourceBody.describe(`${entity} resource body`) }, async ({ realmId, body }) => {
+        if (!ACCOUNT_ID || !PLATFORM_ROOT)
+            return refuseNoAccount(toolName);
+        try {
+            return ok(await qboCreate({ platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID, realmId, entity, body }));
+        }
+        catch (err) {
+            return fail(`${toolName} failed: ${err.message}`);
+        }
+    });
+}
+function updateTool(toolName, entity, description) {
+    server.tool(toolName, description, { realmId: z.string().describe("The company realmId"), body: resourceBody.describe(`${entity} resource body — MUST include Id and SyncToken`) }, async ({ realmId, body }) => {
+        if (!ACCOUNT_ID || !PLATFORM_ROOT)
+            return refuseNoAccount(toolName);
+        try {
+            return ok(await qboUpdate({ platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID, realmId, entity, body }));
+        }
+        catch (err) {
+            return fail(`${toolName} failed: ${err.message}`);
+        }
+    });
+}
+createTool("quickbooks-invoice-create", "Invoice", "Create an invoice in a QuickBooks company.");
+updateTool("quickbooks-invoice-update", "Invoice", "Update an invoice (sparse or full) in a QuickBooks company.");
+createTool("quickbooks-customer-create", "Customer", "Create a customer in a QuickBooks company.");
+updateTool("quickbooks-customer-update", "Customer", "Update a customer in a QuickBooks company.");
+createTool("quickbooks-bill-create", "Bill", "Create a bill (vendor payable) in a QuickBooks company.");
+createTool("quickbooks-payment-create", "Payment", "Record a customer payment in a QuickBooks company.");
+server.tool("quickbooks-entity-create", "Create any QuickBooks entity not covered by a dedicated tool (Vendor, Item, Estimate, CreditMemo, etc). entity is the QBO resource name.", {
+    realmId: z.string().describe("The company realmId"),
+    entity: z.string().describe("QBO entity name, e.g. Vendor, Item, Estimate"),
+    body: resourceBody.describe("The resource body"),
+}, async ({ realmId, entity, body }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-entity-create");
+    try {
+        return ok(await qboCreate({ platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID, realmId, entity, body }));
+    }
+    catch (err) {
+        return fail(`quickbooks-entity-create failed: ${err.message}`);
+    }
+});
+server.tool("quickbooks-entity-update", "Update any QuickBooks entity not covered by a dedicated tool. body MUST include Id and SyncToken.", {
+    realmId: z.string().describe("The company realmId"),
+    entity: z.string().describe("QBO entity name, e.g. Vendor, Item, Estimate"),
+    body: resourceBody.describe("The resource body — MUST include Id and SyncToken"),
+}, async ({ realmId, entity, body }) => {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return refuseNoAccount("quickbooks-entity-update");
+    try {
+        return ok(await qboUpdate({ platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID, realmId, entity, body }));
+    }
+    catch (err) {
+        return fail(`quickbooks-entity-update failed: ${err.message}`);
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/quickbooks/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,aAAa,CAAC,YAAY,CAAC,CAAC;AAE5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEjG,6EAA6E;AAC7E,8EAA8E;AAC9E,qEAAqE;AACrE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;AACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,UAAU,IAAI,MAAM,iBAAiB,aAAa,IAAI,MAAM,IAAI,CAChG,CAAC;AAEF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,qCAAqC,CAAC,CAAC;IACzF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,GAAG,QAAQ,iKAAiK;aACnL;SACF;QACD,OAAO,EAAE,IAAa;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO;QACL,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;SACjG;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEvE,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE3C,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,CAAC,IAAI,CACT,4BAA4B,EAC5B,4QAA4Q,EAC5Q;IACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC7D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;CAC1G,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE;IAChD,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,4BAA4B,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,cAAc,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC,iBAAiB,WAAW,2FAA2F,CAAC,CAAC;IACrI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,8UAA8U,EAC9U;IACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC;IAC3I,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC;CACvI,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE;IACnC,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,YAAY,CAAC,aAAa,EAAE,UAAU,EAAE;YACtC,KAAK;YACL,WAAW;YACX,SAAS;YACT,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,cAAc;SAChC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,KAAK,cAAc,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC,6EAA6E,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,mHAAmH,EACnH,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO;QACP,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QAClF,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;KACzC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,iRAAiR,EACjR;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CACtF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACpB,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAClC,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,qHAAqH,EACrH,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,EACrE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACpB,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACnF,gBAAgB,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,EAAE,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;AAChD,CAAC,CACF,CAAC;AAEF,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,0MAA0M,EAC1M;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;CACxF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;IAC3B,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,QAAQ,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,4KAA4K,EAC5K;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;CACjI,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IACpC,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,8EAA8E;AAC9E,kEAAkE;AAClE,gFAAgF;AAChF,8EAA8E;AAE9E,SAAS,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,WAAmB;IACvE,MAAM,CAAC,IAAI,CACT,QAAQ,EACR,WAAW,EACX,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAC/G,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;YAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,QAAQ,YAAa,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,WAAmB;IACvE,MAAM,CAAC,IAAI,CACT,QAAQ,EACR,WAAW,EACX,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,MAAM,gDAAgD,CAAC,EAAE,EAC/I,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;YAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,QAAQ,YAAa,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,UAAU,CAAC,2BAA2B,EAAE,SAAS,EAAE,4CAA4C,CAAC,CAAC;AACjG,UAAU,CAAC,2BAA2B,EAAE,SAAS,EAAE,6DAA6D,CAAC,CAAC;AAClH,UAAU,CAAC,4BAA4B,EAAE,UAAU,EAAE,4CAA4C,CAAC,CAAC;AACnG,UAAU,CAAC,4BAA4B,EAAE,UAAU,EAAE,4CAA4C,CAAC,CAAC;AACnG,UAAU,CAAC,wBAAwB,EAAE,MAAM,EAAE,yDAAyD,CAAC,CAAC;AACxG,UAAU,CAAC,2BAA2B,EAAE,SAAS,EAAE,oDAAoD,CAAC,CAAC;AAEzG,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,0IAA0I,EAC1I;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC3E,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjD,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;IAClC,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,mGAAmG,EACnG;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC3E,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,mDAAmD,CAAC;CACjF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;IAClC,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}