@rubytech/create-maxy-code 0.1.311 → 0.1.313

package/payload/platform/plugins/quickbooks/mcp/dist/lib/oauth.d.ts

@@ -0,0 +1,37 @@
+/** OAuth consent screen. The operator's browser lands here; Intuit redirects
+ *  back to redirect_uri with code+state+realmId. */
+export declare const INTUIT_AUTHORIZE_URL = "https://appcenter.intuit.com/connect/oauth2";
+/** Token endpoint — same host for sandbox and production (the QBO API base
+ *  differs by environment, the token endpoint does not). */
+export declare const INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
+/** Accounting scope. openid/profile/email are intentionally omitted — the
+ *  connector needs company data, not an Intuit identity. */
+export declare const QBO_SCOPE = "com.intuit.quickbooks.accounting";
+export interface TokenResponse {
+    accessToken: string;
+    refreshToken: string;
+    /** seconds until the access token expires (Intuit returns ~3600). */
+    expiresIn: number;
+    /** seconds until the refresh token expires (Intuit returns ~8640000 ≈ 100d). */
+    refreshTokenExpiresIn: number;
+}
+export declare function buildAuthorizeUrl(opts: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    scope?: string;
+}): string;
+export declare function exchangeCode(opts: {
+    clientId: string;
+    clientSecret: string;
+    code: string;
+    redirectUri: string;
+    tokenUrl?: string;
+}): Promise<TokenResponse>;
+export declare function refreshAccess(opts: {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+    tokenUrl?: string;
+}): Promise<TokenResponse>;
+//# sourceMappingURL=oauth.d.ts.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/lib/oauth.ts"],"names":[],"mappings":"AAOA;oDACoD;AACpD,eAAO,MAAM,oBAAoB,gDAAgD,CAAC;AAElF;4DAC4D;AAC5D,eAAO,MAAM,gBAAgB,8DACgC,CAAC;AAE9D;4DAC4D;AAC5D,eAAO,MAAM,SAAS,qCAAqC,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAST;AAiDD,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,aAAa,CAAC,CAMzB"}

package/payload/platform/plugins/quickbooks/mcp/dist/lib/oauth.js

@@ -0,0 +1,75 @@
+// Intuit OAuth 2.0 — authorization-code grant + refresh. Pure HTTP, no state.
+//
+// Two irreducibly human steps live OUTSIDE this module (relayed, never
+// automated): the operator registers their own Intuit app, and a human clicks
+// the authorize URL to consent per company. Everything here — the URL string,
+// the code->token exchange, the refresh — is deterministic.
+/** OAuth consent screen. The operator's browser lands here; Intuit redirects
+ *  back to redirect_uri with code+state+realmId. */
+export const INTUIT_AUTHORIZE_URL = "https://appcenter.intuit.com/connect/oauth2";
+/** Token endpoint — same host for sandbox and production (the QBO API base
+ *  differs by environment, the token endpoint does not). */
+export const INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
+/** Accounting scope. openid/profile/email are intentionally omitted — the
+ *  connector needs company data, not an Intuit identity. */
+export const QBO_SCOPE = "com.intuit.quickbooks.accounting";
+export function buildAuthorizeUrl(opts) {
+    const params = new URLSearchParams({
+        client_id: opts.clientId,
+        redirect_uri: opts.redirectUri,
+        response_type: "code",
+        scope: opts.scope ?? QBO_SCOPE,
+        state: opts.state,
+    });
+    return `${INTUIT_AUTHORIZE_URL}?${params.toString()}`;
+}
+function basicAuth(clientId, clientSecret) {
+    return "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+}
+async function postToken(tokenUrl, clientId, clientSecret, form) {
+    const res = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+            Authorization: basicAuth(clientId, clientSecret),
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: form.toString(),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`token endpoint ${res.status}: ${text}`);
+    }
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`token endpoint returned non-JSON: ${text}`);
+    }
+    if (!body.access_token || !body.refresh_token) {
+        throw new Error(`token endpoint response missing tokens: ${text}`);
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        expiresIn: body.expires_in ?? 3600,
+        refreshTokenExpiresIn: body.x_refresh_token_expires_in ?? 8_640_000,
+    };
+}
+export function exchangeCode(opts) {
+    const form = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: opts.code,
+        redirect_uri: opts.redirectUri,
+    });
+    return postToken(opts.tokenUrl ?? INTUIT_TOKEN_URL, opts.clientId, opts.clientSecret, form);
+}
+export function refreshAccess(opts) {
+    const form = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: opts.refreshToken,
+    });
+    return postToken(opts.tokenUrl ?? INTUIT_TOKEN_URL, opts.clientId, opts.clientSecret, form);
+}
+//# sourceMappingURL=oauth.js.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/lib/oauth.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,8EAA8E;AAC9E,4DAA4D;AAE5D;oDACoD;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAElF;4DAC4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2DAA2D,CAAC;AAE9D;4DAC4D;AAC5D,MAAM,CAAC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAW5D,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,oBAAoB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AASD,SAAS,SAAS,CAAC,QAAgB,EAAE,YAAoB;IACvD,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,QAAgB,EAChB,YAAoB,EACpB,IAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC;YAChD,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QAClC,qBAAqB,EAAE,IAAI,CAAC,0BAA0B,IAAI,SAAS;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAM5B;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAK7B;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAC9F,CAAC"}

package/payload/platform/plugins/quickbooks/mcp/dist/lib/qbo-client.d.ts

@@ -0,0 +1,39 @@
+export interface QboClientConfig {
+    /** Override Intuit's token endpoint (tests). */
+    tokenUrl?: string;
+    /** Override the QBO API base (tests); defaults from store.environment. */
+    apiBase?: string;
+}
+export declare function qboQuery(args: {
+    platformRoot: string;
+    accountId: string;
+    realmId: string;
+    query: string;
+}, cfg?: QboClientConfig): Promise<unknown>;
+export declare function qboCreate(args: {
+    platformRoot: string;
+    accountId: string;
+    realmId: string;
+    entity: string;
+    body: unknown;
+}, cfg?: QboClientConfig): Promise<unknown>;
+export declare function qboUpdate(args: {
+    platformRoot: string;
+    accountId: string;
+    realmId: string;
+    entity: string;
+    body: unknown;
+}, cfg?: QboClientConfig): Promise<unknown>;
+export declare function auditConnection(platformRoot: string, accountId: string, realmId: string, cfg?: QboClientConfig): Promise<{
+    alive: boolean;
+    ageDays: number;
+    outcome: string;
+}>;
+export declare function qboReport(args: {
+    platformRoot: string;
+    accountId: string;
+    realmId: string;
+    report: string;
+    params?: Record<string, string>;
+}, cfg?: QboClientConfig): Promise<unknown>;
+//# sourceMappingURL=qbo-client.d.ts.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/qbo-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qbo-client.d.ts","sourceRoot":"","sources":["../../src/lib/qbo-client.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAgID,wBAAgB,QAAQ,CACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACjF,GAAG,GAAE,eAAoB,GACxB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,EACD,GAAG,GAAE,eAAoB,GACxB,OAAO,CAAC,OAAO,CAAC,CAalB;AAID,wBAAgB,SAAS,CACvB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,EACD,GAAG,GAAE,eAAoB,GACxB,OAAO,CAAC,OAAO,CAAC,CAElB;AAOD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,eAAoB,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiC/D;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,EACD,GAAG,GAAE,eAAoB,GACxB,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/payload/platform/plugins/quickbooks/mcp/dist/lib/qbo-client.js

@@ -0,0 +1,178 @@
+// QuickBooks Online REST client.
+//
+// Owns the deterministic half of the OAuth lifecycle: it keeps a short-lived
+// access token fresh by refreshing from the stored refresh token, and persists
+// the rotated refresh token Intuit returns on every refresh. No human is in
+// this path. Emits the op=refresh and op=call observability lines.
+import { readStore, upsertConnection } from "./secrets.js";
+import { refreshAccess } from "./oauth.js";
+const SANDBOX_API_BASE = "https://sandbox-quickbooks.api.intuit.com";
+const PRODUCTION_API_BASE = "https://quickbooks.api.intuit.com";
+/** Refresh when the cached access token is within this window of expiry. */
+const ACCESS_REFRESH_THRESHOLD_MS = 60_000;
+// Per (account, realm) access-token cache. The MCP server is one long-lived
+// process per account, so caching here avoids a refresh on every call.
+const accessCache = new Map();
+function cacheKey(accountId, realmId) {
+    return `${accountId}:${realmId}`;
+}
+function classifyRefreshError(message) {
+    if (message.includes("invalid_grant"))
+        return "invalid_grant";
+    if (message.includes("token endpoint 401"))
+        return "401";
+    return "error";
+}
+async function ensureAccessToken(platformRoot, accountId, realmId, cfg) {
+    const store = readStore(platformRoot, accountId);
+    if (!store)
+        throw new Error("no QuickBooks credentials configured for this account");
+    const conn = store.connections[realmId];
+    if (!conn)
+        throw new Error(`no QuickBooks connection for realmId=${realmId}`);
+    const apiBase = cfg.apiBase ?? (store.environment === "production" ? PRODUCTION_API_BASE : SANDBOX_API_BASE);
+    const key = cacheKey(accountId, realmId);
+    const cached = accessCache.get(key);
+    if (cached && cached.expiresAt - ACCESS_REFRESH_THRESHOLD_MS > Date.now()) {
+        return { accessToken: cached.accessToken, apiBase };
+    }
+    const started = Date.now();
+    try {
+        const tok = await refreshAccess({
+            clientId: store.clientId,
+            clientSecret: store.clientSecret,
+            refreshToken: conn.refreshToken,
+            tokenUrl: cfg.tokenUrl,
+        });
+        const now = Date.now();
+        // Intuit rotates the refresh token on every refresh — persist the new one
+        // or the next refresh fails with invalid_grant.
+        upsertConnection(platformRoot, accountId, realmId, {
+            refreshToken: tok.refreshToken,
+            refreshTokenExpiry: now + tok.refreshTokenExpiresIn * 1000,
+            lastRefresh: now,
+        });
+        accessCache.set(key, { accessToken: tok.accessToken, expiresAt: now + tok.expiresIn * 1000 });
+        process.stderr.write(`[quickbooks] op=refresh realmId=${realmId} outcome=ok ms=${now - started}\n`);
+        return { accessToken: tok.accessToken, apiBase };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const outcome = classifyRefreshError(message);
+        process.stderr.write(`[quickbooks] op=refresh realmId=${realmId} outcome=${outcome} ms=${Date.now() - started}\n`);
+        throw err;
+    }
+}
+async function qboRequest(args, cfg = {}) {
+    const { accessToken, apiBase } = await ensureAccessToken(args.platformRoot, args.accountId, args.realmId, cfg);
+    // Encode with encodeURIComponent (→ %20 for spaces) rather than
+    // URLSearchParams (→ + for spaces): the QBO query endpoint expects %20 and a
+    // + would be read as a literal plus inside a SQL-ish WHERE clause.
+    const query = { minorversion: "73", ...(args.search ?? {}) };
+    const search = Object.entries(query)
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+        .join("&");
+    const url = `${apiBase}/v3/company/${args.realmId}/${args.urlPath}?${search}`;
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+    };
+    if (args.body !== undefined)
+        headers["Content-Type"] = "application/json";
+    const started = Date.now();
+    const res = await fetch(url, {
+        method: args.method,
+        headers,
+        body: args.body !== undefined ? JSON.stringify(args.body) : undefined,
+    });
+    const text = await res.text();
+    process.stderr.write(`[quickbooks] op=call realmId=${args.realmId} entity=${args.entity} method=${args.method} status=${res.status} ms=${Date.now() - started}\n`);
+    if (!res.ok) {
+        throw new Error(`QBO ${args.method} ${args.urlPath} ${res.status}: ${text}`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`QBO ${args.urlPath} returned non-JSON: ${text}`);
+    }
+}
+export function qboQuery(args, cfg = {}) {
+    return qboRequest({
+        platformRoot: args.platformRoot,
+        accountId: args.accountId,
+        realmId: args.realmId,
+        method: "GET",
+        urlPath: "query",
+        search: { query: args.query },
+        entity: "query",
+    }, cfg);
+}
+export function qboCreate(args, cfg = {}) {
+    return qboRequest({
+        platformRoot: args.platformRoot,
+        accountId: args.accountId,
+        realmId: args.realmId,
+        method: "POST",
+        urlPath: args.entity.toLowerCase(),
+        entity: args.entity,
+        body: args.body,
+    }, cfg);
+}
+// Update is the same endpoint as create — a full or sparse POST carrying Id +
+// SyncToken. The caller assembles the body; the connector does not guess it.
+export function qboUpdate(args, cfg = {}) {
+    return qboCreate(args, cfg);
+}
+// Standing no-event-failure check. A refresh token dies silently after ~100
+// days of inactivity or operator revocation — nothing is emitted until the next
+// call returns invalid_grant. auditConnection forces a refresh probe so a dead
+// connection is surfaced BEFORE a customer-facing call hits it. A successful
+// probe also keeps the token alive (refresh resets the 100-day clock).
+export async function auditConnection(platformRoot, accountId, realmId, cfg = {}) {
+    const store = readStore(platformRoot, accountId);
+    const conn = store?.connections[realmId];
+    if (!store || !conn) {
+        process.stderr.write(`[quickbooks] op=token-audit realmId=${realmId} alive=false ageDays=-1\n`);
+        return { alive: false, ageDays: -1, outcome: "no-connection" };
+    }
+    const ageDays = conn.lastRefresh > 0 ? Math.floor((Date.now() - conn.lastRefresh) / 86_400_000) : -1;
+    try {
+        const tok = await refreshAccess({
+            clientId: store.clientId,
+            clientSecret: store.clientSecret,
+            refreshToken: conn.refreshToken,
+            tokenUrl: cfg.tokenUrl,
+        });
+        const now = Date.now();
+        upsertConnection(platformRoot, accountId, realmId, {
+            refreshToken: tok.refreshToken,
+            refreshTokenExpiry: now + tok.refreshTokenExpiresIn * 1000,
+            lastRefresh: now,
+        });
+        accessCache.set(cacheKey(accountId, realmId), {
+            accessToken: tok.accessToken,
+            expiresAt: now + tok.expiresIn * 1000,
+        });
+        process.stderr.write(`[quickbooks] op=token-audit realmId=${realmId} alive=true ageDays=${ageDays}\n`);
+        return { alive: true, ageDays, outcome: "ok" };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const outcome = classifyRefreshError(message);
+        process.stderr.write(`[quickbooks] op=token-audit realmId=${realmId} alive=false ageDays=${ageDays}\n`);
+        return { alive: false, ageDays, outcome };
+    }
+}
+export function qboReport(args, cfg = {}) {
+    return qboRequest({
+        platformRoot: args.platformRoot,
+        accountId: args.accountId,
+        realmId: args.realmId,
+        method: "GET",
+        urlPath: `reports/${args.report}`,
+        search: args.params ?? {},
+        entity: `report:${args.report}`,
+    }, cfg);
+}
+//# sourceMappingURL=qbo-client.js.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/qbo-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qbo-client.js","sourceRoot":"","sources":["../../src/lib/qbo-client.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,mEAAmE;AAEnE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,gBAAgB,GAAG,2CAA2C,CAAC;AACrE,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAc3C,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEpD,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,OAAO,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,eAAe,CAAC;IAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,GAAoB;IAEpB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GACX,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAE/F,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,2BAA2B,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,0EAA0E;QAC1E,gDAAgD;QAChD,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE;YACjD,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,kBAAkB,EAAE,GAAG,GAAG,GAAG,CAAC,qBAAqB,GAAG,IAAI;YAC1D,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,OAAO,kBAAkB,GAAG,GAAG,OAAO,IAAI,CAC9E,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,OAAO,YAAY,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,CAC7F,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAYC,EACD,MAAuB,EAAE;IAEzB,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CACtD,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,EACZ,GAAG,CACJ,CAAC;IACF,gEAAgE;IAChE,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,KAAK,GAA2B,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,GAAG,OAAO,eAAe,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;IAE9E,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,WAAW,EAAE;QACtC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,IAAI,CAAC,OAAO,WAAW,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,CAC7I,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,IAAiF,EACjF,MAAuB,EAAE;IAEzB,OAAO,UAAU,CACf;QACE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC7B,MAAM,EAAE,OAAO;KAChB,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAMC,EACD,MAAuB,EAAE;IAEzB,OAAO,UAAU,CACf;QACE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CACvB,IAMC,EACD,MAAuB,EAAE;IAEzB,OAAO,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,MAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,OAAO,2BAA2B,CAAC,CAAC;QAChG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE;YACjD,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,kBAAkB,EAAE,GAAG,GAAG,GAAG,CAAC,qBAAqB,GAAG,IAAI;YAC1D,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;YAC5C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,IAAI;SACtC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,OAAO,uBAAuB,OAAO,IAAI,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,OAAO,wBAAwB,OAAO,IAAI,CAAC,CAAC;QACxG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAMC,EACD,MAAuB,EAAE;IAEzB,OAAO,UAAU,CACf;QACE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,WAAW,IAAI,CAAC,MAAM,EAAE;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;KAChC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/quickbooks/mcp/dist/lib/secrets.d.ts

@@ -0,0 +1,36 @@
+export interface QbConnection {
+    refreshToken: string;
+    /** epoch ms when the refresh token itself expires (~100 days of inactivity). */
+    refreshTokenExpiry: number;
+    /** epoch ms of the last successful token exchange or refresh. */
+    lastRefresh: number;
+}
+export interface QbStore {
+    clientId: string;
+    clientSecret: string;
+    environment: "sandbox" | "production";
+    /** keyed by Intuit realmId (one company per realm). */
+    connections: Record<string, QbConnection>;
+}
+export interface QbPending {
+    state: string;
+    /** The exact redirect_uri used in the authorize request — the token exchange
+     *  must echo it verbatim or Intuit rejects the code. */
+    redirectUri: string;
+    realmHint?: string;
+    createdAt: number;
+    expiresAt: number;
+}
+export declare function accountSecretsDir(platformRoot: string, accountId: string): string;
+export declare function readStore(platformRoot: string, accountId: string): QbStore | null;
+export declare function setCredentials(platformRoot: string, accountId: string, creds: {
+    clientId: string;
+    clientSecret: string;
+    environment: "sandbox" | "production";
+}): void;
+export declare function upsertConnection(platformRoot: string, accountId: string, realmId: string, conn: QbConnection): void;
+export declare function removeConnection(platformRoot: string, accountId: string, realmId: string): void;
+export declare function writePending(platformRoot: string, accountId: string, pending: QbPending): void;
+export declare function readPending(platformRoot: string, accountId: string, state: string): QbPending | null;
+export declare function deletePending(platformRoot: string, accountId: string, state: string): void;
+//# sourceMappingURL=secrets.d.ts.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/lib/secrets.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd;4DACwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjF;AAiBD,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAQjF;AAUD,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,YAAY,CAAA;CAAE,GACvF,IAAI,CAQN;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,GACjB,IAAI,CAON;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,IAAI,CAKN;AAED,wBAAgB,YAAY,CAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,GACjB,IAAI,CAIN;AAED,wBAAgB,WAAW,CACzB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,SAAS,GAAG,IAAI,CAalB;AAED,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,IAAI,CAQN"}

package/payload/platform/plugins/quickbooks/mcp/dist/lib/secrets.js

@@ -0,0 +1,107 @@
+// QuickBooks Online per-account secret store.
+//
+// Plain 0600 JSON, NOT the encrypted outlook TokenStore. Two processes read and
+// write this store: the MCP tool server (this package) and the UI server's
+// callback route (platform/ui/server/routes/quickbooks.ts). They never import
+// across the build-tree boundary — they agree on the on-disk shape defined here
+// and in the callback route. Plain JSON keeps that contract trivially shareable;
+// the secrets/ dir is brand-isolated and delete-protected (admin/files.ts), the
+// same protection the cloudflare token store relies on.
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, } from "node:fs";
+import { resolve, join } from "node:path";
+/** A consent state nonce: URL-safe characters only, never a path fragment. */
+const STATE_RE = /^[A-Za-z0-9_-]+$/;
+function accountsDir(platformRoot) {
+    return resolve(platformRoot, "..", "data/accounts");
+}
+export function accountSecretsDir(platformRoot, accountId) {
+    return join(accountsDir(platformRoot), accountId, "secrets");
+}
+function storePath(platformRoot, accountId) {
+    return join(accountSecretsDir(platformRoot, accountId), "quickbooks.json");
+}
+function pendingDir(platformRoot, accountId) {
+    return join(accountSecretsDir(platformRoot, accountId), "quickbooks-pending");
+}
+function pendingPath(platformRoot, accountId, state) {
+    if (!STATE_RE.test(state)) {
+        throw new Error(`invalid consent state nonce: ${JSON.stringify(state)}`);
+    }
+    return join(pendingDir(platformRoot, accountId), `${state}.json`);
+}
+export function readStore(platformRoot, accountId) {
+    const file = storePath(platformRoot, accountId);
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(readFileSync(file, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeStore(platformRoot, accountId, store) {
+    const dir = accountSecretsDir(platformRoot, accountId);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(storePath(platformRoot, accountId), JSON.stringify(store, null, 2), {
+        mode: 0o600,
+    });
+}
+export function setCredentials(platformRoot, accountId, creds) {
+    const prev = readStore(platformRoot, accountId);
+    writeStore(platformRoot, accountId, {
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        environment: creds.environment,
+        connections: prev?.connections ?? {},
+    });
+}
+export function upsertConnection(platformRoot, accountId, realmId, conn) {
+    const store = readStore(platformRoot, accountId);
+    if (!store) {
+        throw new Error("cannot store a connection before credentials are set");
+    }
+    store.connections[realmId] = conn;
+    writeStore(platformRoot, accountId, store);
+}
+export function removeConnection(platformRoot, accountId, realmId) {
+    const store = readStore(platformRoot, accountId);
+    if (!store)
+        return;
+    delete store.connections[realmId];
+    writeStore(platformRoot, accountId, store);
+}
+export function writePending(platformRoot, accountId, pending) {
+    const file = pendingPath(platformRoot, accountId, pending.state);
+    mkdirSync(pendingDir(platformRoot, accountId), { recursive: true });
+    writeFileSync(file, JSON.stringify(pending, null, 2), { mode: 0o600 });
+}
+export function readPending(platformRoot, accountId, state) {
+    let file;
+    try {
+        file = pendingPath(platformRoot, accountId, state);
+    }
+    catch {
+        return null;
+    }
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(readFileSync(file, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function deletePending(platformRoot, accountId, state) {
+    let file;
+    try {
+        file = pendingPath(platformRoot, accountId, state);
+    }
+    catch {
+        return;
+    }
+    if (existsSync(file))
+        rmSync(file);
+}
+//# sourceMappingURL=secrets.js.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/lib/secrets.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,wDAAwD;AAExD,OAAO,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA4B1C,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,SAAS,WAAW,CAAC,YAAoB;IACvC,OAAO,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,SAAiB;IACvE,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,YAAoB,EAAE,SAAiB;IACxD,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,SAAiB;IACzD,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB,EAAE,SAAiB,EAAE,KAAa;IACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,YAAoB,EAAE,SAAiB;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,SAAiB,EAAE,KAAc;IACzE,MAAM,GAAG,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAChF,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,SAAiB,EACjB,KAAwF;IAExF,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAClC,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,SAAiB,EACjB,OAAe;IAEf,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,YAAoB,EACpB,SAAiB,EACjB,OAAkB;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjE,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,YAAoB,EACpB,SAAiB,EACjB,KAAa;IAEb,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAc,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAoB,EACpB,SAAiB,EACjB,KAAa;IAEb,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/payload/platform/plugins/quickbooks/mcp/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@maxy/quickbooks",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/payload/platform/plugins/quickbooks/skills/quickbooks/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: quickbooks
+description: Connect QuickBooks Online and work with the books. Use when the operator wants to link QuickBooks, read invoices/customers/bills/reports, or create and update accounting records. Covers the one-time Intuit app registration and per-company consent relay, then the agent-driven read/write surface.
+---
+
+# QuickBooks Online connector
+
+QuickBooks Online lives in Intuit's cloud. Maxy never owns the OAuth app — the operator brings their own Intuit app, and a human consents per company. After that, reads and writes are yours.
+
+Success is: the operator's credentials are stored, at least one company shows up under `quickbooks-connections`, and a `quickbooks-query` returns that company's data.
+
+## The two human steps (relay these — never click for them)
+
+**1. Register an Intuit app.** The operator (not the agent) does this once at https://developer.intuit.com. They create an app, enable the Accounting scope, and copy its **client ID** and **client secret**. In the app's Keys & OAuth settings they add a **Redirect URI** that must be exactly the brand's public site URL followed by `/api/quickbooks/callback` (for example `https://app.<brand-domain>/api/quickbooks/callback`). Intuit rejects `localhost` for production, which is why the callback rides the public host. For a first run, the sandbox keys (free, up to five sandbox companies) are the right starting point.
+
+**2. Consent per company.** You generate the consent link with `quickbooks-authorize-url`; a human opens it, signs into Intuit, and authorizes one company. Intuit redirects their browser back to the callback, which stores the refresh token. Repeat per company for the accountant case (one Intuit app can hold many company grants).
+
+## Procedure
+
+1. Once the operator has the client ID and secret, store them: `quickbooks-credentials-set` with `environment` set to `sandbox` or `production`.
+2. Generate the consent link: `quickbooks-authorize-url` with `redirectUri` set to the **exact** registered redirect URI. Hand the returned URL to a human. The link is valid 15 minutes.
+3. After they authorize, confirm with `quickbooks-connections` — the company's `realmId` should appear.
+4. Read and write against that `realmId`.
+
+## Working with the books
+
+- **Read anything** with `quickbooks-query`, e.g. `SELECT * FROM Invoice WHERE TxnDate > '2026-01-01'`, `SELECT * FROM Customer`, `SELECT * FROM Bill MAXRESULTS 50`.
+- **Reports** with `quickbooks-report`, e.g. `ProfitAndLoss` with `{ start_date, end_date }`, or `BalanceSheet`.
+- **Write** with the entity tools (`quickbooks-invoice-create`, `quickbooks-customer-create`, `quickbooks-bill-create`, `quickbooks-payment-create`) or the generic `quickbooks-entity-create` for anything else. Updates require the record's current `Id` and `SyncToken` in the body (read it back first with a query).
+
+## Keeping connections healthy
+
+A refresh token dies silently after about 100 days of inactivity or if the operator revokes it. Run `quickbooks-token-audit` periodically; `alive=false` means that company needs the consent relay run again before it is used. Reads are metered (a free monthly allowance) and writes are free — prefer a targeted query over pulling everything.
+
+## What stays the operator's job
+
+Moving an Intuit app from sandbox to production requires Intuit's production security assessment. That is the operator's responsibility and is not automated here.

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAiB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAkLtD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAkB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAiMtD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -16,6 +16,7 @@ export const MAXY_MCP_PLUGINS = [
     "graph-viewer",
     "memory",
     "outlook",
+    "quickbooks",
     "replicate",
     "scheduling",
     "telegram",
@@ -155,6 +156,21 @@ export const CANONICAL_MAXY_TOOL_NAMES = [
     "mcp__plugin_outlook_outlook__outlook-mail-list",
     "mcp__plugin_outlook_outlook__outlook-mail-search",
     "mcp__plugin_outlook_outlook__outlook-mailbox-info",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-authorize-url",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-bill-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-connections",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-credentials-set",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-customer-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-customer-update",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-disconnect",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-entity-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-entity-update",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-invoice-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-invoice-update",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-payment-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-query",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-report",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-token-audit",
     "mcp__plugin_replicate_replicate__image-generate",
     "mcp__plugin_replicate_replicate__replicate-key-store",
     "mcp__plugin_replicate_replicate__replicate-key-verify",

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,qDAAqD;IACrD,oDAAoD;IACpD,oDAAoD;IACpD,gDAAgD;IAChD,kDAAkD;IAClD,mDAAmD;IACnD,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,qDAAqD;IACrD,oDAAoD;IACpD,oDAAoD;IACpD,gDAAgD;IAChD,kDAAkD;IAClD,mDAAmD;IACnD,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,0DAA0D;IAC1D,6DAA6D;IAC7D,6DAA6D;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}