@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/mcpserver/complete-oauth-connect.js

@@ -0,0 +1,232 @@
+/**
+ * completeOAuthConnect — ports
+ * pkg/domain/mcpserver/controller/complete_oauth_connect.go: finish the
+ * OAuth flow by exchanging the authorization code for tokens, storing
+ * them in a managed environment, and creating an OAuthGrant record. On
+ * re-connect (same user + server + org already has a grant with an
+ * environment ID), the existing managed environment is reused — only its
+ * secrets are updated with the fresh tokens.
+ *
+ * DB-1 (owner-ratified, sub-project 20260825.02): the managed-env service
+ * is wired unconditionally here, so this RPC serves on a Temporal-less
+ * server where Go's composition gate refuses ("managed environment
+ * service not initialized" — a wiring artifact CW-1 deliberately did NOT
+ * pin). Disclosed divergence; the Go-side issue files at wrap-up.
+ *
+ * Proven by mcpserver-connect.conformance.test.ts
+ * (CONFORMANCE_TARGET=local-execution) and
+ * __tests__/complete-oauth-connect.test.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import { EnvironmentValueSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
+import { CompleteOAuthConnectOutputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { failedPreconditionError, internalError, invalidArgumentError, notFoundError, unavailableError, } from "../../pipeline/errors.js";
+import { authorizeDirect } from "../../pipeline/steps/authorize.js";
+import { exchangeCode } from "./oauth/token.js";
+export async function completeOAuthConnect(deps, input, identity) {
+    const mcpServerId = input.mcpServerId;
+    if (mcpServerId === "") {
+        throw invalidArgumentError("mcp_server_id is required");
+    }
+    const stateParam = input.state;
+    if (stateParam === "") {
+        throw invalidArgumentError("state is required");
+    }
+    const code = input.authorizationCode;
+    if (code === "") {
+        throw invalidArgumentError("authorization_code is required");
+    }
+    // Load and validate pending state (atomically consumed).
+    let pendingState;
+    try {
+        pendingState = await deps.pendingOAuthStates.getAndDelete(stateParam);
+    }
+    catch (error) {
+        throw internalError(error, "failed to load pending OAuth state");
+    }
+    if (pendingState === undefined) {
+        throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");
+    }
+    if (pendingState.mcpServerId !== mcpServerId) {
+        throw failedPreconditionError("state parameter does not match the requested mcp_server_id");
+    }
+    // The annotation's can_connect check against the PENDING RECORD's
+    // server id — the Java McpServerCompleteOAuthConnectHandler discipline
+    // (the server-side state is the truth; a caller-supplied id would be a
+    // confused-deputy target). As in Java, the single-use state is already
+    // burned when a denial lands — the denied caller costs the user one
+    // re-initiate. C2 Stage 4.
+    await authorizeDirect(McpServerCommandController.method.completeOAuthConnect, deps.authorizer, identity, input, { resourceId: pendingState.mcpServerId });
+    // Unseal the handshake secrets that initiateOAuthConnect sealed at rest
+    // (oss#394), at the last moment before their only use. The row was
+    // consumed by getAndDelete (single-use is atomic), so a decryption
+    // failure costs the user one re-initiate — the same posture as the
+    // expiry refusal; the error message points them there.
+    try {
+        pendingState = await unsealPendingOAuthState(deps.secretService, pendingState);
+    }
+    catch (error) {
+        deps.logger.error("Failed to decrypt pending OAuth state secrets", {
+            mcp_server_id: mcpServerId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw internalError(error, "failed to decrypt OAuth handshake secrets — please retry the connect flow");
+    }
+    // Exchange authorization code for tokens. Failure maps to UNAVAILABLE —
+    // the pinned (unusual) Go mapping, complete_oauth_connect.go:96.
+    let tokenResponse;
+    try {
+        tokenResponse = await exchangeCode(pendingState.tokenEndpoint, code, pendingState.redirectUri, pendingState.codeVerifier, pendingState.clientId, pendingState.clientSecret, pendingState.tokenAuthMethod);
+    }
+    catch (error) {
+        throw unavailableError(`token exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // Load the MCP server for the auth block metadata and name.
+    let mcpServer;
+    try {
+        mcpServer = await deps.store.getResource(ApiResourceKind.mcp_server, mcpServerId, McpServerSchema);
+    }
+    catch {
+        throw notFoundError("mcp_server", mcpServerId);
+    }
+    let org = pendingState.org;
+    if (org === "") {
+        org = mcpServer.metadata?.org ?? "";
+    }
+    // Resolve the managed environment: reuse from an existing grant or
+    // create new — the create AS THE COMPLETING CALLER (ruling R5, parity
+    // entry 20260830.05): ownership tuples land on the connecting user
+    // under a composed tuple-lifecycle driver, so the environment stays
+    // visible in their scoped lists (the Java createAsCaller posture).
+    const managedEnvId = await resolveOrCreateManagedEnvironment(deps, pendingState.identityAccountId, mcpServerId, org, mcpServer.metadata?.name ?? "", identity);
+    // Build token variables (plaintext — the environment pipeline encrypts).
+    const tokenVars = {
+        [pendingState.targetEnvVar]: create(EnvironmentValueSchema, {
+            value: tokenResponse.accessToken,
+            isSecret: true,
+        }),
+    };
+    const refreshTokenEnvVar = `${pendingState.targetEnvVar}_REFRESH_TOKEN`;
+    if (tokenResponse.refreshToken !== "") {
+        tokenVars[refreshTokenEnvVar] = create(EnvironmentValueSchema, {
+            value: tokenResponse.refreshToken,
+            isSecret: true,
+        });
+    }
+    try {
+        await deps.managedEnv.updateSecrets(managedEnvId, tokenVars);
+    }
+    catch (error) {
+        throw internalError(error, "failed to store OAuth tokens in managed environment");
+    }
+    let expiresAt = 0;
+    if (tokenResponse.expiresIn > 0) {
+        expiresAt = Math.floor(Date.now() / 1000) + tokenResponse.expiresIn;
+    }
+    // Create or update the OAuthGrant record. RefreshTokenEnvVar is set
+    // UNCONDITIONALLY — even when no refresh token was issued — which is
+    // exactly why evaluateHealth's TOKEN_EXPIRED arm is unreachable through
+    // the real flow: the filed defect oss#863, ported as-is (parity, not a
+    // fix).
+    try {
+        await deps.oauthGrants.upsert({
+            identityAccountId: pendingState.identityAccountId,
+            resourceId: mcpServerId,
+            resourceKind: "mcp_server",
+            orgId: org,
+            accessTokenExpiresAt: expiresAt,
+            clientId: pendingState.clientId,
+            authMethod: pendingState.authMethod,
+            tokenEndpoint: pendingState.tokenEndpoint,
+            accessTokenEnvVar: pendingState.targetEnvVar,
+            refreshTokenEnvVar,
+            environmentId: managedEnvId,
+            createdAt: 0,
+            updatedAt: 0,
+        });
+    }
+    catch (error) {
+        throw internalError(error, "failed to create OAuth grant record");
+    }
+    const auth = mcpServer.spec?.auth;
+    deps.logger.info("OAuth Connect completed: tokens stored in managed environment", {
+        mcp_server_id: mcpServerId,
+        auth_method: pendingState.authMethod,
+        target_env_var: pendingState.targetEnvVar,
+        managed_env_id: managedEnvId,
+        expires_at: expiresAt,
+        has_refresh_token: tokenResponse.refreshToken !== "",
+    });
+    return create(CompleteOAuthConnectOutputSchema, {
+        connected: true,
+        targetEnvVar: pendingState.targetEnvVar,
+        tokenLifetimeHint: auth?.tokenLifetimeHint ?? "",
+    });
+}
+/**
+ * Decrypts the secrets sealPendingOAuthState encrypted before the row
+ * rested (oss#394) — the read seam paired with the write seam in
+ * initiate-oauth-connect.ts.
+ *
+ * decrypt() dispatches on the value's own enc:v1: prefix and passes
+ * plaintext through unchanged, which quietly covers every legacy shape:
+ * rows written before the sealing release, rows written while encryption
+ * was disabled, and the DCR path's deliberately empty client secret. No
+ * migration — the table turns over in 10 minutes.
+ *
+ * A sealed row on a deployment whose key has since vanished fails here
+ * (loudly, before any token-exchange attempt) rather than sending
+ * ciphertext to the vendor's token endpoint.
+ */
+export async function unsealPendingOAuthState(secretService, state) {
+    let verifier;
+    try {
+        verifier = await secretService.decrypt(state.codeVerifier);
+    }
+    catch (error) {
+        throw new Error(`failed to decrypt code_verifier: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let secret;
+    try {
+        secret = await secretService.decrypt(state.clientSecret);
+    }
+    catch (error) {
+        throw new Error(`failed to decrypt client_secret: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return { ...state, codeVerifier: verifier, clientSecret: secret };
+}
+/**
+ * Reuses the managed environment an existing OAuthGrant points to
+ * (re-connect case), or creates a new one (Go
+ * resolveOrCreateManagedEnvironment).
+ */
+async function resolveOrCreateManagedEnvironment(deps, identityAccountId, mcpServerId, org, mcpServerName, caller) {
+    let existingGrant;
+    try {
+        existingGrant = await deps.oauthGrants.find(identityAccountId, mcpServerId, org);
+    }
+    catch (error) {
+        deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)", {
+            mcp_server_id: mcpServerId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    if (existingGrant !== undefined && existingGrant.environmentId !== "") {
+        deps.logger.info("Reusing existing managed environment for OAuth re-connect", {
+            mcp_server_id: mcpServerId,
+            environment_id: existingGrant.environmentId,
+        });
+        return existingGrant.environmentId;
+    }
+    const envName = `OAuth: ${mcpServerName}`;
+    try {
+        return await deps.managedEnv.createManagedEnvironment(envName, org, caller);
+    }
+    catch (error) {
+        throw internalError(error, "failed to create managed environment for OAuth tokens");
+    }
+}
+//# sourceMappingURL=complete-oauth-connect.js.map

package/dist/domain/mcpserver/complete-oauth-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-oauth-connect.js","sourceRoot":"","sources":["../../../src/domain/mcpserver/complete-oauth-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AAEnG,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAKxG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uDAAuD,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAItH,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA0B,EAC1B,KAAgC,EAChC,QAAwB;IAExB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC;IACrC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IAED,yDAAyD;IACzD,IAAI,YAA2C,CAAC;IAChD,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,uBAAuB,CAC3B,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC7C,MAAM,uBAAuB,CAC3B,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,2BAA2B;IAC3B,MAAM,eAAe,CACnB,0BAA0B,CAAC,MAAM,CAAC,oBAAoB,EACtD,IAAI,CAAC,UAAU,EACf,QAAQ,EACR,KAAK,EACL,EAAE,UAAU,EAAE,YAAY,CAAC,WAAW,EAAE,CACzC,CAAC;IAEF,wEAAwE;IACxE,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,uDAAuD;IACvD,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,uBAAuB,CAC1C,IAAI,CAAC,aAAa,EAClB,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE;YACjE,aAAa,EAAE,WAAW;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,aAAa,CACjB,KAAK,EACL,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,aAAa,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,YAAY,CAChC,YAAY,CAAC,aAAa,EAC1B,IAAI,EACJ,YAAY,CAAC,WAAW,EACxB,YAAY,CAAC,YAAY,EACzB,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,YAAY,EACzB,YAAY,CAAC,eAAe,CAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CACpB,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CACtC,eAAe,CAAC,UAAU,EAC1B,WAAW,EACX,eAAe,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAC1D,IAAI,EACJ,YAAY,CAAC,iBAAiB,EAC9B,WAAW,EACX,GAAG,EACH,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAC9B,QAAQ,CACT,CAAC;IAEF,yEAAyE;IACzE,MAAM,SAAS,GAA4C;QACzD,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,sBAAsB,EAAE;YAC1D,KAAK,EAAE,aAAa,CAAC,WAAW;YAChC,QAAQ,EAAE,IAAI;SACf,CAAC;KACH,CAAC;IAEF,MAAM,kBAAkB,GAAG,GAAG,YAAY,CAAC,YAAY,gBAAgB,CAAC;IACxE,IAAI,aAAa,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACtC,SAAS,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,sBAAsB,EAAE;YAC7D,KAAK,EAAE,aAAa,CAAC,YAAY;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CACjB,KAAK,EACL,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,aAAa,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAChC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,QAAQ;IACR,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAC5B,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;YACjD,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,YAAY;YAC1B,KAAK,EAAE,GAAG;YACV,oBAAoB,EAAE,SAAS;YAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,iBAAiB,EAAE,YAAY,CAAC,YAAY;YAC5C,kBAAkB;YAClB,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,qCAAqC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;IAElC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+DAA+D,EAC/D;QACE,aAAa,EAAE,WAAW;QAC1B,WAAW,EAAE,YAAY,CAAC,UAAU;QACpC,cAAc,EAAE,YAAY,CAAC,YAAY;QACzC,cAAc,EAAE,YAAY;QAC5B,UAAU,EAAE,SAAS;QACrB,iBAAiB,EAAE,aAAa,CAAC,YAAY,KAAK,EAAE;KACrD,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE;KACjD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA4B,EAC5B,KAAwB;IAExB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAC9C,IAA0B,EAC1B,iBAAyB,EACzB,WAAmB,EACnB,GAAW,EACX,aAAqB,EACrB,MAAsB;IAEtB,IAAI,aAAa,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CACzC,iBAAiB,EACjB,WAAW,EACX,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iFAAiF,EACjF;YACE,aAAa,EAAE,WAAW;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,aAAa,EAAE,WAAW;YAC1B,cAAc,EAAE,aAAa,CAAC,aAAa;SAC5C,CACF,CAAC;QACF,OAAO,aAAa,CAAC,aAAa,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,aAAa,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CACjB,KAAK,EACL,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/domain/mcpserver/connect-status.d.ts

@@ -0,0 +1,100 @@
+import type { ConnectError } from "@connectrpc/connect";
+import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import type { ToolApprovalPolicy } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import type { DiscoveredCapabilities, McpServerStatus } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/status_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { Store } from "../../store/interface.js";
+import type { ConnectWorkflowOutput } from "./engine.js";
+/**
+ * Converts the workflow output to the proto DiscoveredCapabilities
+ * message (Go convertToDiscoveredCapabilities).
+ *
+ * protobuf-es represents google.protobuf.Struct fields as JsonObject, so
+ * the runner's schema object assigns directly — Go's soft
+ * structpb.NewStruct error arm has no TS equivalent (the value arrived
+ * through JSON and is representable by construction).
+ *
+ * Watch item (oss#862, ratified DB-3): Go persists the Struct with
+ * SORTED JSON keys while this path keeps the runner's insertion order —
+ * the runner's reconnect signature compares stringified schemas, so
+ * ordering feeds the filed carry-forward defect. The conformance suite
+ * pins only the wire-stable contract (capabilities + gates survive
+ * reconnect), which both orderings satisfy.
+ */
+export declare function convertToDiscoveredCapabilities(output: ConnectWorkflowOutput): DiscoveredCapabilities;
+/**
+ * Converts the classifier output to the ToolApprovalPolicy list (Go
+ * convertToToolApprovals). Presence in the list means "requires
+ * approval" — there is no boolean on the proto — so any entry explicitly
+ * marked requires_approval=false is dropped. Mirrors the Cloud (Java)
+ * StoreConnectResults converter so both editions persist identical
+ * classifier output.
+ */
+export declare function convertToToolApprovals(output: ConnectWorkflowOutput): ToolApprovalPolicy[];
+/**
+ * Writes the freshly classified tool approvals onto the status, returning
+ * how many were applied (Go setToolApprovalsFromConnect).
+ *
+ * Overwrite-on-reconnect: a new non-empty result replaces the prior list
+ * so a reclassification takes effect. Preserve-on-empty: an empty result
+ * leaves the existing list untouched, so a degraded or older runner that
+ * returns nothing can never silently disarm previously persisted approval
+ * gates.
+ */
+export declare function setToolApprovalsFromConnect(status: McpServerStatus, output: ConnectWorkflowOutput): number;
+/**
+ * Records the terminal phase of a connect operation on the status,
+ * preserving the start-time fields (started_at) the starting lane
+ * recorded (Go settleConnectStatus). failure is the mapped gRPC error for
+ * a failed operation, undefined for success; its code and message land
+ * verbatim on the status so polling clients render the same
+ * classification blocking callers get as an RPC error.
+ *
+ * The start-time warning is cleared either way: it is a CONNECTING-phase
+ * advisory ("no worker appears to be polling"), and a settled operation
+ * has disproven it.
+ */
+export declare function settleConnectStatus(mcpStatus: McpServerStatus, workflowId: string, failure: ConnectError | undefined): void;
+/**
+ * Writes the connect workflow's output onto the McpServer status as a
+ * single atomic read-modify-write, returning the updated resource and the
+ * number of tool-approval gates applied (Go persistConnectResult).
+ *
+ * This is the one place connect output lands on the resource — the
+ * blocking Connect path, the async StartConnect path, and the best-effort
+ * auto-connect path all route through it. The atomic updateResource is
+ * deliberate: the background writes can land long after the triggering
+ * RPC returned, so a plain read-modify-write would risk clobbering a
+ * concurrent update (a manual reconnect or an edit) made in that window.
+ *
+ * The result fields follow the deliberate Phase-6 asymmetry, unchanged:
+ * discovered_capabilities is a point-in-time snapshot, overwritten on
+ * every connect; tool_approvals are safety-critical gates (see
+ * setToolApprovalsFromConnect). The connect_status settle rides the same
+ * atomic write so pollers can never observe results without the terminal
+ * phase (or vice versa).
+ *
+ * Throws ResourceNotFoundError if the resource was deleted between the
+ * connect trigger and its completion (a real case for the background
+ * paths); callers decide how to react.
+ */
+export declare function persistConnectResult(store: Store, mcpServerId: string, workflowId: string, output: ConnectWorkflowOutput): Promise<{
+    persisted: McpServer;
+    toolApprovalCount: number;
+}>;
+/**
+ * Records a freshly started connect operation as the resource's
+ * connect_status (phase CONNECTING), replacing whatever previous
+ * operation's record was there (Go persistConnectStarting). Returns the
+ * updated resource — the payload StartConnect answers with.
+ */
+export declare function persistConnectStarting(store: Store, mcpServerId: string, workflowId: string, warning: string): Promise<McpServer>;
+/**
+ * Settles connect_status as FAILED with the mapped gRPC classification of
+ * the given error (Go persistConnectFailure). Never propagates its own
+ * failure: every caller has already surfaced the connect failure on its
+ * own channel (RPC error or log), and a resource deleted mid-operation is
+ * expected.
+ */
+export declare function persistConnectFailure(store: Store, logger: Logger, mcpServerId: string, failure: ConnectError): Promise<void>;
+//# sourceMappingURL=connect-status.d.ts.map

package/dist/domain/mcpserver/connect-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-status.d.ts","sourceRoot":"","sources":["../../../src/domain/mcpserver/connect-status.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AAExF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yDAAyD,CAAC;AAElG,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EAChB,MAAM,2DAA2D,CAAC;AAWnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,qBAAqB,GAC5B,sBAAsB,CA4BxB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,GAC5B,kBAAkB,EAAE,CAetB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,qBAAqB,GAC5B,MAAM,CAMR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,YAAY,GAAG,SAAS,GAChC,IAAI,CAsBN;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB9D;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/domain/mcpserver/connect-status.js

@@ -0,0 +1,219 @@
+/**
+ * Connect-status bookkeeping and result persistence — ports the
+ * persistence family shared by all three connect lanes:
+ * persistConnectResult / settleConnectStatus / convertToDiscovered-
+ * Capabilities / convertToToolApprovals / setToolApprovalsFromConnect
+ * (connect.go:733-889) and persistConnectStarting / persistConnectFailure
+ * (start_connect.go:212-285). One module because these helpers are the
+ * shared bookkeeping BOTH connect.ts and start-connect.ts consume — Go's
+ * single package makes the split invisible; in ESM this placement keeps
+ * the handler modules cycle-free.
+ *
+ * Proven by mcpserver-connect.conformance.test.ts
+ * (CONFORMANCE_TARGET=local-execution).
+ */
+import { create } from "@bufbuild/protobuf";
+import { timestampNow } from "@bufbuild/protobuf/wkt";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ToolApprovalPolicySchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { ConnectPhase, ConnectStatusSchema, DiscoveredCapabilitiesSchema, DiscoveredResourceTemplateSchema, DiscoveredToolSchema, McpServerStatusSchema, } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/status_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { grpcCodeName } from "../../pipeline/errors.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+/**
+ * Converts the workflow output to the proto DiscoveredCapabilities
+ * message (Go convertToDiscoveredCapabilities).
+ *
+ * protobuf-es represents google.protobuf.Struct fields as JsonObject, so
+ * the runner's schema object assigns directly — Go's soft
+ * structpb.NewStruct error arm has no TS equivalent (the value arrived
+ * through JSON and is representable by construction).
+ *
+ * Watch item (oss#862, ratified DB-3): Go persists the Struct with
+ * SORTED JSON keys while this path keeps the runner's insertion order —
+ * the runner's reconnect signature compares stringified schemas, so
+ * ordering feeds the filed carry-forward defect. The conformance suite
+ * pins only the wire-stable contract (capabilities + gates survive
+ * reconnect), which both orderings satisfy.
+ */
+export function convertToDiscoveredCapabilities(output) {
+    const capabilities = create(DiscoveredCapabilitiesSchema, {
+        lastDiscoveredAt: timestampNow(),
+    });
+    for (const t of output.tools ?? []) {
+        const tool = create(DiscoveredToolSchema, {
+            name: t.name ?? "",
+            description: t.description ?? "",
+        });
+        if (t.input_schema !== undefined) {
+            tool.inputSchema = t.input_schema;
+        }
+        capabilities.tools.push(tool);
+    }
+    for (const rt of output.resource_templates ?? []) {
+        capabilities.resourceTemplates.push(create(DiscoveredResourceTemplateSchema, {
+            uriTemplate: rt.uri_template ?? "",
+            name: rt.name ?? "",
+            description: rt.description ?? "",
+            mimeType: rt.mime_type ?? "",
+        }));
+    }
+    return capabilities;
+}
+/**
+ * Converts the classifier output to the ToolApprovalPolicy list (Go
+ * convertToToolApprovals). Presence in the list means "requires
+ * approval" — there is no boolean on the proto — so any entry explicitly
+ * marked requires_approval=false is dropped. Mirrors the Cloud (Java)
+ * StoreConnectResults converter so both editions persist identical
+ * classifier output.
+ */
+export function convertToToolApprovals(output) {
+    const approvals = [];
+    for (const a of output.tool_approvals ?? []) {
+        if (a.requires_approval !== true || (a.tool_name ?? "") === "") {
+            continue;
+        }
+        approvals.push(create(ToolApprovalPolicySchema, {
+            toolName: a.tool_name,
+            message: a.message ?? "",
+            fromDestructiveHint: a.from_destructive_hint ?? false,
+        }));
+    }
+    return approvals;
+}
+/**
+ * Writes the freshly classified tool approvals onto the status, returning
+ * how many were applied (Go setToolApprovalsFromConnect).
+ *
+ * Overwrite-on-reconnect: a new non-empty result replaces the prior list
+ * so a reclassification takes effect. Preserve-on-empty: an empty result
+ * leaves the existing list untouched, so a degraded or older runner that
+ * returns nothing can never silently disarm previously persisted approval
+ * gates.
+ */
+export function setToolApprovalsFromConnect(status, output) {
+    const approvals = convertToToolApprovals(output);
+    if (approvals.length > 0) {
+        status.toolApprovals = approvals;
+    }
+    return approvals.length;
+}
+/**
+ * Records the terminal phase of a connect operation on the status,
+ * preserving the start-time fields (started_at) the starting lane
+ * recorded (Go settleConnectStatus). failure is the mapped gRPC error for
+ * a failed operation, undefined for success; its code and message land
+ * verbatim on the status so polling clients render the same
+ * classification blocking callers get as an RPC error.
+ *
+ * The start-time warning is cleared either way: it is a CONNECTING-phase
+ * advisory ("no worker appears to be polling"), and a settled operation
+ * has disproven it.
+ */
+export function settleConnectStatus(mcpStatus, workflowId, failure) {
+    let cs = mcpStatus.connectStatus;
+    if (cs === undefined) {
+        // The operation was started by a lane that could not record
+        // CONNECTING (a failed best-effort status write, or a legacy
+        // in-flight run from before this field existed). Settle with what is
+        // known.
+        cs = create(ConnectStatusSchema);
+        mcpStatus.connectStatus = cs;
+    }
+    cs.workflowId = workflowId;
+    cs.finishedAt = timestampNow();
+    cs.warning = "";
+    if (failure === undefined) {
+        cs.phase = ConnectPhase.succeeded;
+        cs.failureCode = "";
+        cs.failureMessage = "";
+        return;
+    }
+    cs.phase = ConnectPhase.failed;
+    cs.failureCode = grpcCodeName(failure.code);
+    cs.failureMessage = failure.rawMessage;
+}
+/**
+ * Writes the connect workflow's output onto the McpServer status as a
+ * single atomic read-modify-write, returning the updated resource and the
+ * number of tool-approval gates applied (Go persistConnectResult).
+ *
+ * This is the one place connect output lands on the resource — the
+ * blocking Connect path, the async StartConnect path, and the best-effort
+ * auto-connect path all route through it. The atomic updateResource is
+ * deliberate: the background writes can land long after the triggering
+ * RPC returned, so a plain read-modify-write would risk clobbering a
+ * concurrent update (a manual reconnect or an edit) made in that window.
+ *
+ * The result fields follow the deliberate Phase-6 asymmetry, unchanged:
+ * discovered_capabilities is a point-in-time snapshot, overwritten on
+ * every connect; tool_approvals are safety-critical gates (see
+ * setToolApprovalsFromConnect). The connect_status settle rides the same
+ * atomic write so pollers can never observe results without the terminal
+ * phase (or vice versa).
+ *
+ * Throws ResourceNotFoundError if the resource was deleted between the
+ * connect trigger and its completion (a real case for the background
+ * paths); callers decide how to react.
+ */
+export async function persistConnectResult(store, mcpServerId, workflowId, output) {
+    let toolApprovalCount = 0;
+    const persisted = await store.updateResource(ApiResourceKind.mcp_server, mcpServerId, McpServerSchema, (mcpServer) => {
+        if (mcpServer.status === undefined) {
+            mcpServer.status = create(McpServerStatusSchema);
+        }
+        mcpServer.status.discoveredCapabilities =
+            convertToDiscoveredCapabilities(output);
+        toolApprovalCount = setToolApprovalsFromConnect(mcpServer.status, output);
+        settleConnectStatus(mcpServer.status, workflowId, undefined);
+    });
+    return { persisted, toolApprovalCount };
+}
+/**
+ * Records a freshly started connect operation as the resource's
+ * connect_status (phase CONNECTING), replacing whatever previous
+ * operation's record was there (Go persistConnectStarting). Returns the
+ * updated resource — the payload StartConnect answers with.
+ */
+export async function persistConnectStarting(store, mcpServerId, workflowId, warning) {
+    return store.updateResource(ApiResourceKind.mcp_server, mcpServerId, McpServerSchema, (mcpServer) => {
+        if (mcpServer.status === undefined) {
+            mcpServer.status = create(McpServerStatusSchema);
+        }
+        mcpServer.status.connectStatus = create(ConnectStatusSchema, {
+            phase: ConnectPhase.connecting,
+            workflowId,
+            startedAt: timestampNow(),
+            warning,
+        });
+    });
+}
+/**
+ * Settles connect_status as FAILED with the mapped gRPC classification of
+ * the given error (Go persistConnectFailure). Never propagates its own
+ * failure: every caller has already surfaced the connect failure on its
+ * own channel (RPC error or log), and a resource deleted mid-operation is
+ * expected.
+ */
+export async function persistConnectFailure(store, logger, mcpServerId, failure) {
+    try {
+        await store.updateResource(ApiResourceKind.mcp_server, mcpServerId, McpServerSchema, (mcpServer) => {
+            if (mcpServer.status === undefined) {
+                mcpServer.status = create(McpServerStatusSchema);
+            }
+            settleConnectStatus(mcpServer.status, mcpServer.status.connectStatus?.workflowId ?? "", failure);
+        });
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            logger.info("Skipping connect failure persistence: MCP server deleted before connect settled", { mcp_server_id: mcpServerId });
+            return;
+        }
+        logger.warn("Failed to record connect failure on connect_status (non-fatal)", {
+            mcp_server_id: mcpServerId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+//# sourceMappingURL=connect-status.js.map

package/dist/domain/mcpserver/connect-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-status.js","sourceRoot":"","sources":["../../../src/domain/mcpserver/connect-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAItD,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AAEzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AAKnG,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,gCAAgC,EAChC,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAA6B;IAE7B,MAAM,YAAY,GAAG,MAAM,CAAC,4BAA4B,EAAE;QACxD,gBAAgB,EAAE,YAAY,EAAE;KACjC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,YAA0B,CAAC;QAClD,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACjD,YAAY,CAAC,iBAAiB,CAAC,IAAI,CACjC,MAAM,CAAC,gCAAgC,EAAE;YACvC,WAAW,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE;YAClC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE;YACnB,WAAW,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE;YACjC,QAAQ,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;SAC7B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA6B;IAE7B,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,wBAAwB,EAAE;YAC/B,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,mBAAmB,EAAE,CAAC,CAAC,qBAAqB,IAAI,KAAK;SACtD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAuB,EACvB,MAA6B;IAE7B,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,UAAkB,EAClB,OAAiC;IAEjC,IAAI,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC;IACjC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,4DAA4D;QAC5D,6DAA6D;QAC7D,qEAAqE;QACrE,SAAS;QACT,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACjC,SAAS,CAAC,aAAa,GAAG,EAAE,CAAC;IAC/B,CAAC;IACD,EAAE,CAAC,UAAU,GAAG,UAAU,CAAC;IAC3B,EAAE,CAAC,UAAU,GAAG,YAAY,EAAE,CAAC;IAC/B,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,EAAE,CAAC,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC;QAClC,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC;QACpB,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,EAAE,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC;IAC/B,EAAE,CAAC,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,EAAE,CAAC,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAY,EACZ,WAAmB,EACnB,UAAkB,EAClB,MAA6B;IAE7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAC1C,eAAe,CAAC,UAAU,EAC1B,WAAW,EACX,eAAe,EACf,CAAC,SAAS,EAAE,EAAE;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,sBAAsB;YACrC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC1C,iBAAiB,GAAG,2BAA2B,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1E,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC,CACF,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,WAAmB,EACnB,UAAkB,EAClB,OAAe;IAEf,OAAO,KAAK,CAAC,cAAc,CACzB,eAAe,CAAC,UAAU,EAC1B,WAAW,EACX,eAAe,EACf,CAAC,SAAS,EAAE,EAAE;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,mBAAmB,EAAE;YAC3D,KAAK,EAAE,YAAY,CAAC,UAAU;YAC9B,UAAU;YACV,SAAS,EAAE,YAAY,EAAE;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAY,EACZ,MAAc,EACd,WAAmB,EACnB,OAAqB;IAErB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,cAAc,CACxB,eAAe,CAAC,UAAU,EAC1B,WAAW,EACX,eAAe,EACf,CAAC,SAAS,EAAE,EAAE;YACZ,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACnD,CAAC;YACD,mBAAmB,CACjB,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,IAAI,EAAE,EAChD,OAAO,CACR,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACT,iFAAiF,EACjF,EAAE,aAAa,EAAE,WAAW,EAAE,CAC/B,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CACT,gEAAgE,EAChE;YACE,aAAa,EAAE,WAAW;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}