@xopcai/xopc 0.0.126 → 0.0.128

package/dist/src/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","names":[],"sources":["../../../src/config/schema.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport {\n  AgentConfigEntrySchema,\n  CapabilityPresetSchema,\n  DEFAULT_CAPABILITY_PRESET_ID,\n} from '../agent-manifest/schema.js';\nimport { checkCacheDir } from '../browser/cache-dir-policy.js';\nimport { DEFAULT_AGENT_MODELS } from './default-model.js';\nimport { validatePublicUrl } from './public-url.js';\n\n// ============================================\n// Agent Configs\n// ============================================\n\n/**\n * Agent model ref. Always an object with explicit `primary` and optional\n * `fallbacks` chain. No string-form shorthand — every write site builds the\n * object explicitly so reads never branch on shape.\n */\nexport const AgentModelRefSchema = z\n  .object({\n    primary: z.string().min(1),\n    fallbacks: z.array(z.string()).optional(),\n  })\n  .strict();\n\nexport type AgentModelConfig = z.infer<typeof AgentModelRefSchema>;\n\n/**\n * Image-generation model ref. {@link AgentModelRefSchema} plus runtime knobs\n * (`timeoutMs`, `autoProviderFallback`) used by the image-generation runtime.\n */\nexport const AgentImageGenerationModelSchema = z\n  .object({\n    primary: z.string().min(1),\n    fallbacks: z.array(z.string()).optional(),\n    /** Hard cap for the whole generation attempt (ms). */\n    timeoutMs: z.number().int().positive().optional(),\n    /**\n     * When all `primary + fallbacks` candidates fail, sweep every other\n     * configured provider before giving up.\n     */\n    autoProviderFallback: z.boolean().optional(),\n  })\n  .strict();\n\nexport type AgentImageGenerationModelConfig = z.infer<typeof AgentImageGenerationModelSchema>;\n\nexport const AgentTypedModelRoleSchema = z\n  .object({\n    description: z.string().max(500).optional(),\n    model: z.string().min(1),\n    fallbacks: z.array(z.string().min(1)).optional(),\n  })\n  .strict()\n  .superRefine((entry, ctx) => {\n    const validateRef = (ref: string) => {\n      const trimmed = ref.trim();\n      const idx = trimmed.indexOf('/');\n      return idx > 0 && idx < trimmed.length - 1;\n    };\n    if (!validateRef(entry.model)) {\n      ctx.addIssue({\n        code: 'custom',\n        message: `model must be provider/model format (got '${entry.model}')`,\n        path: ['model'],\n      });\n    }\n    for (const [index, fallback] of (entry.fallbacks ?? []).entries()) {\n      if (!validateRef(fallback)) {\n        ctx.addIssue({\n          code: 'custom',\n          message: `fallback must be provider/model format (got '${fallback}')`,\n          path: ['fallbacks', index],\n        });\n      }\n    }\n  });\n\nexport type AgentTypedModelRole = z.infer<typeof AgentTypedModelRoleSchema>;\n\nconst AgentTypedModelRolesSchema = z\n  .record(z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), AgentTypedModelRoleSchema)\n  .optional();\n\nexport const AgentModelsSchema = z\n  .object({\n    defaultRole: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),\n    roles: AgentTypedModelRolesSchema,\n    imageModel: AgentModelRefSchema.optional(),\n    imageGenerationModel: AgentImageGenerationModelSchema.optional(),\n  })\n  .strict()\n  .optional();\n\nexport type AgentModelsConfig = z.infer<typeof AgentModelsSchema>;\n\nexport type AgentTypedModel = AgentTypedModelRole & { id: string };\n\nexport const AgentsConfigSchema = z.object({\n  /** Default agent id when not specified (routing / session creation). */\n  default: z.string().optional(),\n  /** Protected global defaults preset applied before each agent's own presets. */\n  defaultPreset: z.string().default(DEFAULT_CAPABILITY_PRESET_ID),\n  capabilityPresets: z.record(z.string(), CapabilityPresetSchema).default({}),\n  list: z.array(AgentConfigEntrySchema).default([]),\n}).strict().default({\n  default: 'main',\n  defaultPreset: DEFAULT_CAPABILITY_PRESET_ID,\n  capabilityPresets: {\n    [DEFAULT_CAPABILITY_PRESET_ID]: {\n      id: DEFAULT_CAPABILITY_PRESET_ID,\n      name: 'Global defaults',\n      description: 'Default capabilities inherited by every agent.',\n      version: 1,\n      models: DEFAULT_AGENT_MODELS,\n    },\n  },\n  list: [\n    {\n      id: 'main',\n      enabled: true,\n      identity: {\n        name: 'Main',\n        role: 'General assistant',\n        language: 'en',\n        tone: 'direct',\n      },\n      responsibilities: {\n        primary: ['Help the user complete tasks'],\n      },\n      workspace: { root: '~/.xopc/workspace/main' },\n      tools: { builtin: {} },\n      skills: { mode: 'all' },\n      memory: {\n        mode: 'confirmWrite',\n        sources: ['session', 'curated'],\n        writePolicy: { curated: 'confirm' },\n      },\n      workflows: {},\n      boundaries: { requiresConfirmation: [], forbidden: [], escalation: [] },\n    },\n  ],\n});\n\nconst BrowserCloudConfigSchema = z\n  .object({\n    apiKey: z.string().optional(),\n    projectId: z.string().optional(),\n    region: z.string().optional(),\n  })\n  .strict()\n  .optional();\n\nconst BrowserExtensionConfigSchema = z\n  .object({\n    port: z.number().int().min(1024).max(65535).optional(),\n    host: z.string().min(1).optional(),\n    connectionTimeout: z.number().int().positive().optional(),\n  })\n  .strict()\n  .optional();\n\nconst BrowserCloakConfigSchema = z\n  .object({\n    keepOpen: z.boolean().optional(),\n    temporaryProfile: z.boolean().optional(),\n    cacheDir: z.string().optional().superRefine((value, ctx) => {\n      const result = checkCacheDir(value);\n      if (result.ok === false) {\n        ctx.addIssue({ code: 'custom', message: result.message });\n      }\n    }),\n    binaryPath: z.string().optional(),\n    timezone: z.string().optional(),\n    locale: z.string().optional(),\n    webrtcIp: z.string().optional(),\n    fingerprintPlatform: z.string().optional(),\n    extraArgs: z.array(z.string()).optional(),\n  })\n  .strict()\n  .optional();\n\nexport const BrowserConfigSchema = z\n  .object({\n    enabled: z.boolean().default(true),\n    backend: z.enum(['local', 'cdp', 'cloud', 'extension', 'cloakbrowser']).default('extension'),\n    headless: z.boolean().optional(),\n    allowPrivateUrls: z.boolean().optional(),\n    commandTimeout: z.number().int().min(5).max(900).optional(),\n    cloudProvider: z.enum(['local', 'browserbase', 'browser-use']).optional(),\n    cloud: BrowserCloudConfigSchema,\n    cdpUrl: z.string().optional(),\n    extension: BrowserExtensionConfigSchema,\n    cloakbrowser: BrowserCloakConfigSchema,\n    humanize: z.boolean().optional(),\n    humanPreset: z.enum(['default', 'careful']).optional(),\n    dialogPolicy: z.enum(['must_respond', 'auto_dismiss', 'auto_accept']).optional(),\n    dialogTimeoutSeconds: z.number().int().positive().optional(),\n  })\n  .strict()\n  .default({ enabled: true, backend: 'extension' });\n\n// ============================================\n// Channel Configs (per-channel Zod lives in bundled extensions; root schema is open)\n// ============================================\n\nexport {\n  TelegramTopicConfigSchema,\n  TelegramGroupConfigSchema,\n  TelegramAccountConfigSchema,\n  TelegramConfigSchema,\n} from '../../extensions/telegram/src/config-schema.js';\nexport type { TelegramConfig } from '../../extensions/telegram/src/config-schema.js';\nexport { WeixinAccountConfigSchema, WeixinConfigSchema } from '../../extensions/weixin/src/config-schema.js';\nexport type { WeixinConfig } from '../../extensions/weixin/src/config-schema.js';\n// ============================================\n// Session Routing Configuration\n// ============================================\n\nexport const BindingMatchSchema = z.object({\n  channel: z.string(),\n  accountId: z.string().optional(),\n  peerKind: z.string().optional(),\n  peerId: z.string().optional(),\n  guildId: z.string().optional(),\n  teamId: z.string().optional(),\n  memberRoleIds: z.array(z.string()).optional(),\n});\n\nexport const BindingRuleSchema = z.object({\n  id: z.string().optional(),\n  agentId: z.string(),\n  priority: z.number().default(100),\n  match: BindingMatchSchema,\n  enabled: z.boolean().default(true),\n});\n\nexport const BindingsConfigSchema = z.array(BindingRuleSchema).default([]);\n\nexport const SessionDmScopeSchema = z.enum([\n  'main',\n  'per-peer',\n  'per-channel-peer',\n  'per-account-channel-peer',\n]);\n\nexport const SessionStorageConfigSchema = z.object({\n  pruneAfterMs: z.number().optional(),\n  maxEntries: z.number().optional(),\n});\n\nexport const SessionResetModeSchema = z.enum(['daily', 'idle']);\n\nexport const SessionResetConfigSchema = z\n  .object({\n    mode: SessionResetModeSchema.optional(),\n    /** Local hour (0–23) for the daily reset boundary. */\n    atHour: z.number().int().min(0).max(23).optional(),\n    /** Sliding idle window (minutes). When set with daily mode, whichever expires first wins. */\n    idleMinutes: z.number().int().min(0).optional(),\n  })\n  .strict();\n\nexport const SessionResetByTypeSchema = z\n  .object({\n    direct: SessionResetConfigSchema.optional(),\n    group: SessionResetConfigSchema.optional(),\n    thread: SessionResetConfigSchema.optional(),\n  })\n  .strict();\n\nexport const SessionScopeSchema = z.enum(['per-sender', 'global']);\n\nexport const SessionConfigSchema = z.object({\n  scope: SessionScopeSchema.default('per-sender'),\n  mainKey: z.string().default('main'),\n  dmScope: SessionDmScopeSchema.default('main'),\n  identityLinks: z.record(z.string(), z.array(z.string())).optional(),\n  resetTriggers: z.array(z.string()).optional(),\n  idleMinutes: z.number().int().positive().optional(),\n  reset: SessionResetConfigSchema.optional(),\n  resetByType: SessionResetByTypeSchema.optional(),\n  resetByChannel: z.record(z.string(), SessionResetConfigSchema).optional(),\n  storage: SessionStorageConfigSchema.optional(),\n}).default({\n  scope: 'per-sender',\n  mainKey: 'main',\n  dmScope: 'main',\n});\n\n/** Channel buckets — shapes validated post-parse by registered channel plugins. */\nexport const ChannelsConfigSchema = z.record(z.string(), z.unknown()).default({});\n\nexport const SearchProviderEntrySchema = z.object({\n  type: z.enum(['brave', 'tavily', 'bing', 'searxng']),\n  apiKey: z.string().optional(),\n  /** SearXNG instance base URL (e.g. http://localhost:8080) */\n  url: z.string().optional(),\n  disabled: z.boolean().optional(),\n});\n\nexport type SearchProviderEntry = z.infer<typeof SearchProviderEntrySchema>;\n\nexport const WebSearchConfigSchema = z.object({\n  maxResults: z.number().default(5),\n  /** Ordered API providers; empty → HTML fallback only */\n  providers: z.array(SearchProviderEntrySchema).default([]),\n});\n\nexport type WebSearchConfig = z.infer<typeof WebSearchConfigSchema>;\n\nexport const WebsiteBlocklistSchema = z.object({\n  /** Master switch. Default false (no blocking). */\n  enabled: z.boolean().default(false),\n  /** Domain patterns to block (e.g. \"example.com\", \"*.evil.org\"). */\n  domains: z.array(z.string()).default([]),\n});\n\nexport type WebsiteBlocklistConfig = z.infer<typeof WebsiteBlocklistSchema>;\n\nexport const WebToolsConfigSchema = z.object({\n  /** Search result HTML fallback: cn → Bing, otherwise DuckDuckGo */\n  region: z.enum(['cn', 'global']).optional(),\n  search: WebSearchConfigSchema.optional(),\n  /** Domain blocklist for web_fetch / web_extract / browser tools. */\n  blocklist: WebsiteBlocklistSchema.optional(),\n});\n\nexport type WebToolsConfig = z.infer<typeof WebToolsConfigSchema>;\n\nexport const ToolsConfigSchema = z.object({\n  web: WebToolsConfigSchema.optional(),\n  /**\n   * Per-capability media providers. Currently only `audio` (STT) is wired;\n   * `image` / `video` slots are reserved for future capabilities.\n   */\n  media: z.lazy(() => ToolsMediaConfigSchema),\n}).default({\n  web: {\n    search: {\n      maxResults: 5,\n      providers: [],\n    },\n  },\n});\n\n// ============================================\n// Gateway Configuration\n// ============================================\n\nexport const GatewayAuthRateLimitSchema = z\n  .object({\n    enabled: z.boolean().default(true),\n    maxAttempts: z.number().int().min(1).default(5),\n    windowMs: z.number().default(900_000),\n    blockDurationMs: z.number().default(300_000),\n    /** OpenClaw alias for blockDurationMs. */\n    lockoutMs: z.number().optional(),\n    /** Skip rate limiting for loopback client IPs (default true). Remote browser Origin requests never exempt. */\n    exemptLoopback: z.boolean().default(true),\n    /**\n     * Coalesce same-client failures arriving within this window into a single\n     * attempt. Absorbs SPA fan-out / SDK auto-retry storms without weakening\n     * brute-force protection (deliberate attackers are still rate-limited to\n     * one effective attempt per window). Set to 0 to disable.\n     */\n    burstCoalesceMs: z.number().int().min(0).default(1000),\n  })\n  .optional();\n\nexport const GatewaySecuritySchema = z\n  .object({\n    /** When true, non-loopback binds require explicit gateway.auth.rateLimit configuration. */\n    strict: z.boolean().optional(),\n  })\n  .optional();\n\nexport const GatewayTrustedProxySchema = z\n  .object({\n    /** Header set by the reverse proxy with the authenticated user identity. */\n    userHeader: z.string().min(1),\n    /** Additional headers that must be present (e.g. proxy auth markers). */\n    requiredHeaders: z.array(z.string()).optional(),\n    /** When non-empty, only these user identities are allowed. */\n    allowUsers: z.array(z.string()).optional(),\n    /** Allow trusted-proxy auth when the TCP source is loopback (same-host reverse proxy). */\n    allowLoopback: z.boolean().optional(),\n  })\n  .strict();\n\nexport const GatewayAuthSchema = z\n  .object({\n    mode: z.enum(['none', 'token', 'password', 'trusted-proxy']).default('token'),\n    token: z.string().optional(),\n    password: z.string().optional(),\n    /** When true (default for Serve), browser UI may auth via Tailscale identity headers. API routes still require token. */\n    allowTailscale: z.boolean().optional(),\n    rateLimit: GatewayAuthRateLimitSchema,\n    trustedProxy: GatewayTrustedProxySchema.optional(),\n  })\n  .default({\n    mode: 'token',\n  });\n\nexport const GatewayTailscaleConsentSchema = z.object({\n  version: z.string().min(1),\n  acceptedAt: z.string().min(1),\n});\n\nexport const GatewayTailscaleSchema = z\n  .object({\n    mode: z.enum(['off', 'serve', 'funnel']).default('off'),\n    resetOnExit: z.boolean().default(true),\n    consent: GatewayTailscaleConsentSchema.optional(),\n  })\n  .default({\n    mode: 'off',\n    resetOnExit: true,\n  });\n\nexport const GatewayRemoteSchema = z.object({\n  url: z.string().url(),\n  token: z.string().optional(),\n  password: z.string().optional(),\n  transport: z.enum(['direct', 'ssh']).default('direct'),\n  sshTarget: z.string().optional(),\n  sshIdentity: z.string().optional(),\n  tlsFingerprint: z.string().optional(),\n});\n\nexport const GatewayTlsSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    autoGenerate: z.boolean().default(false),\n    certPath: z.string().optional(),\n    keyPath: z.string().optional(),\n  })\n  .default({\n    enabled: false,\n    autoGenerate: false,\n  });\n\nexport const GatewayModeSchema = z.enum(['local', 'remote']).default('local');\n\nexport const HeartbeatConfigSchema = z\n  .object({\n    enabled: z.boolean(),\n    intervalMs: z.number(),\n    /** When false, heartbeat instructions are only sent during heartbeat polling turns (not in every chat system prompt). */\n    includeSystemPromptSection: z.boolean().optional().default(false),\n    target: z.string().optional(),\n    targetChatId: z.string().optional(),\n    prompt: z.string().optional(),\n    ackMaxChars: z.number().optional(),\n    isolatedSession: z.boolean().optional(),\n    activeHours: z\n      .object({\n        start: z.string(),\n        end: z.string(),\n        timezone: z.string().optional(),\n      })\n      .optional(),\n  })\n  .default({\n    enabled: true,\n    intervalMs: 1_800_000,\n    includeSystemPromptSection: false,\n  });\n\nexport const GatewayChannelConnectDeferModeSchema = z.enum(['auto', 'off', 'explicit']);\n\nexport const TunnelConsentSchema = z.object({\n  version: z.string().min(1),\n  acceptedAt: z.string().min(1),\n});\n\nexport const TunnelConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    brokerUrl: z.string().url().default('https://frp.xopc.ai/api'),\n    /** Broker register API secret (env `XOPC_TUNNEL_REGISTRATION_SECRET` overrides when set). */\n    registrationSecret: z.string().min(1).optional(),\n    autoStart: z.boolean().default(false),\n    subdomain: z.string().optional(),\n    consent: TunnelConsentSchema.optional(),\n  })\n  .default({\n    enabled: false,\n    brokerUrl: 'https://frp.xopc.ai/api',\n    autoStart: false,\n  });\n\nexport type TunnelConfig = z.infer<typeof TunnelConfigSchema>;\n\n/**\n * Workspace-scoped concerns (file import, etc.). Distinct from\n * agent manifest workspace roots; this block carries\n * feature configuration for workspace-related routes.\n */\nexport const WorkspaceImportConfigSchema = z.object({\n  /** Workspace-relative subdir for imported files. Default `imports`. */\n  targetDir: z.string().default('imports'),\n  /** Per-file byte cap. Default 100 MiB. */\n  maxBytes: z.number().int().min(1024).max(10_737_418_240).default(104_857_600),\n  /** When false, the route rejects `onConflict: 'overwrite'`. Default true. */\n  allowOverwrite: z.boolean().default(true),\n});\nexport type WorkspaceImportConfig = z.infer<typeof WorkspaceImportConfigSchema>;\n\nexport const WorkspaceConfigSchema = z.object({\n  import: WorkspaceImportConfigSchema.optional(),\n}).optional();\nexport type WorkspaceConfig = z.infer<typeof WorkspaceConfigSchema>;\n\nexport const GatewayBindModeSchema = z.enum(['auto', 'loopback', 'lan', 'tailnet', 'custom']);\n\nexport const GatewayConfigSchema = z.object({\n  /** Semantic bind mode. */\n  bind: GatewayBindModeSchema.optional(),\n  /** IPv4 listen address when `bind` is `custom`. */\n  customBindHost: z.string().optional(),\n  port: z.number().optional(),\n  /** local: this process runs the gateway; remote: CLI clients target gateway.remote. */\n  mode: GatewayModeSchema.optional(),\n  /** Persistent remote gateway target for CLI/TUI/MCP when mode=remote. */\n  remote: GatewayRemoteSchema.optional(),\n  tailscale: GatewayTailscaleSchema.optional(),\n  tls: GatewayTlsSchema.optional(),\n  auth: GatewayAuthSchema.optional(),\n  heartbeat: HeartbeatConfigSchema.optional(),\n  maxSseConnections: z.number().optional(),\n  corsOrigins: z.array(z.string()).optional(),\n  /**\n   * Reverse-proxy publicly reachable URL (e.g. `https://gateway.example.com`).\n   * Optional. When set, mobile pairing surfaces this URL as the preferred\n   * baseUrl and it is auto-added to the browser CORS/CSRF allowlist.\n   * - Must be a URL with no path / query / userinfo.\n   * - Must use `https:` for public hosts; `http:` is only allowed when the\n   *   hostname is in an RFC1918 / `.local` private range.\n   */\n  publicUrl: z\n    .string()\n    .superRefine((value, ctx) => {\n      const result = validatePublicUrl(value);\n      if (result.ok === false) {\n        ctx.addIssue({ code: 'custom', message: `gateway.publicUrl: ${result.message}` });\n      }\n    })\n    .optional(),\n  /** Dangerous: allow browser Origin to match the HTTP Host header when not in corsOrigins. */\n  dangerouslyAllowHostHeaderOriginFallback: z.boolean().optional(),\n  /** CIDRs or exact IPs of reverse proxies allowed to terminate auth (trusted-proxy mode). */\n  trustedProxies: z.array(z.string()).optional(),\n  /** When true, fall back to X-Real-IP if X-Forwarded-For chain parsing fails. Default false (fail closed). */\n  allowRealIpFallback: z.boolean().optional(),\n  security: GatewaySecuritySchema,\n  /**\n   * How channel `start()` is split around HTTP listen when using `GatewayServer`.\n   * - `auto` (default): defer ids come from channel plugin `meta.deferConnectUntilAfterListen` + enabled config.\n   * - `off`: always start all channels in phase1 (troubleshooting / strict ordering).\n   * - `explicit`: defer only `channelConnectDeferIds` (empty = defer none).\n   */\n  channelConnectDeferMode: GatewayChannelConnectDeferModeSchema.optional(),\n  /** When `channelConnectDeferMode` is `explicit`, these channel plugin ids are deferred until after listen. */\n  channelConnectDeferIds: z.array(z.string().min(1)).max(24).optional(),\n  /** Removed from the defer set (applied after `auto` or `explicit` resolution). */\n  channelConnectDeferSkipIds: z.array(z.string().min(1)).max(24).optional(),\n  /** Default skills marketplace provider id. Built-in: 'store', 'skillhub', 'clawhub'. Extensions may register more. */\n  skillsMarketplaceProvider: z.string().optional(),\n  /** Base URL for the xopc skills marketplace (public REST API). */\n  skillsStoreBaseUrl: z.string().url().optional(),\n  /** File sharing configuration (temporary public download links for workspace files). */\n  share: z.object({\n    enabled: z.boolean().default(true),\n    /** Default TTL in ms (default 24h). */\n    defaultTtlMs: z.number().min(60_000).max(604_800_000).default(86_400_000),\n    /** Maximum TTL in ms (default 7 days). */\n    maxTtlMs: z.number().min(60_000).max(2_592_000_000).default(604_800_000),\n    /** Maximum concurrent active shares (default 100). */\n    maxActiveShares: z.number().min(1).max(10_000).default(100),\n    /** Maximum shareable file size in bytes (default 100MB). */\n    maxFileSize: z.number().min(1_048_576).max(10_737_418_240).default(104_857_600),\n    /** MIME types allowed for inline preview (?inline=1). */\n    inlinePreviewMimes: z.array(z.string()).default([\n      'image/png',\n      'image/jpeg',\n      'image/gif',\n      'image/webp',\n      'image/svg+xml',\n      'application/pdf',\n      'text/html',\n      'text/markdown',\n      'text/plain',\n      'application/json',\n    ]),\n    /** Folder-sharing controls (browse + ZIP). */\n    directory: z.object({\n      enabled: z.boolean().default(true),\n      /** Maximum folder size in bytes at scan time (default 1 GB). */\n      maxFolderSize: z.number().int().min(1_048_576).max(10_737_418_240).default(1_073_741_824),\n      /** Maximum number of entries scanned for a single folder share. */\n      maxFileCount: z.number().int().min(1).max(100_000).default(1_000),\n      /** Traversal depth cap (defense against recursive symlinks). */\n      maxDepth: z.number().int().min(1).max(64).default(20),\n      /** In-memory directory listing cache TTL. */\n      listingCacheMs: z.number().int().min(0).max(600_000).default(60_000),\n      /** Maximum simultaneous ZIP streams per share token. */\n      zipConcurrency: z.number().int().min(1).max(8).default(1),\n    }).default({\n      enabled: true,\n      maxFolderSize: 1_073_741_824,\n      maxFileCount: 1_000,\n      maxDepth: 20,\n      listingCacheMs: 60_000,\n      zipConcurrency: 1,\n    }),\n  }).optional(),\n  /** Site-share configuration (static directory or reverse-proxy a local dev server). */\n  siteShare: z.object({\n    enabled: z.boolean().default(true),\n    /** Public host suffix that subdomain shares are served under. */\n    publicHostSuffix: z.string().min(1).default('share.xopc.ai'),\n    /** Default TTL in ms (default 6h, shorter than file shares — live app surface). */\n    defaultTtlMs: z.number().int().min(60_000).max(604_800_000).default(21_600_000),\n    /** Maximum TTL in ms (default 7 days). */\n    maxTtlMs: z.number().int().min(60_000).max(2_592_000_000).default(604_800_000),\n    /** Maximum concurrent active site shares. */\n    maxActiveSites: z.number().int().min(1).max(1_000).default(5),\n    static: z.object({\n      enabled: z.boolean().default(true),\n      /** Maximum total bytes of files served per static site. */\n      maxRootDirSize: z.number().int().min(1_048_576).max(10_737_418_240).default(524_288_000),\n      /** Maximum file count under root dir. */\n      maxFileCount: z.number().int().min(1).max(100_000).default(10_000),\n      /** Whether HTML/CSS rewrite of absolute paths is on by default. */\n      rewriteEnabledByDefault: z.boolean().default(false),\n    }).default({\n      enabled: true,\n      maxRootDirSize: 524_288_000,\n      maxFileCount: 10_000,\n      rewriteEnabledByDefault: false,\n    }),\n    proxy: z.object({\n      /** Reverse-proxy mode default-enabled per the product brief. */\n      enabled: z.boolean().default(true),\n      /** Upstream host whitelist. Loopback by default. */\n      allowedUpstreamHosts: z\n        .array(z.string().min(1))\n        .default(['127.0.0.1', 'localhost', '::1']),\n      /** Upstream port whitelist (common dev-server ports). */\n      allowedUpstreamPorts: z\n        .array(z.number().int().min(1).max(65535))\n        .default([3000, 3001, 4321, 5173, 8000, 8080, 8888, 9000]),\n      /** Whether to forward WebSocket upgrades. */\n      forwardWebSocket: z.boolean().default(true),\n      /** Maximum request body size in bytes (50 MB). */\n      bodySizeLimit: z.number().int().min(0).max(1_073_741_824).default(52_428_800),\n      /** Per-request HTTP timeout in ms. */\n      requestTimeoutMs: z.number().int().min(1_000).max(600_000).default(30_000),\n      /** Per-WebSocket idle timeout in ms. */\n      wsIdleTimeoutMs: z.number().int().min(10_000).max(3_600_000).default(300_000),\n      /** Rewrite Set-Cookie Path attribute (subpath mode only). */\n      rewriteSetCookiePath: z.boolean().default(true),\n    }).default({\n      enabled: true,\n      allowedUpstreamHosts: ['127.0.0.1', 'localhost', '::1'],\n      allowedUpstreamPorts: [3000, 3001, 4321, 5173, 8000, 8080, 8888, 9000],\n      forwardWebSocket: true,\n      bodySizeLimit: 52_428_800,\n      requestTimeoutMs: 30_000,\n      wsIdleTimeoutMs: 300_000,\n      rewriteSetCookiePath: true,\n    }),\n  }).optional(),\n}).default({\n  bind: 'loopback',\n  port: 18790,\n  auth: {\n    mode: 'token',\n  },\n  heartbeat: {\n    enabled: true,\n    intervalMs: 1_800_000,\n    includeSystemPromptSection: false,\n  },\n  maxSseConnections: 100,\n  corsOrigins: [],\n  skillsMarketplaceProvider: 'skillhub',\n  skillsStoreBaseUrl: 'https://store.xopc.ai',\n});\n\nexport const ModelsDevConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n}).default({\n  enabled: true,\n});\n\n// ============================================\n// STT (Speech-to-Text) Config\n// ============================================\n\nconst SttProviderConfigCatchallSchema = z.union([\n  z.string(),\n  z.number(),\n  z.boolean(),\n  z.null(),\n  z.array(z.unknown()),\n  z.record(z.string(), z.unknown()),\n]);\n\nexport const STTProviderConfigSchema = z\n  .object({\n    apiKey: z.string().optional(),\n    model: z.string().optional(),\n    baseUrl: z.string().optional(),\n    headers: z.record(z.string(), z.string()).optional(),\n    language: z.string().optional(),\n    prompt: z.string().optional(),\n  })\n  .catchall(SttProviderConfigCatchallSchema);\n\nexport const STTFallbackConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  order: z.array(z.string().min(1)).default(['alibaba', 'openai']),\n});\n\nexport const MediaUnderstandingCapabilitiesSchema = z\n  .array(z.enum(['image', 'audio', 'video']))\n  .optional();\n\nexport const MediaUnderstandingModelSchema = z\n  .object({\n    provider: z.string().optional(),\n    model: z.string().optional(),\n    capabilities: MediaUnderstandingCapabilitiesSchema,\n    type: z.union([z.literal('provider'), z.literal('cli')]).optional(),\n    command: z.string().optional(),\n    baseUrl: z.string().optional(),\n    headers: z.record(z.string(), z.string()).optional(),\n    apiKey: z.string().optional(),\n    language: z.string().optional(),\n    prompt: z.string().optional(),\n  })\n  .catchall(SttProviderConfigCatchallSchema);\n\nexport const STTConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    /** Primary provider id — any registered MediaUnderstandingProvider id. */\n    provider: z.string().min(1).default('alibaba'),\n    fallback: STTFallbackConfigSchema.optional(),\n    timeoutMs: z.number().int().min(1000).max(180000).optional(),\n    /** Ordered model entries for this capability (OpenClaw `tools.media.audio.models`). */\n    models: z.array(MediaUnderstandingModelSchema).optional(),\n    /** Provider settings map keyed by provider id. */\n    providers: z.record(z.string(), STTProviderConfigSchema).optional(),\n  })\n  .strict();\n\n// ============================================\n// TTS (Text-to-Speech) Config\n// ============================================\n\nconst TtsProviderConfigCatchallSchema = z.union([\n  z.string(),\n  z.number(),\n  z.boolean(),\n  z.null(),\n  z.array(z.unknown()),\n  z.record(z.string(), z.unknown()),\n]);\n\nexport const TTSProviderConfigSchema = z\n  .object({\n    apiKey: z.string().optional(),\n    model: z.string().optional(),\n    voice: z.string().optional(),\n  })\n  .catchall(TtsProviderConfigCatchallSchema);\n\nexport const TTSFallbackConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  order: z\n    .array(z.string().min(1))\n    .default(['openai', 'alibaba', 'minimax', 'edge']),\n});\n\nexport const TTSModelOverridesConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  allowText: z.boolean().default(true),\n  allowProvider: z.boolean().default(false),\n  allowVoice: z.boolean().default(true),\n  allowModelId: z.boolean().default(true),\n  allowVoiceSettings: z.boolean().default(false),\n  allowNormalization: z.boolean().default(false),\n  allowSeed: z.boolean().default(false),\n});\n\nexport const TTSEdgeConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  voice: z.string().optional(),\n  lang: z.string().optional(),\n  outputFormat: z.string().optional(),\n  pitch: z.string().optional(),\n  rate: z.string().optional(),\n  volume: z.string().optional(),\n  proxy: z.string().optional(),\n  timeoutMs: z.number().int().min(1000).max(120000).optional(),\n});\n\nexport const TTSSummarizationConfigSchema = z.object({\n  enabled: z.boolean().optional(),\n  targetLength: z.number().int().min(1).optional(),\n  threshold: z.number().int().min(1).optional(),\n  model: z.string().optional(),\n});\n\nexport const TTSConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    /** Primary provider id — any registered SpeechProviderPlugin id. */\n    provider: z.string().min(1).default('edge'),\n    trigger: z.enum(['off', 'always', 'inbound', 'tagged']).default('always'),\n    fallback: TTSFallbackConfigSchema.optional(),\n    maxTextLength: z.number().int().min(1).default(512), // Conservative default to accommodate all providers (Alibaba limit is 512)\n    timeoutMs: z.number().int().min(1000).max(180000).default(60000),\n    summarization: TTSSummarizationConfigSchema.optional(),\n    modelOverrides: TTSModelOverridesConfigSchema.optional(),\n    /** Provider settings map keyed by provider id. */\n    providers: z.record(z.string(), TTSProviderConfigSchema).optional(),\n  })\n  .strict();\n\n// ============================================\n// messages.* — delivery / presentation concerns\n// ============================================\n\nexport const MessagesConfigSchema = z.object({\n  /** Voice (text-to-speech) output configuration. */\n  tts: TTSConfigSchema.optional(),\n}).optional();\n\nexport const ToolsMediaAudioConfigSchema = STTConfigSchema;\n\nexport const ToolsMediaConfigSchema = z\n  .object({\n    /** Shared model entries applied across media capabilities when entry lacks capabilities. */\n    models: z.array(MediaUnderstandingModelSchema).optional(),\n    /** Audio (speech-to-text) capability provider config. */\n    audio: ToolsMediaAudioConfigSchema.optional(),\n  })\n  .optional();\n\n// ============================================\n// Provider Configs (capability providers: image / audio / video)\n// ============================================\n\n/**\n * Optional Azure OpenAI overrides used when an OpenAI image-generation\n * request should hit an Azure deployment instead of `api.openai.com`.\n *\n * URL template (when present):\n *   `https://<resource>.openai.azure.com/openai/deployments/<deployment>/images/generations?api-version=<apiVersion>`\n */\nexport const ProviderAzureConfigSchema = z\n  .object({\n    /** Azure resource name (subdomain before `.openai.azure.com`). */\n    resource: z.string().min(1).optional(),\n    /** Azure deployment id (configured per model). */\n    deployment: z.string().min(1).optional(),\n    /** Azure REST API version, e.g. `2024-08-01-preview`. */\n    apiVersion: z.string().min(1).optional(),\n  })\n  .strict();\n\n/** Per-vendor request overrides applied by the provider HTTP layer. */\nexport const ProviderRequestOverridesSchema = z\n  .object({\n    /** Hard cap for a single HTTP call (ms). */\n    timeoutMs: z.number().int().positive().optional(),\n    /** Extra headers merged into every outbound request. */\n    headers: z.record(z.string(), z.string()).optional(),\n  })\n  .strict();\n\n/**\n * Generic per-vendor provider config — used by image / audio / video\n * capability providers via `cfg.providers.<id>`. Kept loose (`.strict()` but\n * everything optional) so adding a new vendor never requires a config\n * migration.\n */\nexport const ProviderAuthConfigSchema = z\n  .object({\n    /** Static API key (api-key / azure-key modes). */\n    apiKey: z.string().optional(),\n    /** Override the default REST base URL. */\n    baseUrl: z.string().url().optional(),\n    /** Vendor region (DashScope: `beijing` / `singapore`; AWS: region id). */\n    region: z.string().optional(),\n    /** Image-only base URL override (DashScope splits image vs LLM). */\n    imageBaseUrl: z.string().url().optional(),\n    /** Per-vendor request overrides. */\n    request: ProviderRequestOverridesSchema.optional(),\n    /** Azure OpenAI deployment overrides; only consumed by OpenAI image provider. */\n    azure: ProviderAzureConfigSchema.optional(),\n  })\n  .strict();\n\nexport type ProviderAuthConfig = z.infer<typeof ProviderAuthConfigSchema>;\n\n/**\n * `cfg.providers.<id>` is keyed by provider id (`openai`, `dashscope`,\n * `minimax`, `google`, `fal`, …). Every entry is optional and validated by\n * {@link ProviderAuthConfigSchema}.\n */\nexport const ProvidersConfigSchema = z.record(z.string(), ProviderAuthConfigSchema);\n\nexport type ProvidersConfig = z.infer<typeof ProvidersConfigSchema>;\n\n// ============================================\n// Extension Configs \n// ============================================\n\n// Security config for extensions \nexport const ExtensionSecurityConfigSchema = z.object({\n  checkPermissions: z.boolean().default(true),\n  allowUntrusted: z.boolean().default(false),\n  allow: z.array(z.string()).default([]),\n  trackProvenance: z.boolean().default(true),\n  allowPromptInjection: z.boolean().default(false),\n});\n\n// Slot config for extensions \nexport const ExtensionSlotsConfigSchema = z.object({\n  memory: z.string().optional(),\n  tts: z.string().optional(),\n  imageGeneration: z.string().optional(),\n  webSearch: z.string().optional(),\n});\n\n// Complete extensions config\n// Extension config allows both known fields AND arbitrary extension-specific config\n// Known fields: enabled (array), allow (array), security (object), slots (object)\n// Arbitrary: any other key is extension-specific config (e.g., extensions.hello.greeting)\nexport const ExtensionsConfigSchema: z.ZodType<Record<string, unknown>> = z.record(z.string(), z.unknown());\n\n// ============================================\n// Update Config\n// ============================================\n\nexport const UpdateAutoConfigSchema = z\n  .object({\n    /** Enable automatic update installation. Default false. */\n    enabled: z.boolean().default(false),\n    /** Hours to wait before applying a stable update after first detection. */\n    stableDelayHours: z.number().min(0).default(6),\n    /** Additional random jitter hours for stable rollout (avoids thundering herd). */\n    stableJitterHours: z.number().min(0).default(12),\n    /** How often to re-check for beta updates (hours). Min 0.25. */\n    betaCheckIntervalHours: z.number().min(0.25).default(1),\n  })\n  .strict()\n  .optional();\n\n/** Persistent `/goal` (Ralph loop) — Hermes-aligned defaults. */\nexport const GoalNotificationEventSchema = z.enum([\n  'done',\n  'blocked',\n  'needs_input',\n  'queue_failed',\n  'queue_retry',\n  'queue_succeeded',\n  'queue_skipped',\n]);\n\nexport const GoalNotificationTargetSchema = z\n  .object({\n    channel: z.string().min(1),\n    chatId: z.string().min(1),\n    accountId: z.string().optional(),\n    threadId: z.union([z.string(), z.number()]).optional(),\n    silent: z.boolean().optional(),\n    events: z.array(GoalNotificationEventSchema).optional(),\n  })\n  .strict();\n\nexport const GoalNotificationsConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    /** Notify Telegram/Weixin chats bound to the goal activeSessionKey. */\n    includeLinkedSessions: z.boolean().default(true),\n    /** Channels eligible for linked-session notifications. */\n    channels: z.array(z.string().min(1)).default(['telegram', 'weixin']),\n    events: z\n      .array(GoalNotificationEventSchema)\n      .default(['done', 'blocked', 'needs_input', 'queue_failed', 'queue_retry']),\n    targets: z.array(GoalNotificationTargetSchema).default([]),\n  })\n  .strict()\n  .default({\n    enabled: false,\n    includeLinkedSessions: true,\n    channels: ['telegram', 'weixin'],\n    events: ['done', 'blocked', 'needs_input', 'queue_failed', 'queue_retry'],\n    targets: [],\n  });\n\nexport const GoalsConfigSchema = z\n  .object({\n    /** Max continuation turns before auto-pause (Hermes default 20). */\n    maxTurns: z.number().int().min(1).max(500).default(20),\n    /** Optional judge model ref; defaults to the active agent model. */\n    judgeModelRef: z.string().optional(),\n    /**\n     * When true (default), first post-turn runs a decomposition judge to build a checklist;\n     * subsequent turns evaluate progress per item (Hermes-style). When false, use legacy freeform judge only.\n     */\n    checklistMode: z.boolean().default(true),\n    /**\n     * empty_only preserves legacy behavior: the first post-turn decomposition runs only when the\n     * goal has no checklist. supplement_existing lets the first post-turn add non-duplicate judge\n     * criteria even when the user supplied initial acceptance criteria.\n     */\n    checklistDecomposePolicy: z.enum(['empty_only', 'supplement_existing']).default('empty_only'),\n    /** Auto-pause after this many consecutive judge JSON/tool parse failures (Hermes default 3). */\n    maxConsecutiveParseFailures: z.number().int().min(1).max(20).default(3),\n    /** Judge LLM call timeout in ms (Hermes uses 60s). */\n    judgeTimeoutMs: z.number().int().min(5_000).max(120_000).default(60_000),\n    /** Max characters of recent transcript JSON passed to the checklist judge as extra context. */\n    checklistHistoryChars: z.number().int().min(0).max(100_000).default(24_000),\n    /** External channel notification policy for durable goal lifecycle events. */\n    notifications: GoalNotificationsConfigSchema,\n  })\n  .strict();\n\nexport type GoalsConfig = z.infer<typeof GoalsConfigSchema>;\n\nexport const UpdateConfigSchema = z\n  .object({\n    /** Check for updates on gateway startup. Default true. */\n    checkOnStart: z.boolean().default(true),\n    /** Update channel: stable (default), beta, or dev. */\n    channel: z.enum(['stable', 'beta', 'dev']).default('stable'),\n    /** Automatic update policy. */\n    auto: UpdateAutoConfigSchema,\n  })\n  .strict()\n  .optional();\n\nexport type UpdateConfig = z.infer<typeof UpdateConfigSchema>;\n\nexport const CommandsConfigSchema = z\n  .object({\n    restart: z.boolean().optional(),\n  })\n  .strict()\n  .optional();\n\nexport type CommandsConfig = z.infer<typeof CommandsConfigSchema>;\n\nexport const TuiConfigSchema = z\n  .object({\n    /** Default agent id for fresh TUI sessions. Leaves global routing (`agents.default`) untouched. */\n    defaultAgent: z.string().min(1).optional(),\n  })\n  .strict()\n  .default({});\n\nexport type TuiConfig = z.infer<typeof TuiConfigSchema>;\n\n// ============================================\n// MCP (Model Context Protocol)\n// ============================================\n\nconst McpHttpUrlSchema = z\n  .string()\n  .url()\n  .refine((value) => {\n    try {\n      const protocol = new URL(value).protocol;\n      return protocol === 'http:' || protocol === 'https:';\n    } catch {\n      return false;\n    }\n  }, 'MCP server URL must use http or https');\n\nconst ConnectorSecretReferenceSchema = z.object({\n  xopcSecretRef: z.object({\n    provider: z.string().min(1),\n    fieldKey: z.string().min(1),\n  }),\n});\n\nconst McpConfigScalarSchema = z.union([z.string(), z.number(), z.boolean(), ConnectorSecretReferenceSchema]);\n\nexport const McpServerSchema = z\n  .object({\n    command: z.string().optional(),\n    args: z.array(z.string()).optional(),\n    env: z.record(z.string(), McpConfigScalarSchema).optional(),\n    cwd: z.string().optional(),\n    workingDirectory: z.string().optional(),\n    url: McpHttpUrlSchema.optional(),\n    transport: z.enum(['sse', 'streamable-http']).optional(),\n    headers: z.record(z.string(), McpConfigScalarSchema).optional(),\n    connectionTimeoutMs: z.number().finite().positive().optional(),\n  })\n  .catchall(z.unknown())\n  .superRefine((value, ctx) => {\n    const hasCommand = typeof value.command === 'string' && value.command.trim().length > 0;\n    const hasUrl = typeof value.url === 'string' && value.url.trim().length > 0;\n    if (hasCommand && hasUrl) {\n      ctx.addIssue({\n        code: 'custom',\n        message: 'MCP server cannot define both command and url',\n      });\n    }\n  });\n\nexport const McpConfigSchema = z\n  .object({\n    servers: z.record(z.string(), McpServerSchema).optional(),\n    sessionIdleTtlMs: z.number().finite().min(0).optional(),\n  })\n  .strict()\n  .optional();\n\nexport type McpServerConfig = z.infer<typeof McpServerSchema>;\nexport type McpConfig = z.infer<typeof McpConfigSchema>;\n\nexport const ConnectorsConfigSchema = z\n  .object({\n    instances: z.record(z.string(), z.record(z.string(), z.unknown())).optional(),\n  })\n  .strict()\n  .optional();\n\nexport type ConnectorsConfig = z.infer<typeof ConnectorsConfigSchema>;\n\n// ============================================\n// Root Config\n// ============================================\n\nexport const ConfigSchema = z.object({\n  agents: AgentsConfigSchema,\n  bindings: BindingsConfigSchema,\n  session: SessionConfigSchema,\n  channels: ChannelsConfigSchema,\n  gateway: GatewayConfigSchema,\n  browser: BrowserConfigSchema,\n  tunnel: TunnelConfigSchema.optional(),\n  workspace: WorkspaceConfigSchema,\n  tools: ToolsConfigSchema,\n  mcp: McpConfigSchema,\n  connectors: ConnectorsConfigSchema,\n  goals: GoalsConfigSchema.optional(),\n  extensions: ExtensionsConfigSchema.default({}),\n  /** Per-vendor capability provider config (image / audio / video). */\n  providers: ProvidersConfigSchema.optional(),\n  modelsDev: ModelsDevConfigSchema,\n  /** Delivery / presentation concerns (currently `tts`). */\n  messages: MessagesConfigSchema,\n  update: UpdateConfigSchema,\n  commands: CommandsConfigSchema,\n  tui: TuiConfigSchema,\n}).default({\n  agents: {\n    default: 'main',\n    defaultPreset: DEFAULT_CAPABILITY_PRESET_ID,\n    capabilityPresets: {\n      [DEFAULT_CAPABILITY_PRESET_ID]: {\n        id: DEFAULT_CAPABILITY_PRESET_ID,\n        name: 'Global defaults',\n        description: 'Default capabilities inherited by every agent.',\n        version: 1,\n        models: DEFAULT_AGENT_MODELS,\n      },\n    },\n    list: [\n      {\n        id: 'main',\n        enabled: true,\n        identity: {\n          name: 'Main',\n          role: 'General assistant',\n          language: 'en',\n          tone: 'direct',\n        },\n        responsibilities: {\n          primary: ['Help the user complete tasks'],\n        },\n        workspace: { root: '~/.xopc/workspace/main' },\n        tools: { builtin: {} },\n        skills: { mode: 'all' },\n        memory: {\n          mode: 'confirmWrite',\n          sources: ['session', 'curated'],\n          writePolicy: { curated: 'confirm' },\n        },\n        workflows: {},\n        boundaries: { requiresConfirmation: [], forbidden: [], escalation: [] },\n      },\n    ],\n  },\n  bindings: [],\n  session: {\n    scope: 'per-sender' as const,\n    mainKey: 'main',\n    dmScope: 'main' as const,\n  },\n  channels: {\n    telegram: {\n      enabled: false,\n      debug: false,\n      defaults: {\n        dmPolicy: 'pairing' as const,\n        groupPolicy: 'open' as const,\n        replyToMode: 'off' as const,\n        historyLimit: 50,\n        textChunkLimit: 4000,\n        streaming: { mode: 'partial' as const },\n      },\n      accounts: {\n        default: {\n          accountId: 'default',\n          enabled: true,\n          botToken: '',\n          allowFrom: [],\n          groupAllowFrom: [],\n        },\n      },\n    },\n  },\n  gateway: {\n    bind: 'loopback',\n    port: 18790,\n    auth: {\n      mode: 'token',\n    },\n    heartbeat: {\n      enabled: true,\n      intervalMs: 1_800_000,\n      includeSystemPromptSection: false,\n    },\n    maxSseConnections: 100,\n    corsOrigins: [],\n    skillsMarketplaceProvider: 'skillhub',\n    skillsStoreBaseUrl: 'https://store.xopc.ai',\n  },\n  browser: {\n    enabled: true,\n    backend: 'extension' as const,\n  },\n  tools: {\n    web: {\n      search: {\n        maxResults: 5,\n        providers: [],\n      },\n    },\n  },\n  goals: {\n    maxTurns: 20,\n    checklistMode: true,\n    checklistDecomposePolicy: 'empty_only',\n    maxConsecutiveParseFailures: 3,\n    judgeTimeoutMs: 60_000,\n    checklistHistoryChars: 24_000,\n    notifications: {\n      enabled: false,\n      includeLinkedSessions: true,\n      channels: ['telegram', 'weixin'],\n      events: ['done', 'blocked', 'needs_input', 'queue_failed', 'queue_retry'],\n      targets: [],\n    },\n  },\n  extensions: {\n    allow: [],\n    security: {\n      checkPermissions: true,\n      allowUntrusted: false,\n      allow: [],\n      trackProvenance: true,\n      allowPromptInjection: false,\n    },\n    slots: {},\n  },\n  modelsDev: {\n    enabled: true,\n  },\n  tui: {},\n  // messages.tts / tools.media.audio start undefined; the factory layer fills\n  // in provider-level defaults (model/voice) on demand. Fresh configs don't\n  // ship with enabled providers so they never make surprise STT/TTS calls.\n});\n\nexport type Config = z.infer<typeof ConfigSchema>;\nexport type GatewayAuthConfig = z.infer<typeof GatewayAuthSchema>;\nexport type GatewayTrustedProxyConfig = z.infer<typeof GatewayTrustedProxySchema>;\nexport type GatewayAuthRateLimitConfig = z.infer<typeof GatewayAuthRateLimitSchema>;\nexport type GatewayBindMode = z.infer<typeof GatewayBindModeSchema>;\nexport type STTConfig = z.infer<typeof STTConfigSchema>;\nexport type TTSConfig = z.infer<typeof TTSConfigSchema>;\n\n// ============================================\n// Helper Functions\n// ============================================\n\n/**\n * Parse a model reference string.\n */\nexport interface ParsedModelRef {\n  provider: string;\n  model: string;\n}\n\nexport function getAgentDefaultModelRef(config: Config): string | undefined {\n  const list = Array.isArray(config.agents?.list) ? config.agents.list : [];\n  const defaultId =\n    config.agents?.default?.trim() ||\n    list.find((entry) => (entry as { default?: boolean }).default === true)?.id?.trim() ||\n    list[0]?.id;\n  const agent = list.find((entry) => entry.enabled !== false && entry.id === defaultId) ?? list[0];\n  if (!agent) return undefined;\n\n  let modelRef: string | undefined;\n  const visited = new Set<string>();\n  const applyModels = (models: AgentModelsConfig | undefined): void => {\n    const roles = models?.roles ?? {};\n    const defaultRole = models?.defaultRole ?? Object.keys(roles)[0];\n    const role = defaultRole ? roles[defaultRole] : undefined;\n    const next = role?.model.trim();\n    if (next) modelRef = next;\n  };\n  const applyPreset = (presetId: string): void => {\n    if (visited.has(presetId)) return;\n    visited.add(presetId);\n    const preset = config.agents.capabilityPresets[presetId];\n    if (!preset) return;\n    for (const parent of preset.extends ?? []) {\n      applyPreset(parent);\n    }\n    applyModels(preset.models);\n  };\n\n  applyPreset(config.agents.defaultPreset);\n  for (const presetId of agent.extends ?? []) {\n    if (presetId !== config.agents.defaultPreset) {\n      applyPreset(presetId);\n    }\n  }\n  applyModels(agent.models);\n  return modelRef;\n}\n\nfunction getAgentDefaultModelsConfig(config: Config): AgentModelsConfig | undefined {\n  const list = Array.isArray(config.agents?.list) ? config.agents.list : [];\n  const defaultId =\n    config.agents?.default?.trim() ||\n    list.find((entry) => (entry as { default?: boolean }).default === true)?.id?.trim() ||\n    list[0]?.id;\n  const agent = list.find((entry) => entry.enabled !== false && entry.id === defaultId) ?? list[0];\n  if (!agent) return undefined;\n\n  let modelConfig: AgentModelsConfig | undefined;\n  const visited = new Set<string>();\n  const applyModels = (models: AgentModelsConfig | undefined): void => {\n    if (!models) return;\n    modelConfig = {\n      ...modelConfig,\n      ...models,\n      roles: {\n        ...(modelConfig?.roles ?? {}),\n        ...(models.roles ?? {}),\n      },\n    };\n  };\n  const applyPreset = (presetId: string): void => {\n    if (visited.has(presetId)) return;\n    visited.add(presetId);\n    const preset = config.agents.capabilityPresets[presetId];\n    if (!preset) return;\n    for (const parent of preset.extends ?? []) {\n      applyPreset(parent);\n    }\n    applyModels(preset.models);\n  };\n\n  applyPreset(config.agents.defaultPreset);\n  for (const presetId of agent.extends ?? []) {\n    if (presetId !== config.agents.defaultPreset) {\n      applyPreset(presetId);\n    }\n  }\n  applyModels(agent.models);\n  return modelConfig;\n}\n\nexport function getAgentDefaultImageModelConfig(config: Config): AgentModelConfig | undefined {\n  return getAgentDefaultModelsConfig(config)?.imageModel;\n}\n\nexport function getAgentDefaultImageGenerationModelConfig(\n  config: Config,\n): AgentImageGenerationModelConfig | undefined {\n  return getAgentDefaultModelsConfig(config)?.imageGenerationModel;\n}\n\n/** `provider/model` or null when invalid. */\nexport function parseModelRef(ref: string): ParsedModelRef | null {\n  const trimmed = ref.trim();\n  const idx = trimmed.indexOf('/');\n  if (idx <= 0 || idx === trimmed.length - 1) {\n    return null;\n  }\n  return { provider: trimmed.slice(0, idx).trim(), model: trimmed.slice(idx + 1).trim() };\n}\n"],"mappings":";;;;;;;;;AAsyCA,SAAgB,wBAAwB,QAAoC;CAC1E,MAAM,OAAO,MAAM,QAAQ,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,OAAO,EAAE;CACzE,MAAM,YACJ,OAAO,QAAQ,SAAS,MAAM,IAC9B,KAAK,MAAM,UAAW,MAAgC,YAAY,KAAK,EAAE,IAAI,MAAM,IACnF,KAAK,IAAI;CACX,MAAM,QAAQ,KAAK,MAAM,UAAU,MAAM,YAAY,SAAS,MAAM,OAAO,UAAU,IAAI,KAAK;AAC9F,KAAI,CAAC,MAAO,QAAO,KAAA;CAEnB,IAAI;CACJ,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,eAAe,WAAgD;EACnE,MAAM,QAAQ,QAAQ,SAAS,EAAE;EACjC,MAAM,cAAc,QAAQ,eAAe,OAAO,KAAK,MAAM,CAAC;EAE9D,MAAM,QADO,cAAc,MAAM,eAAe,KAAA,IAC7B,MAAM,MAAM;AAC/B,MAAI,KAAM,YAAW;;CAEvB,MAAM,eAAe,aAA2B;AAC9C,MAAI,QAAQ,IAAI,SAAS,CAAE;AAC3B,UAAQ,IAAI,SAAS;EACrB,MAAM,SAAS,OAAO,OAAO,kBAAkB;AAC/C,MAAI,CAAC,OAAQ;AACb,OAAK,MAAM,UAAU,OAAO,WAAW,EAAE,CACvC,aAAY,OAAO;AAErB,cAAY,OAAO,OAAO;;AAG5B,aAAY,OAAO,OAAO,cAAc;AACxC,MAAK,MAAM,YAAY,MAAM,WAAW,EAAE,CACxC,KAAI,aAAa,OAAO,OAAO,cAC7B,aAAY,SAAS;AAGzB,aAAY,MAAM,OAAO;AACzB,QAAO;;AAGT,SAAS,4BAA4B,QAA+C;CAClF,MAAM,OAAO,MAAM,QAAQ,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,OAAO,EAAE;CACzE,MAAM,YACJ,OAAO,QAAQ,SAAS,MAAM,IAC9B,KAAK,MAAM,UAAW,MAAgC,YAAY,KAAK,EAAE,IAAI,MAAM,IACnF,KAAK,IAAI;CACX,MAAM,QAAQ,KAAK,MAAM,UAAU,MAAM,YAAY,SAAS,MAAM,OAAO,UAAU,IAAI,KAAK;AAC9F,KAAI,CAAC,MAAO,QAAO,KAAA;CAEnB,IAAI;CACJ,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,eAAe,WAAgD;AACnE,MAAI,CAAC,OAAQ;AACb,gBAAc;GACZ,GAAG;GACH,GAAG;GACH,OAAO;IACL,GAAI,aAAa,SAAS,EAAE;IAC5B,GAAI,OAAO,SAAS,EAAE;IACvB;GACF;;CAEH,MAAM,eAAe,aAA2B;AAC9C,MAAI,QAAQ,IAAI,SAAS,CAAE;AAC3B,UAAQ,IAAI,SAAS;EACrB,MAAM,SAAS,OAAO,OAAO,kBAAkB;AAC/C,MAAI,CAAC,OAAQ;AACb,OAAK,MAAM,UAAU,OAAO,WAAW,EAAE,CACvC,aAAY,OAAO;AAErB,cAAY,OAAO,OAAO;;AAG5B,aAAY,OAAO,OAAO,cAAc;AACxC,MAAK,MAAM,YAAY,MAAM,WAAW,EAAE,CACxC,KAAI,aAAa,OAAO,OAAO,cAC7B,aAAY,SAAS;AAGzB,aAAY,MAAM,OAAO;AACzB,QAAO;;AAGT,SAAgB,gCAAgC,QAA8C;AAC5F,QAAO,4BAA4B,OAAO,EAAE;;AAG9C,SAAgB,0CACd,QAC6C;AAC7C,QAAO,4BAA4B,OAAO,EAAE;;;AAI9C,SAAgB,cAAc,KAAoC;CAChE,MAAM,UAAU,IAAI,MAAM;CAC1B,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAChC,KAAI,OAAO,KAAK,QAAQ,QAAQ,SAAS,EACvC,QAAO;AAET,QAAO;EAAE,UAAU,QAAQ,MAAM,GAAG,IAAI,CAAC,MAAM;EAAE,OAAO,QAAQ,MAAM,MAAM,EAAE,CAAC,MAAM;EAAE;;;;gBAn4CpD;wBAC0B;qBACL;kBACN;qBA4MI;uBAEqD;AAnMhG,uBAAsB,EAChC,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;AAQE,mCAAkC,EAC5C,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAEzC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;;;;;EAKjD,sBAAsB,EAAE,SAAS,CAAC,UAAU;EAC7C,CAAC,CACD,QAAQ;AAIE,6BAA4B,EACtC,OAAO;EACN,aAAa,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU;EAC3C,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;EACjD,CAAC,CACD,QAAQ,CACR,aAAa,OAAO,QAAQ;EAC3B,MAAM,eAAe,QAAgB;GACnC,MAAM,UAAU,IAAI,MAAM;GAC1B,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAChC,UAAO,MAAM,KAAK,MAAM,QAAQ,SAAS;;AAE3C,MAAI,CAAC,YAAY,MAAM,MAAM,CAC3B,KAAI,SAAS;GACX,MAAM;GACN,SAAS,6CAA6C,MAAM,MAAM;GAClE,MAAM,CAAC,QAAQ;GAChB,CAAC;AAEJ,OAAK,MAAM,CAAC,OAAO,cAAc,MAAM,aAAa,EAAE,EAAE,SAAS,CAC/D,KAAI,CAAC,YAAY,SAAS,CACxB,KAAI,SAAS;GACX,MAAM;GACN,SAAS,gDAAgD,SAAS;GAClE,MAAM,CAAC,aAAa,MAAM;GAC3B,CAAC;GAGN;AAIE,8BAA6B,EAChC,OAAO,EAAE,QAAQ,CAAC,MAAM,0BAA0B,EAAE,0BAA0B,CAC9E,UAAU;AAEA,qBAAoB,EAC9B,OAAO;EACN,aAAa,EAAE,QAAQ,CAAC,MAAM,0BAA0B,CAAC,UAAU;EACnE,OAAO;EACP,YAAY,oBAAoB,UAAU;EAC1C,sBAAsB,gCAAgC,UAAU;EACjE,CAAC,CACD,QAAQ,CACR,UAAU;AAMA,sBAAqB,EAAE,OAAO;;EAEzC,SAAS,EAAE,QAAQ,CAAC,UAAU;;EAE9B,eAAe,EAAE,QAAQ,CAAC,QAAQ,6BAA6B;EAC/D,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC;EAC3E,MAAM,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;EAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ;EAClB,SAAS;EACT,eAAe;EACf,mBAAmB,GAChB,+BAA+B;GAC9B,IAAI;GACJ,MAAM;GACN,aAAa;GACb,SAAS;GACT,QAAQ;GACT,EACF;EACD,MAAM,CACJ;GACE,IAAI;GACJ,SAAS;GACT,UAAU;IACR,MAAM;IACN,MAAM;IACN,UAAU;IACV,MAAM;IACP;GACD,kBAAkB,EAChB,SAAS,CAAC,+BAA+B,EAC1C;GACD,WAAW,EAAE,MAAM,0BAA0B;GAC7C,OAAO,EAAE,SAAS,EAAE,EAAE;GACtB,QAAQ,EAAE,MAAM,OAAO;GACvB,QAAQ;IACN,MAAM;IACN,SAAS,CAAC,WAAW,UAAU;IAC/B,aAAa,EAAE,SAAS,WAAW;IACpC;GACD,WAAW,EAAE;GACb,YAAY;IAAE,sBAAsB,EAAE;IAAE,WAAW,EAAE;IAAE,YAAY,EAAE;IAAE;GACxE,CACF;EACF,CAAC;AAEI,4BAA2B,EAC9B,OAAO;EACN,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC,CACD,QAAQ,CACR,UAAU;AAEP,gCAA+B,EAClC,OAAO;EACN,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU;EACtD,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EAClC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;EAC1D,CAAC,CACD,QAAQ,CACR,UAAU;AAEP,4BAA2B,EAC9B,OAAO;EACN,UAAU,EAAE,SAAS,CAAC,UAAU;EAChC,kBAAkB,EAAE,SAAS,CAAC,UAAU;EACxC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa,OAAO,QAAQ;GAC1D,MAAM,SAAS,cAAc,MAAM;AACnC,OAAI,OAAO,OAAO,MAChB,KAAI,SAAS;IAAE,MAAM;IAAU,SAAS,OAAO;IAAS,CAAC;IAE3D;EACF,YAAY,EAAE,QAAQ,CAAC,UAAU;EACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,qBAAqB,EAAE,QAAQ,CAAC,UAAU;EAC1C,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ,CACR,UAAU;AAEA,uBAAsB,EAChC,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,SAAS,EAAE,KAAK;GAAC;GAAS;GAAO;GAAS;GAAa;GAAe,CAAC,CAAC,QAAQ,YAAY;EAC5F,UAAU,EAAE,SAAS,CAAC,UAAU;EAChC,kBAAkB,EAAE,SAAS,CAAC,UAAU;EACxC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;EAC3D,eAAe,EAAE,KAAK;GAAC;GAAS;GAAe;GAAc,CAAC,CAAC,UAAU;EACzE,OAAO;EACP,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,WAAW;EACX,cAAc;EACd,UAAU,EAAE,SAAS,CAAC,UAAU;EAChC,aAAa,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC,CAAC,UAAU;EACtD,cAAc,EAAE,KAAK;GAAC;GAAgB;GAAgB;GAAc,CAAC,CAAC,UAAU;EAChF,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;EAC7D,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,SAAS;EAAM,SAAS;EAAa,CAAC;AAmBtC,sBAAqB,EAAE,OAAO;EACzC,SAAS,EAAE,QAAQ;EACnB,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC9C,CAAC;AAEW,qBAAoB,EAAE,OAAO;EACxC,IAAI,EAAE,QAAQ,CAAC,UAAU;EACzB,SAAS,EAAE,QAAQ;EACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,IAAI;EACjC,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EACnC,CAAC;AAEW,wBAAuB,EAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,CAAC;AAE7D,wBAAuB,EAAE,KAAK;EACzC;EACA;EACA;EACA;EACD,CAAC;AAEW,8BAA6B,EAAE,OAAO;EACjD,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,YAAY,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;AAEW,0BAAyB,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAElD,4BAA2B,EACrC,OAAO;EACN,MAAM,uBAAuB,UAAU;;EAEvC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU;;EAElD,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;EAChD,CAAC,CACD,QAAQ;AAEE,4BAA2B,EACrC,OAAO;EACN,QAAQ,yBAAyB,UAAU;EAC3C,OAAO,yBAAyB,UAAU;EAC1C,QAAQ,yBAAyB,UAAU;EAC5C,CAAC,CACD,QAAQ;AAEE,sBAAqB,EAAE,KAAK,CAAC,cAAc,SAAS,CAAC;AAErD,uBAAsB,EAAE,OAAO;EAC1C,OAAO,mBAAmB,QAAQ,aAAa;EAC/C,SAAS,EAAE,QAAQ,CAAC,QAAQ,OAAO;EACnC,SAAS,qBAAqB,QAAQ,OAAO;EAC7C,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU;EACnE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC7C,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;EACnD,OAAO,yBAAyB,UAAU;EAC1C,aAAa,yBAAyB,UAAU;EAChD,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,UAAU;EACzE,SAAS,2BAA2B,UAAU;EAC/C,CAAC,CAAC,QAAQ;EACT,OAAO;EACP,SAAS;EACT,SAAS;EACV,CAAC;AAGW,wBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEpE,6BAA4B,EAAE,OAAO;EAChD,MAAM,EAAE,KAAK;GAAC;GAAS;GAAU;GAAQ;GAAU,CAAC;EACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;;EAE7B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;EACjC,CAAC;AAIW,yBAAwB,EAAE,OAAO;EAC5C,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;;EAEjC,WAAW,EAAE,MAAM,0BAA0B,CAAC,QAAQ,EAAE,CAAC;EAC1D,CAAC;AAIW,0BAAyB,EAAE,OAAO;;EAE7C,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;EACzC,CAAC;AAIW,wBAAuB,EAAE,OAAO;;EAE3C,QAAQ,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,UAAU;EAC3C,QAAQ,sBAAsB,UAAU;;EAExC,WAAW,uBAAuB,UAAU;EAC7C,CAAC;AAIW,qBAAoB,EAAE,OAAO;EACxC,KAAK,qBAAqB,UAAU;;;;;EAKpC,OAAO,EAAE,WAAW,uBAAuB;EAC5C,CAAC,CAAC,QAAQ,EACT,KAAK,EACH,QAAQ;EACN,YAAY;EACZ,WAAW,EAAE;EACd,EACF,EACF,CAAC;AAMW,8BAA6B,EACvC,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;EAC/C,UAAU,EAAE,QAAQ,CAAC,QAAQ,IAAQ;EACrC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,IAAQ;;EAE5C,WAAW,EAAE,QAAQ,CAAC,UAAU;;EAEhC,gBAAgB,EAAE,SAAS,CAAC,QAAQ,KAAK;;;;;;;EAOzC,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAK;EACvD,CAAC,CACD,UAAU;AAEA,yBAAwB,EAClC,OAAO;;AAEN,QAAQ,EAAE,SAAS,CAAC,UAAU,EAC/B,CAAC,CACD,UAAU;AAEA,6BAA4B,EACtC,OAAO;;EAEN,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;;EAE7B,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAE/C,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAE1C,eAAe,EAAE,SAAS,CAAC,UAAU;EACtC,CAAC,CACD,QAAQ;AAEE,qBAAoB,EAC9B,OAAO;EACN,MAAM,EAAE,KAAK;GAAC;GAAQ;GAAS;GAAY;GAAgB,CAAC,CAAC,QAAQ,QAAQ;EAC7E,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;;EAE/B,gBAAgB,EAAE,SAAS,CAAC,UAAU;EACtC,WAAW;EACX,cAAc,0BAA0B,UAAU;EACnD,CAAC,CACD,QAAQ,EACP,MAAM,SACP,CAAC;AAES,iCAAgC,EAAE,OAAO;EACpD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC9B,CAAC;AAEW,0BAAyB,EACnC,OAAO;EACN,MAAM,EAAE,KAAK;GAAC;GAAO;GAAS;GAAS,CAAC,CAAC,QAAQ,MAAM;EACvD,aAAa,EAAE,SAAS,CAAC,QAAQ,KAAK;EACtC,SAAS,8BAA8B,UAAU;EAClD,CAAC,CACD,QAAQ;EACP,MAAM;EACN,aAAa;EACd,CAAC;AAES,uBAAsB,EAAE,OAAO;EAC1C,KAAK,EAAE,QAAQ,CAAC,KAAK;EACrB,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,WAAW,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC,CAAC,QAAQ,SAAS;EACtD,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,gBAAgB,EAAE,QAAQ,CAAC,UAAU;EACtC,CAAC;AAEW,oBAAmB,EAC7B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;EACnC,cAAc,EAAE,SAAS,CAAC,QAAQ,MAAM;EACxC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC/B,CAAC,CACD,QAAQ;EACP,SAAS;EACT,cAAc;EACf,CAAC;AAES,qBAAoB,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,CAAC,QAAQ,QAAQ;AAEhE,yBAAwB,EAClC,OAAO;EACN,SAAS,EAAE,SAAS;EACpB,YAAY,EAAE,QAAQ;;EAEtB,4BAA4B,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,MAAM;EACjE,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,iBAAiB,EAAE,SAAS,CAAC,UAAU;EACvC,aAAa,EACV,OAAO;GACN,OAAO,EAAE,QAAQ;GACjB,KAAK,EAAE,QAAQ;GACf,UAAU,EAAE,QAAQ,CAAC,UAAU;GAChC,CAAC,CACD,UAAU;EACd,CAAC,CACD,QAAQ;EACP,SAAS;EACT,YAAY;EACZ,4BAA4B;EAC7B,CAAC;AAES,wCAAuC,EAAE,KAAK;EAAC;EAAQ;EAAO;EAAW,CAAC;AAE1E,uBAAsB,EAAE,OAAO;EAC1C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC9B,CAAC;AAEW,sBAAqB,EAC/B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;EACnC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,0BAA0B;;EAE9D,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EAChD,WAAW,EAAE,SAAS,CAAC,QAAQ,MAAM;EACrC,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,SAAS,oBAAoB,UAAU;EACxC,CAAC,CACD,QAAQ;EACP,SAAS;EACT,WAAW;EACX,WAAW;EACZ,CAAC;AASS,+BAA8B,EAAE,OAAO;;EAElD,WAAW,EAAE,QAAQ,CAAC,QAAQ,UAAU;;EAExC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,YAAe,CAAC,QAAQ,UAAY;;EAE7E,gBAAgB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC1C,CAAC;AAGW,yBAAwB,EAAE,OAAO,EAC5C,QAAQ,4BAA4B,UAAU,EAC/C,CAAC,CAAC,UAAU;AAGA,yBAAwB,EAAE,KAAK;EAAC;EAAQ;EAAY;EAAO;EAAW;EAAS,CAAC;AAEhF,uBAAsB,EAAE,OAAO;;EAE1C,MAAM,sBAAsB,UAAU;;EAEtC,gBAAgB,EAAE,QAAQ,CAAC,UAAU;EACrC,MAAM,EAAE,QAAQ,CAAC,UAAU;;EAE3B,MAAM,kBAAkB,UAAU;;EAElC,QAAQ,oBAAoB,UAAU;EACtC,WAAW,uBAAuB,UAAU;EAC5C,KAAK,iBAAiB,UAAU;EAChC,MAAM,kBAAkB,UAAU;EAClC,WAAW,sBAAsB,UAAU;EAC3C,mBAAmB,EAAE,QAAQ,CAAC,UAAU;EACxC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;;;;;;;;EAS3C,WAAW,EACR,QAAQ,CACR,aAAa,OAAO,QAAQ;GAC3B,MAAM,SAAS,kBAAkB,MAAM;AACvC,OAAI,OAAO,OAAO,MAChB,KAAI,SAAS;IAAE,MAAM;IAAU,SAAS,sBAAsB,OAAO;IAAW,CAAC;IAEnF,CACD,UAAU;;EAEb,0CAA0C,EAAE,SAAS,CAAC,UAAU;;EAEhE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAE9C,qBAAqB,EAAE,SAAS,CAAC,UAAU;EAC3C,UAAU;;;;;;;EAOV,yBAAyB,qCAAqC,UAAU;;EAExE,wBAAwB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU;;EAErE,4BAA4B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU;;EAEzE,2BAA2B,EAAE,QAAQ,CAAC,UAAU;;EAEhD,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;EAE/C,OAAO,EAAE,OAAO;GACd,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;GAElC,cAAc,EAAE,QAAQ,CAAC,IAAI,IAAO,CAAC,IAAI,OAAY,CAAC,QAAQ,MAAW;;GAEzE,UAAU,EAAE,QAAQ,CAAC,IAAI,IAAO,CAAC,IAAI,OAAc,CAAC,QAAQ,OAAY;;GAExE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAO,CAAC,QAAQ,IAAI;;GAE3D,aAAa,EAAE,QAAQ,CAAC,IAAI,QAAU,CAAC,IAAI,YAAe,CAAC,QAAQ,UAAY;;GAE/E,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;GAEF,WAAW,EAAE,OAAO;IAClB,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAElC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAU,CAAC,IAAI,YAAe,CAAC,QAAQ,WAAc;;IAEzF,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAM;;IAEjE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG;;IAErD,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAO;;IAEpE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC1D,CAAC,CAAC,QAAQ;IACT,SAAS;IACT,eAAe;IACf,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,gBAAgB;IACjB,CAAC;GACH,CAAC,CAAC,UAAU;;EAEb,WAAW,EAAE,OAAO;GAClB,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;GAElC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,gBAAgB;;GAE5D,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAO,CAAC,IAAI,OAAY,CAAC,QAAQ,MAAW;;GAE/E,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAO,CAAC,IAAI,OAAc,CAAC,QAAQ,OAAY;;GAE9E,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAM,CAAC,QAAQ,EAAE;GAC7D,QAAQ,EAAE,OAAO;IACf,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAElC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAU,CAAC,IAAI,YAAe,CAAC,QAAQ,SAAY;;IAExF,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAO;;IAElE,yBAAyB,EAAE,SAAS,CAAC,QAAQ,MAAM;IACpD,CAAC,CAAC,QAAQ;IACT,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,yBAAyB;IAC1B,CAAC;GACF,OAAO,EAAE,OAAO;;IAEd,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAElC,sBAAsB,EACnB,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CACxB,QAAQ;KAAC;KAAa;KAAa;KAAM,CAAC;;IAE7C,sBAAsB,EACnB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,CACzC,QAAQ;KAAC;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAK,CAAC;;IAE5D,kBAAkB,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAE3C,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,WAAc,CAAC,QAAQ,SAAW;;IAE7E,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAM,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAO;;IAE1E,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAO,CAAC,IAAI,KAAU,CAAC,QAAQ,IAAQ;;IAE7E,sBAAsB,EAAE,SAAS,CAAC,QAAQ,KAAK;IAChD,CAAC,CAAC,QAAQ;IACT,SAAS;IACT,sBAAsB;KAAC;KAAa;KAAa;KAAM;IACvD,sBAAsB;KAAC;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAK;IACtE,kBAAkB;IAClB,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACvB,CAAC;GACH,CAAC,CAAC,UAAU;EACd,CAAC,CAAC,QAAQ;EACT,MAAM;EACN,MAAM;EACN,MAAM,EACJ,MAAM,SACP;EACD,WAAW;GACT,SAAS;GACT,YAAY;GACZ,4BAA4B;GAC7B;EACD,mBAAmB;EACnB,aAAa,EAAE;EACf,2BAA2B;EAC3B,oBAAoB;EACrB,CAAC;AAEW,yBAAwB,EAAE,OAAO,EAC5C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK,EACnC,CAAC,CAAC,QAAQ,EACT,SAAS,MACV,CAAC;AAMI,mCAAkC,EAAE,MAAM;EAC9C,EAAE,QAAQ;EACV,EAAE,QAAQ;EACV,EAAE,SAAS;EACX,EAAE,MAAM;EACR,EAAE,MAAM,EAAE,SAAS,CAAC;EACpB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;EAClC,CAAC;AAEW,2BAA0B,EACpC,OAAO;EACN,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EACpD,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC,CACD,SAAS,gCAAgC;AAE/B,2BAA0B,EAAE,OAAO;EAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,SAAS,CAAC;EACjE,CAAC;AAEW,wCAAuC,EACjD,MAAM,EAAE,KAAK;EAAC;EAAS;EAAS;EAAQ,CAAC,CAAC,CAC1C,UAAU;AAEA,iCAAgC,EAC1C,OAAO;EACN,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,cAAc;EACd,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,WAAW,EAAE,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,UAAU;EACnE,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC,CACD,SAAS,gCAAgC;AAE/B,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,UAAU;EAC9C,UAAU,wBAAwB,UAAU;EAC5C,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAK,CAAC,IAAI,KAAO,CAAC,UAAU;;EAE5D,QAAQ,EAAE,MAAM,8BAA8B,CAAC,UAAU;;EAEzD,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,UAAU;EACpE,CAAC,CACD,QAAQ;AAML,mCAAkC,EAAE,MAAM;EAC9C,EAAE,QAAQ;EACV,EAAE,QAAQ;EACV,EAAE,SAAS;EACX,EAAE,MAAM;EACR,EAAE,MAAM,EAAE,SAAS,CAAC;EACpB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;EAClC,CAAC;AAEW,2BAA0B,EACpC,OAAO;EACN,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC7B,CAAC,CACD,SAAS,gCAAgC;AAE/B,2BAA0B,EAAE,OAAO;EAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,OAAO,EACJ,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CACxB,QAAQ;GAAC;GAAU;GAAW;GAAW;GAAO,CAAC;EACrD,CAAC;AAEW,iCAAgC,EAAE,OAAO;EACpD,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,WAAW,EAAE,SAAS,CAAC,QAAQ,KAAK;EACpC,eAAe,EAAE,SAAS,CAAC,QAAQ,MAAM;EACzC,YAAY,EAAE,SAAS,CAAC,QAAQ,KAAK;EACrC,cAAc,EAAE,SAAS,CAAC,QAAQ,KAAK;EACvC,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC9C,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC9C,WAAW,EAAE,SAAS,CAAC,QAAQ,MAAM;EACtC,CAAC;AAEW,uBAAsB,EAAE,OAAO;EAC1C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,MAAM,EAAE,QAAQ,CAAC,UAAU;EAC3B,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,MAAM,EAAE,QAAQ,CAAC,UAAU;EAC3B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAK,CAAC,IAAI,KAAO,CAAC,UAAU;EAC7D,CAAC;AAEW,gCAA+B,EAAE,OAAO;EACnD,SAAS,EAAE,SAAS,CAAC,UAAU;EAC/B,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;EAChD,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;EAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC7B,CAAC;AAEW,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,OAAO;EAC3C,SAAS,EAAE,KAAK;GAAC;GAAO;GAAU;GAAW;GAAS,CAAC,CAAC,QAAQ,SAAS;EACzE,UAAU,wBAAwB,UAAU;EAC5C,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI;EACnD,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAK,CAAC,IAAI,KAAO,CAAC,QAAQ,IAAM;EAChE,eAAe,6BAA6B,UAAU;EACtD,gBAAgB,8BAA8B,UAAU;;EAExD,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,UAAU;EACpE,CAAC,CACD,QAAQ;AAME,wBAAuB,EAAE,OAAO;;AAE3C,KAAK,gBAAgB,UAAU,EAChC,CAAC,CAAC,UAAU;AAEA,+BAA8B;AAE9B,0BAAyB,EACnC,OAAO;;EAEN,QAAQ,EAAE,MAAM,8BAA8B,CAAC,UAAU;;EAEzD,OAAO,4BAA4B,UAAU;EAC9C,CAAC,CACD,UAAU;AAaA,6BAA4B,EACtC,OAAO;;EAEN,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;;EAEtC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;;EAExC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EACzC,CAAC,CACD,QAAQ;AAGE,kCAAiC,EAC3C,OAAO;;EAEN,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;;EAEjD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EACrD,CAAC,CACD,QAAQ;AAQE,4BAA2B,EACrC,OAAO;;EAEN,QAAQ,EAAE,QAAQ,CAAC,UAAU;;EAE7B,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;EAEpC,QAAQ,EAAE,QAAQ,CAAC,UAAU;;EAE7B,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;EAEzC,SAAS,+BAA+B,UAAU;;EAElD,OAAO,0BAA0B,UAAU;EAC5C,CAAC,CACD,QAAQ;AASE,yBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB;AAStE,iCAAgC,EAAE,OAAO;EACpD,kBAAkB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC3C,gBAAgB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;EACtC,iBAAiB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC1C,sBAAsB,EAAE,SAAS,CAAC,QAAQ,MAAM;EACjD,CAAC;AAGW,8BAA6B,EAAE,OAAO;EACjD,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,iBAAiB,EAAE,QAAQ,CAAC,UAAU;EACtC,WAAW,EAAE,QAAQ,CAAC,UAAU;EACjC,CAAC;AAMW,0BAA6D,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;AAM9F,0BAAyB,EACnC,OAAO;;EAEN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;;EAE9C,mBAAmB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,GAAG;;EAEhD,wBAAwB,EAAE,QAAQ,CAAC,IAAI,IAAK,CAAC,QAAQ,EAAE;EACxD,CAAC,CACD,QAAQ,CACR,UAAU;AAGA,+BAA8B,EAAE,KAAK;EAChD;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEW,gCAA+B,EACzC,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;EACzB,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU;EACtD,QAAQ,EAAE,SAAS,CAAC,UAAU;EAC9B,QAAQ,EAAE,MAAM,4BAA4B,CAAC,UAAU;EACxD,CAAC,CACD,QAAQ;AAEE,iCAAgC,EAC1C,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,KAAK;;EAEhD,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,SAAS,CAAC;EACpE,QAAQ,EACL,MAAM,4BAA4B,CAClC,QAAQ;GAAC;GAAQ;GAAW;GAAe;GAAgB;GAAc,CAAC;EAC7E,SAAS,EAAE,MAAM,6BAA6B,CAAC,QAAQ,EAAE,CAAC;EAC3D,CAAC,CACD,QAAQ,CACR,QAAQ;EACP,SAAS;EACT,uBAAuB;EACvB,UAAU,CAAC,YAAY,SAAS;EAChC,QAAQ;GAAC;GAAQ;GAAW;GAAe;GAAgB;GAAc;EACzE,SAAS,EAAE;EACZ,CAAC;AAES,qBAAoB,EAC9B,OAAO;;EAEN,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG;;EAEtD,eAAe,EAAE,QAAQ,CAAC,UAAU;;;;;EAKpC,eAAe,EAAE,SAAS,CAAC,QAAQ,KAAK;;;;;;EAMxC,0BAA0B,EAAE,KAAK,CAAC,cAAc,sBAAsB,CAAC,CAAC,QAAQ,aAAa;;EAE7F,6BAA6B,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE;;EAEvE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAM,CAAC,IAAI,KAAQ,CAAC,QAAQ,IAAO;;EAExE,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,KAAO;;EAE3E,eAAe;EAChB,CAAC,CACD,QAAQ;AAIE,sBAAqB,EAC/B,OAAO;;EAEN,cAAc,EAAE,SAAS,CAAC,QAAQ,KAAK;;EAEvC,SAAS,EAAE,KAAK;GAAC;GAAU;GAAQ;GAAM,CAAC,CAAC,QAAQ,SAAS;;EAE5D,MAAM;EACP,CAAC,CACD,QAAQ,CACR,UAAU;AAIA,wBAAuB,EACjC,OAAO,EACN,SAAS,EAAE,SAAS,CAAC,UAAU,EAChC,CAAC,CACD,QAAQ,CACR,UAAU;AAIA,mBAAkB,EAC5B,OAAO;;AAEN,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EAC3C,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,CAAC;AAQR,oBAAmB,EACtB,QAAQ,CACR,KAAK,CACL,QAAQ,UAAU;AACjB,MAAI;GACF,MAAM,WAAW,IAAI,IAAI,MAAM,CAAC;AAChC,UAAO,aAAa,WAAW,aAAa;UACtC;AACN,UAAO;;IAER,wCAAwC;AAEvC,kCAAiC,EAAE,OAAO,EAC9C,eAAe,EAAE,OAAO;EACtB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC3B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC5B,CAAC,EACH,CAAC;AAEI,yBAAwB,EAAE,MAAM;EAAC,EAAE,QAAQ;EAAE,EAAE,QAAQ;EAAE,EAAE,SAAS;EAAE;EAA+B,CAAC;AAE/F,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EACpC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;EAC3D,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,UAAU;EACvC,KAAK,iBAAiB,UAAU;EAChC,WAAW,EAAE,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC,UAAU;EACxD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;EAC/D,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;EAC/D,CAAC,CACD,SAAS,EAAE,SAAS,CAAC,CACrB,aAAa,OAAO,QAAQ;EAC3B,MAAM,aAAa,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,MAAM,CAAC,SAAS;EACtF,MAAM,SAAS,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,MAAM,CAAC,SAAS;AAC1E,MAAI,cAAc,OAChB,KAAI,SAAS;GACX,MAAM;GACN,SAAS;GACV,CAAC;GAEJ;AAES,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU;EACzD,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EACxD,CAAC,CACD,QAAQ,CACR,UAAU;AAKA,0BAAyB,EACnC,OAAO,EACN,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,UAAU;AAQA,gBAAe,EAAE,OAAO;EACnC,QAAQ;EACR,UAAU;EACV,SAAS;EACT,UAAU;EACV,SAAS;EACT,SAAS;EACT,QAAQ,mBAAmB,UAAU;EACrC,WAAW;EACX,OAAO;EACP,KAAK;EACL,YAAY;EACZ,OAAO,kBAAkB,UAAU;EACnC,YAAY,uBAAuB,QAAQ,EAAE,CAAC;;EAE9C,WAAW,sBAAsB,UAAU;EAC3C,WAAW;;EAEX,UAAU;EACV,QAAQ;EACR,UAAU;EACV,KAAK;EACN,CAAC,CAAC,QAAQ;EACT,QAAQ;GACN,SAAS;GACT,eAAe;GACf,mBAAmB,GAChB,+BAA+B;IAC9B,IAAI;IACJ,MAAM;IACN,aAAa;IACb,SAAS;IACT,QAAQ;IACT,EACF;GACD,MAAM,CACJ;IACE,IAAI;IACJ,SAAS;IACT,UAAU;KACR,MAAM;KACN,MAAM;KACN,UAAU;KACV,MAAM;KACP;IACD,kBAAkB,EAChB,SAAS,CAAC,+BAA+B,EAC1C;IACD,WAAW,EAAE,MAAM,0BAA0B;IAC7C,OAAO,EAAE,SAAS,EAAE,EAAE;IACtB,QAAQ,EAAE,MAAM,OAAO;IACvB,QAAQ;KACN,MAAM;KACN,SAAS,CAAC,WAAW,UAAU;KAC/B,aAAa,EAAE,SAAS,WAAW;KACpC;IACD,WAAW,EAAE;IACb,YAAY;KAAE,sBAAsB,EAAE;KAAE,WAAW,EAAE;KAAE,YAAY,EAAE;KAAE;IACxE,CACF;GACF;EACD,UAAU,EAAE;EACZ,SAAS;GACP,OAAO;GACP,SAAS;GACT,SAAS;GACV;EACD,UAAU,EACR,UAAU;GACR,SAAS;GACT,OAAO;GACP,UAAU;IACR,UAAU;IACV,aAAa;IACb,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,WAAW,EAAE,MAAM,WAAoB;IACxC;GACD,UAAU,EACR,SAAS;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW,EAAE;IACb,gBAAgB,EAAE;IACnB,EACF;GACF,EACF;EACD,SAAS;GACP,MAAM;GACN,MAAM;GACN,MAAM,EACJ,MAAM,SACP;GACD,WAAW;IACT,SAAS;IACT,YAAY;IACZ,4BAA4B;IAC7B;GACD,mBAAmB;GACnB,aAAa,EAAE;GACf,2BAA2B;GAC3B,oBAAoB;GACrB;EACD,SAAS;GACP,SAAS;GACT,SAAS;GACV;EACD,OAAO,EACL,KAAK,EACH,QAAQ;GACN,YAAY;GACZ,WAAW,EAAE;GACd,EACF,EACF;EACD,OAAO;GACL,UAAU;GACV,eAAe;GACf,0BAA0B;GAC1B,6BAA6B;GAC7B,gBAAgB;GAChB,uBAAuB;GACvB,eAAe;IACb,SAAS;IACT,uBAAuB;IACvB,UAAU,CAAC,YAAY,SAAS;IAChC,QAAQ;KAAC;KAAQ;KAAW;KAAe;KAAgB;KAAc;IACzE,SAAS,EAAE;IACZ;GACF;EACD,YAAY;GACV,OAAO,EAAE;GACT,UAAU;IACR,kBAAkB;IAClB,gBAAgB;IAChB,OAAO,EAAE;IACT,iBAAiB;IACjB,sBAAsB;IACvB;GACD,OAAO,EAAE;GACV;EACD,WAAW,EACT,SAAS,MACV;EACD,KAAK,EAAE;EAIR,CAAC"}
+{"version":3,"file":"schema.js","names":[],"sources":["../../../src/config/schema.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport {\n  AgentConfigEntrySchema,\n  CapabilityPresetSchema,\n  DEFAULT_CAPABILITY_PRESET_ID,\n} from '../agent-manifest/schema.js';\nimport { checkCacheDir } from '../browser/cache-dir-policy.js';\nimport { DEFAULT_AGENT_MODELS } from './default-model.js';\nimport { validatePublicUrl } from './public-url.js';\n\n// ============================================\n// Agent Configs\n// ============================================\n\n/**\n * Agent model ref. Always an object with explicit `primary` and optional\n * `fallbacks` chain. No string-form shorthand — every write site builds the\n * object explicitly so reads never branch on shape.\n */\nexport const AgentModelRefSchema = z\n  .object({\n    primary: z.string().min(1),\n    fallbacks: z.array(z.string()).optional(),\n  })\n  .strict();\n\nexport type AgentModelConfig = z.infer<typeof AgentModelRefSchema>;\n\n/**\n * Image-generation model ref. {@link AgentModelRefSchema} plus runtime knobs\n * (`timeoutMs`, `autoProviderFallback`) used by the image-generation runtime.\n */\nexport const AgentImageGenerationModelSchema = z\n  .object({\n    primary: z.string().min(1),\n    fallbacks: z.array(z.string()).optional(),\n    /** Hard cap for the whole generation attempt (ms). */\n    timeoutMs: z.number().int().positive().optional(),\n    /**\n     * When all `primary + fallbacks` candidates fail, sweep every other\n     * configured provider before giving up.\n     */\n    autoProviderFallback: z.boolean().optional(),\n  })\n  .strict();\n\nexport type AgentImageGenerationModelConfig = z.infer<typeof AgentImageGenerationModelSchema>;\n\nexport const AgentTypedModelRoleSchema = z\n  .object({\n    description: z.string().max(500).optional(),\n    model: z.string().min(1),\n    fallbacks: z.array(z.string().min(1)).optional(),\n  })\n  .strict()\n  .superRefine((entry, ctx) => {\n    const validateRef = (ref: string) => {\n      const trimmed = ref.trim();\n      const idx = trimmed.indexOf('/');\n      return idx > 0 && idx < trimmed.length - 1;\n    };\n    if (!validateRef(entry.model)) {\n      ctx.addIssue({\n        code: 'custom',\n        message: `model must be provider/model format (got '${entry.model}')`,\n        path: ['model'],\n      });\n    }\n    for (const [index, fallback] of (entry.fallbacks ?? []).entries()) {\n      if (!validateRef(fallback)) {\n        ctx.addIssue({\n          code: 'custom',\n          message: `fallback must be provider/model format (got '${fallback}')`,\n          path: ['fallbacks', index],\n        });\n      }\n    }\n  });\n\nexport type AgentTypedModelRole = z.infer<typeof AgentTypedModelRoleSchema>;\n\nconst AgentTypedModelRolesSchema = z\n  .record(z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), AgentTypedModelRoleSchema)\n  .optional();\n\nexport const AgentModelsSchema = z\n  .object({\n    defaultRole: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),\n    roles: AgentTypedModelRolesSchema,\n    imageModel: AgentModelRefSchema.optional(),\n    imageGenerationModel: AgentImageGenerationModelSchema.optional(),\n  })\n  .strict()\n  .optional();\n\nexport type AgentModelsConfig = z.infer<typeof AgentModelsSchema>;\n\nexport type AgentTypedModel = AgentTypedModelRole & { id: string };\n\nexport const AgentsConfigSchema = z.object({\n  /** Default agent id when not specified (routing / session creation). */\n  default: z.string().optional(),\n  /** Protected global defaults preset applied before each agent's own presets. */\n  defaultPreset: z.string().default(DEFAULT_CAPABILITY_PRESET_ID),\n  capabilityPresets: z.record(z.string(), CapabilityPresetSchema).default({}),\n  list: z.array(AgentConfigEntrySchema).default([]),\n}).strict().default({\n  default: 'main',\n  defaultPreset: DEFAULT_CAPABILITY_PRESET_ID,\n  capabilityPresets: {\n    [DEFAULT_CAPABILITY_PRESET_ID]: {\n      id: DEFAULT_CAPABILITY_PRESET_ID,\n      name: 'Global defaults',\n      description: 'Default capabilities inherited by every agent.',\n      version: 1,\n      models: DEFAULT_AGENT_MODELS,\n    },\n  },\n  list: [\n    {\n      id: 'main',\n      enabled: true,\n      identity: {\n        name: 'Main',\n        role: 'General assistant',\n        language: 'en',\n        tone: 'direct',\n      },\n      responsibilities: {\n        primary: ['Help the user complete tasks'],\n      },\n      workspace: { root: '~/.xopc/workspace/main' },\n      tools: { builtin: {} },\n      skills: { mode: 'all' },\n      memory: {\n        mode: 'confirmWrite',\n        sources: ['session', 'curated'],\n        writePolicy: { curated: 'confirm' },\n      },\n      workflows: {},\n      boundaries: { requiresConfirmation: [], forbidden: [], escalation: [] },\n    },\n  ],\n});\n\nconst BrowserCloudConfigSchema = z\n  .object({\n    apiKey: z.string().optional(),\n    projectId: z.string().optional(),\n    region: z.string().optional(),\n  })\n  .strict()\n  .optional();\n\nconst BrowserExtensionConfigSchema = z\n  .object({\n    port: z.number().int().min(1024).max(65535).optional(),\n    host: z.string().min(1).optional(),\n    connectionTimeout: z.number().int().positive().optional(),\n  })\n  .strict()\n  .optional();\n\nconst BrowserCloakConfigSchema = z\n  .object({\n    keepOpen: z.boolean().optional(),\n    temporaryProfile: z.boolean().optional(),\n    cacheDir: z.string().optional().superRefine((value, ctx) => {\n      const result = checkCacheDir(value);\n      if (result.ok === false) {\n        ctx.addIssue({ code: 'custom', message: result.message });\n      }\n    }),\n    binaryPath: z.string().optional(),\n    timezone: z.string().optional(),\n    locale: z.string().optional(),\n    webrtcIp: z.string().optional(),\n    fingerprintPlatform: z.string().optional(),\n    extraArgs: z.array(z.string()).optional(),\n  })\n  .strict()\n  .optional();\n\nexport const BrowserConfigSchema = z\n  .object({\n    enabled: z.boolean().default(true),\n    backend: z.enum(['local', 'cdp', 'cloud', 'extension', 'cloakbrowser']).default('extension'),\n    headless: z.boolean().optional(),\n    allowPrivateUrls: z.boolean().optional(),\n    commandTimeout: z.number().int().min(5).max(900).optional(),\n    cloudProvider: z.enum(['local', 'browserbase', 'browser-use']).optional(),\n    cloud: BrowserCloudConfigSchema,\n    cdpUrl: z.string().optional(),\n    extension: BrowserExtensionConfigSchema,\n    cloakbrowser: BrowserCloakConfigSchema,\n    humanize: z.boolean().optional(),\n    humanPreset: z.enum(['default', 'careful']).optional(),\n    dialogPolicy: z.enum(['must_respond', 'auto_dismiss', 'auto_accept']).optional(),\n    dialogTimeoutSeconds: z.number().int().positive().optional(),\n  })\n  .strict()\n  .default({ enabled: true, backend: 'extension' });\n\n// ============================================\n// Channel Configs (per-channel Zod lives in bundled extensions; root schema is open)\n// ============================================\n\nexport {\n  TelegramTopicConfigSchema,\n  TelegramGroupConfigSchema,\n  TelegramAccountConfigSchema,\n  TelegramConfigSchema,\n} from '../../extensions/telegram/src/config-schema.js';\nexport type { TelegramConfig } from '../../extensions/telegram/src/config-schema.js';\nexport { WeixinAccountConfigSchema, WeixinConfigSchema } from '../../extensions/weixin/src/config-schema.js';\nexport type { WeixinConfig } from '../../extensions/weixin/src/config-schema.js';\n// ============================================\n// Session Routing Configuration\n// ============================================\n\nexport const BindingMatchSchema = z.object({\n  channel: z.string(),\n  accountId: z.string().optional(),\n  peerKind: z.string().optional(),\n  peerId: z.string().optional(),\n  guildId: z.string().optional(),\n  teamId: z.string().optional(),\n  memberRoleIds: z.array(z.string()).optional(),\n});\n\nexport const BindingRuleSchema = z.object({\n  id: z.string().optional(),\n  agentId: z.string(),\n  priority: z.number().default(100),\n  match: BindingMatchSchema,\n  enabled: z.boolean().default(true),\n});\n\nexport const BindingsConfigSchema = z.array(BindingRuleSchema).default([]);\n\nexport const SessionDmScopeSchema = z.enum([\n  'main',\n  'per-peer',\n  'per-channel-peer',\n  'per-account-channel-peer',\n]);\n\nexport const SessionStorageConfigSchema = z.object({\n  pruneAfterMs: z.number().optional(),\n  maxEntries: z.number().optional(),\n});\n\nexport const SessionResetModeSchema = z.enum(['daily', 'idle']);\n\nexport const SessionResetConfigSchema = z\n  .object({\n    mode: SessionResetModeSchema.optional(),\n    /** Local hour (0–23) for the daily reset boundary. */\n    atHour: z.number().int().min(0).max(23).optional(),\n    /** Sliding idle window (minutes). When set with daily mode, whichever expires first wins. */\n    idleMinutes: z.number().int().min(0).optional(),\n  })\n  .strict();\n\nexport const SessionResetByTypeSchema = z\n  .object({\n    direct: SessionResetConfigSchema.optional(),\n    group: SessionResetConfigSchema.optional(),\n    thread: SessionResetConfigSchema.optional(),\n  })\n  .strict();\n\nexport const SessionScopeSchema = z.enum(['per-sender', 'global']);\n\nexport const SessionConfigSchema = z.object({\n  scope: SessionScopeSchema.default('per-sender'),\n  mainKey: z.string().default('main'),\n  dmScope: SessionDmScopeSchema.default('main'),\n  identityLinks: z.record(z.string(), z.array(z.string())).optional(),\n  resetTriggers: z.array(z.string()).optional(),\n  idleMinutes: z.number().int().positive().optional(),\n  reset: SessionResetConfigSchema.optional(),\n  resetByType: SessionResetByTypeSchema.optional(),\n  resetByChannel: z.record(z.string(), SessionResetConfigSchema).optional(),\n  storage: SessionStorageConfigSchema.optional(),\n}).default({\n  scope: 'per-sender',\n  mainKey: 'main',\n  dmScope: 'main',\n});\n\n/** Channel buckets — shapes validated post-parse by registered channel plugins. */\nexport const ChannelsConfigSchema = z.record(z.string(), z.unknown()).default({});\n\nexport const SearchProviderEntrySchema = z.object({\n  type: z.enum(['brave', 'tavily', 'bing', 'searxng']),\n  apiKey: z.string().optional(),\n  /** SearXNG instance base URL (e.g. http://localhost:8080) */\n  url: z.string().optional(),\n  disabled: z.boolean().optional(),\n});\n\nexport type SearchProviderEntry = z.infer<typeof SearchProviderEntrySchema>;\n\nexport const WebSearchConfigSchema = z.object({\n  maxResults: z.number().default(5),\n  /** Ordered API providers; empty → HTML fallback only */\n  providers: z.array(SearchProviderEntrySchema).default([]),\n});\n\nexport type WebSearchConfig = z.infer<typeof WebSearchConfigSchema>;\n\nexport const WebsiteBlocklistSchema = z.object({\n  /** Master switch. Default false (no blocking). */\n  enabled: z.boolean().default(false),\n  /** Domain patterns to block (e.g. \"example.com\", \"*.evil.org\"). */\n  domains: z.array(z.string()).default([]),\n});\n\nexport type WebsiteBlocklistConfig = z.infer<typeof WebsiteBlocklistSchema>;\n\nexport const WebToolsConfigSchema = z.object({\n  /** Search result HTML fallback: cn → Bing, otherwise DuckDuckGo */\n  region: z.enum(['cn', 'global']).optional(),\n  search: WebSearchConfigSchema.optional(),\n  /** Domain blocklist for web_fetch / web_extract / browser tools. */\n  blocklist: WebsiteBlocklistSchema.optional(),\n});\n\nexport type WebToolsConfig = z.infer<typeof WebToolsConfigSchema>;\n\nexport const ToolsConfigSchema = z.object({\n  web: WebToolsConfigSchema.optional(),\n  /**\n   * Per-capability media providers. Currently only `audio` (STT) is wired;\n   * `image` / `video` slots are reserved for future capabilities.\n   */\n  media: z.lazy(() => ToolsMediaConfigSchema),\n}).default({\n  web: {\n    search: {\n      maxResults: 5,\n      providers: [],\n    },\n  },\n});\n\n// ============================================\n// Gateway Configuration\n// ============================================\n\nexport const GatewayAuthRateLimitSchema = z\n  .object({\n    enabled: z.boolean().default(true),\n    maxAttempts: z.number().int().min(1).default(5),\n    windowMs: z.number().default(900_000),\n    blockDurationMs: z.number().default(300_000),\n    /** OpenClaw alias for blockDurationMs. */\n    lockoutMs: z.number().optional(),\n    /** Skip rate limiting for loopback client IPs (default true). Remote browser Origin requests never exempt. */\n    exemptLoopback: z.boolean().default(true),\n    /**\n     * Coalesce same-client failures arriving within this window into a single\n     * attempt. Absorbs SPA fan-out / SDK auto-retry storms without weakening\n     * brute-force protection (deliberate attackers are still rate-limited to\n     * one effective attempt per window). Set to 0 to disable.\n     */\n    burstCoalesceMs: z.number().int().min(0).default(1000),\n  })\n  .optional();\n\nexport const GatewaySecuritySchema = z\n  .object({\n    /** When true, non-loopback binds require explicit gateway.auth.rateLimit configuration. */\n    strict: z.boolean().optional(),\n  })\n  .optional();\n\nexport const GatewayTrustedProxySchema = z\n  .object({\n    /** Header set by the reverse proxy with the authenticated user identity. */\n    userHeader: z.string().min(1),\n    /** Additional headers that must be present (e.g. proxy auth markers). */\n    requiredHeaders: z.array(z.string()).optional(),\n    /** When non-empty, only these user identities are allowed. */\n    allowUsers: z.array(z.string()).optional(),\n    /** Allow trusted-proxy auth when the TCP source is loopback (same-host reverse proxy). */\n    allowLoopback: z.boolean().optional(),\n  })\n  .strict();\n\nexport const GatewayAuthSchema = z\n  .object({\n    mode: z.enum(['none', 'token', 'password', 'trusted-proxy']).default('token'),\n    token: z.string().optional(),\n    password: z.string().optional(),\n    /** When true (default for Serve), browser UI may auth via Tailscale identity headers. API routes still require token. */\n    allowTailscale: z.boolean().optional(),\n    rateLimit: GatewayAuthRateLimitSchema,\n    trustedProxy: GatewayTrustedProxySchema.optional(),\n  })\n  .default({\n    mode: 'token',\n  });\n\nexport const GatewayTailscaleConsentSchema = z.object({\n  version: z.string().min(1),\n  acceptedAt: z.string().min(1),\n});\n\nexport const GatewayTailscaleSchema = z\n  .object({\n    mode: z.enum(['off', 'serve', 'funnel']).default('off'),\n    resetOnExit: z.boolean().default(true),\n    consent: GatewayTailscaleConsentSchema.optional(),\n  })\n  .default({\n    mode: 'off',\n    resetOnExit: true,\n  });\n\nexport const GatewayRemoteSchema = z.object({\n  url: z.string().url(),\n  token: z.string().optional(),\n  password: z.string().optional(),\n  transport: z.enum(['direct', 'ssh']).default('direct'),\n  sshTarget: z.string().optional(),\n  sshIdentity: z.string().optional(),\n  tlsFingerprint: z.string().optional(),\n});\n\nexport const GatewayTlsSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    autoGenerate: z.boolean().default(false),\n    certPath: z.string().optional(),\n    keyPath: z.string().optional(),\n  })\n  .default({\n    enabled: false,\n    autoGenerate: false,\n  });\n\nexport const GatewayModeSchema = z.enum(['local', 'remote']).default('local');\n\nexport const HeartbeatConfigSchema = z\n  .object({\n    enabled: z.boolean(),\n    intervalMs: z.number(),\n    /** When false, heartbeat instructions are only sent during heartbeat polling turns (not in every chat system prompt). */\n    includeSystemPromptSection: z.boolean().optional().default(false),\n    target: z.string().optional(),\n    targetChatId: z.string().optional(),\n    prompt: z.string().optional(),\n    ackMaxChars: z.number().optional(),\n    isolatedSession: z.boolean().optional(),\n    activeHours: z\n      .object({\n        start: z.string(),\n        end: z.string(),\n        timezone: z.string().optional(),\n      })\n      .optional(),\n  })\n  .default({\n    enabled: true,\n    intervalMs: 1_800_000,\n    includeSystemPromptSection: false,\n  });\n\nexport const GatewayChannelConnectDeferModeSchema = z.enum(['auto', 'off', 'explicit']);\n\nexport const TunnelConsentSchema = z.object({\n  version: z.string().min(1),\n  acceptedAt: z.string().min(1),\n});\n\nexport const TunnelConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    brokerUrl: z.string().url().default('https://frp.xopc.ai/api'),\n    /** Broker register API secret (env `XOPC_TUNNEL_REGISTRATION_SECRET` overrides when set). */\n    registrationSecret: z.string().min(1).optional(),\n    autoStart: z.boolean().default(false),\n    subdomain: z.string().optional(),\n    consent: TunnelConsentSchema.optional(),\n  })\n  .default({\n    enabled: false,\n    brokerUrl: 'https://frp.xopc.ai/api',\n    autoStart: false,\n  });\n\nexport type TunnelConfig = z.infer<typeof TunnelConfigSchema>;\n\n/**\n * Workspace-scoped concerns (file import, etc.). Distinct from\n * agent manifest workspace roots; this block carries\n * feature configuration for workspace-related routes.\n */\nexport const WorkspaceImportConfigSchema = z.object({\n  /** Workspace-relative subdir for imported files. Default `imports`. */\n  targetDir: z.string().default('imports'),\n  /** Per-file byte cap. Default 100 MiB. */\n  maxBytes: z.number().int().min(1024).max(10_737_418_240).default(104_857_600),\n  /** When false, the route rejects `onConflict: 'overwrite'`. Default true. */\n  allowOverwrite: z.boolean().default(true),\n});\nexport type WorkspaceImportConfig = z.infer<typeof WorkspaceImportConfigSchema>;\n\nexport const WorkspaceConfigSchema = z.object({\n  import: WorkspaceImportConfigSchema.optional(),\n}).optional();\nexport type WorkspaceConfig = z.infer<typeof WorkspaceConfigSchema>;\n\nexport const GatewayBindModeSchema = z.enum(['auto', 'loopback', 'lan', 'tailnet', 'custom']);\n\nexport const GatewayConfigSchema = z.object({\n  /** Semantic bind mode. */\n  bind: GatewayBindModeSchema.optional(),\n  /** IPv4 listen address when `bind` is `custom`. */\n  customBindHost: z.string().optional(),\n  port: z.number().optional(),\n  /** local: this process runs the gateway; remote: CLI clients target gateway.remote. */\n  mode: GatewayModeSchema.optional(),\n  /** Persistent remote gateway target for CLI/TUI/MCP when mode=remote. */\n  remote: GatewayRemoteSchema.optional(),\n  tailscale: GatewayTailscaleSchema.optional(),\n  tls: GatewayTlsSchema.optional(),\n  auth: GatewayAuthSchema.optional(),\n  heartbeat: HeartbeatConfigSchema.optional(),\n  maxSseConnections: z.number().optional(),\n  corsOrigins: z.array(z.string()).optional(),\n  /**\n   * Reverse-proxy publicly reachable URL (e.g. `https://gateway.example.com`).\n   * Optional. When set, mobile pairing surfaces this URL as the preferred\n   * baseUrl and it is auto-added to the browser CORS/CSRF allowlist.\n   * - Must be a URL with no path / query / userinfo.\n   * - Must use `https:` for public hosts; `http:` is only allowed when the\n   *   hostname is in an RFC1918 / `.local` private range.\n   */\n  publicUrl: z\n    .string()\n    .superRefine((value, ctx) => {\n      const result = validatePublicUrl(value);\n      if (result.ok === false) {\n        ctx.addIssue({ code: 'custom', message: `gateway.publicUrl: ${result.message}` });\n      }\n    })\n    .optional(),\n  /** Dangerous: allow browser Origin to match the HTTP Host header when not in corsOrigins. */\n  dangerouslyAllowHostHeaderOriginFallback: z.boolean().optional(),\n  /** CIDRs or exact IPs of reverse proxies allowed to terminate auth (trusted-proxy mode). */\n  trustedProxies: z.array(z.string()).optional(),\n  /** When true, fall back to X-Real-IP if X-Forwarded-For chain parsing fails. Default false (fail closed). */\n  allowRealIpFallback: z.boolean().optional(),\n  security: GatewaySecuritySchema,\n  /**\n   * How channel `start()` is split around HTTP listen when using `GatewayServer`.\n   * - `auto` (default): defer ids come from channel plugin `meta.deferConnectUntilAfterListen` + enabled config.\n   * - `off`: always start all channels in phase1 (troubleshooting / strict ordering).\n   * - `explicit`: defer only `channelConnectDeferIds` (empty = defer none).\n   */\n  channelConnectDeferMode: GatewayChannelConnectDeferModeSchema.optional(),\n  /** When `channelConnectDeferMode` is `explicit`, these channel plugin ids are deferred until after listen. */\n  channelConnectDeferIds: z.array(z.string().min(1)).max(24).optional(),\n  /** Removed from the defer set (applied after `auto` or `explicit` resolution). */\n  channelConnectDeferSkipIds: z.array(z.string().min(1)).max(24).optional(),\n  /** Default skills marketplace provider id. Built-in: 'store', 'skillhub', 'clawhub'. Extensions may register more. */\n  skillsMarketplaceProvider: z.string().optional(),\n  /** Base URL for the xopc skills marketplace (public REST API). */\n  skillsStoreBaseUrl: z.string().url().optional(),\n  /** File sharing configuration (temporary public download links for workspace files). */\n  share: z.object({\n    enabled: z.boolean().default(true),\n    /** Default TTL in ms (default 24h). */\n    defaultTtlMs: z.number().min(60_000).max(604_800_000).default(86_400_000),\n    /** Maximum TTL in ms (default 7 days). */\n    maxTtlMs: z.number().min(60_000).max(2_592_000_000).default(604_800_000),\n    /** Maximum concurrent active shares (default 100). */\n    maxActiveShares: z.number().min(1).max(10_000).default(100),\n    /** Maximum shareable file size in bytes (default 100MB). */\n    maxFileSize: z.number().min(1_048_576).max(10_737_418_240).default(104_857_600),\n    /** MIME types allowed for inline preview (?inline=1). */\n    inlinePreviewMimes: z.array(z.string()).default([\n      'image/png',\n      'image/jpeg',\n      'image/gif',\n      'image/webp',\n      'image/svg+xml',\n      'application/pdf',\n      'text/html',\n      'text/markdown',\n      'text/plain',\n      'application/json',\n    ]),\n    /** Folder-sharing controls (browse + ZIP). */\n    directory: z.object({\n      enabled: z.boolean().default(true),\n      /** Maximum folder size in bytes at scan time (default 1 GB). */\n      maxFolderSize: z.number().int().min(1_048_576).max(10_737_418_240).default(1_073_741_824),\n      /** Maximum number of entries scanned for a single folder share. */\n      maxFileCount: z.number().int().min(1).max(100_000).default(1_000),\n      /** Traversal depth cap (defense against recursive symlinks). */\n      maxDepth: z.number().int().min(1).max(64).default(20),\n      /** In-memory directory listing cache TTL. */\n      listingCacheMs: z.number().int().min(0).max(600_000).default(60_000),\n      /** Maximum simultaneous ZIP streams per share token. */\n      zipConcurrency: z.number().int().min(1).max(8).default(1),\n    }).default({\n      enabled: true,\n      maxFolderSize: 1_073_741_824,\n      maxFileCount: 1_000,\n      maxDepth: 20,\n      listingCacheMs: 60_000,\n      zipConcurrency: 1,\n    }),\n  }).optional(),\n  /** Site-share configuration (static directory or reverse-proxy a local dev server). */\n  siteShare: z.object({\n    enabled: z.boolean().default(true),\n    /** Public host suffix that subdomain shares are served under. */\n    publicHostSuffix: z.string().min(1).default('share.xopc.ai'),\n    /** Default TTL in ms (default 6h, shorter than file shares — live app surface). */\n    defaultTtlMs: z.number().int().min(60_000).max(604_800_000).default(21_600_000),\n    /** Maximum TTL in ms (default 7 days). */\n    maxTtlMs: z.number().int().min(60_000).max(2_592_000_000).default(604_800_000),\n    /** Maximum concurrent active site shares. */\n    maxActiveSites: z.number().int().min(1).max(1_000).default(5),\n    static: z.object({\n      enabled: z.boolean().default(true),\n      /** Maximum total bytes of files served per static site. */\n      maxRootDirSize: z.number().int().min(1_048_576).max(10_737_418_240).default(524_288_000),\n      /** Maximum file count under root dir. */\n      maxFileCount: z.number().int().min(1).max(100_000).default(10_000),\n      /** Whether HTML/CSS rewrite of absolute paths is on by default. */\n      rewriteEnabledByDefault: z.boolean().default(false),\n    }).default({\n      enabled: true,\n      maxRootDirSize: 524_288_000,\n      maxFileCount: 10_000,\n      rewriteEnabledByDefault: false,\n    }),\n    proxy: z.object({\n      /** Reverse-proxy mode default-enabled per the product brief. */\n      enabled: z.boolean().default(true),\n      /** Upstream host whitelist. Loopback by default. */\n      allowedUpstreamHosts: z\n        .array(z.string().min(1))\n        .default(['127.0.0.1', 'localhost', '::1']),\n      /** Upstream port whitelist (common dev-server ports). */\n      allowedUpstreamPorts: z\n        .array(z.number().int().min(1).max(65535))\n        .default([3000, 3001, 4321, 5173, 8000, 8080, 8888, 9000]),\n      /** Whether to forward WebSocket upgrades. */\n      forwardWebSocket: z.boolean().default(true),\n      /** Maximum request body size in bytes (50 MB). */\n      bodySizeLimit: z.number().int().min(0).max(1_073_741_824).default(52_428_800),\n      /** Per-request HTTP timeout in ms. */\n      requestTimeoutMs: z.number().int().min(1_000).max(600_000).default(30_000),\n      /** Per-WebSocket idle timeout in ms. */\n      wsIdleTimeoutMs: z.number().int().min(10_000).max(3_600_000).default(300_000),\n      /** Rewrite Set-Cookie Path attribute (subpath mode only). */\n      rewriteSetCookiePath: z.boolean().default(true),\n    }).default({\n      enabled: true,\n      allowedUpstreamHosts: ['127.0.0.1', 'localhost', '::1'],\n      allowedUpstreamPorts: [3000, 3001, 4321, 5173, 8000, 8080, 8888, 9000],\n      forwardWebSocket: true,\n      bodySizeLimit: 52_428_800,\n      requestTimeoutMs: 30_000,\n      wsIdleTimeoutMs: 300_000,\n      rewriteSetCookiePath: true,\n    }),\n  }).optional(),\n}).default({\n  bind: 'loopback',\n  port: 18790,\n  auth: {\n    mode: 'token',\n  },\n  heartbeat: {\n    enabled: true,\n    intervalMs: 1_800_000,\n    includeSystemPromptSection: false,\n  },\n  maxSseConnections: 100,\n  corsOrigins: [],\n  skillsMarketplaceProvider: 'store',\n  skillsStoreBaseUrl: 'https://store.xopc.ai',\n});\n\nexport const ModelsDevConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n}).default({\n  enabled: true,\n});\n\n// ============================================\n// STT (Speech-to-Text) Config\n// ============================================\n\nconst SttProviderConfigCatchallSchema = z.union([\n  z.string(),\n  z.number(),\n  z.boolean(),\n  z.null(),\n  z.array(z.unknown()),\n  z.record(z.string(), z.unknown()),\n]);\n\nexport const STTProviderConfigSchema = z\n  .object({\n    apiKey: z.string().optional(),\n    model: z.string().optional(),\n    baseUrl: z.string().optional(),\n    headers: z.record(z.string(), z.string()).optional(),\n    language: z.string().optional(),\n    prompt: z.string().optional(),\n  })\n  .catchall(SttProviderConfigCatchallSchema);\n\nexport const STTFallbackConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  order: z.array(z.string().min(1)).default(['alibaba', 'openai']),\n});\n\nexport const MediaUnderstandingCapabilitiesSchema = z\n  .array(z.enum(['image', 'audio', 'video']))\n  .optional();\n\nexport const MediaUnderstandingModelSchema = z\n  .object({\n    provider: z.string().optional(),\n    model: z.string().optional(),\n    capabilities: MediaUnderstandingCapabilitiesSchema,\n    type: z.union([z.literal('provider'), z.literal('cli')]).optional(),\n    command: z.string().optional(),\n    baseUrl: z.string().optional(),\n    headers: z.record(z.string(), z.string()).optional(),\n    apiKey: z.string().optional(),\n    language: z.string().optional(),\n    prompt: z.string().optional(),\n  })\n  .catchall(SttProviderConfigCatchallSchema);\n\nexport const STTConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    /** Primary provider id — any registered MediaUnderstandingProvider id. */\n    provider: z.string().min(1).default('alibaba'),\n    fallback: STTFallbackConfigSchema.optional(),\n    timeoutMs: z.number().int().min(1000).max(180000).optional(),\n    /** Ordered model entries for this capability (OpenClaw `tools.media.audio.models`). */\n    models: z.array(MediaUnderstandingModelSchema).optional(),\n    /** Provider settings map keyed by provider id. */\n    providers: z.record(z.string(), STTProviderConfigSchema).optional(),\n  })\n  .strict();\n\n// ============================================\n// TTS (Text-to-Speech) Config\n// ============================================\n\nconst TtsProviderConfigCatchallSchema = z.union([\n  z.string(),\n  z.number(),\n  z.boolean(),\n  z.null(),\n  z.array(z.unknown()),\n  z.record(z.string(), z.unknown()),\n]);\n\nexport const TTSProviderConfigSchema = z\n  .object({\n    apiKey: z.string().optional(),\n    model: z.string().optional(),\n    voice: z.string().optional(),\n  })\n  .catchall(TtsProviderConfigCatchallSchema);\n\nexport const TTSFallbackConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  order: z\n    .array(z.string().min(1))\n    .default(['openai', 'alibaba', 'minimax', 'edge']),\n});\n\nexport const TTSModelOverridesConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  allowText: z.boolean().default(true),\n  allowProvider: z.boolean().default(false),\n  allowVoice: z.boolean().default(true),\n  allowModelId: z.boolean().default(true),\n  allowVoiceSettings: z.boolean().default(false),\n  allowNormalization: z.boolean().default(false),\n  allowSeed: z.boolean().default(false),\n});\n\nexport const TTSEdgeConfigSchema = z.object({\n  enabled: z.boolean().default(true),\n  voice: z.string().optional(),\n  lang: z.string().optional(),\n  outputFormat: z.string().optional(),\n  pitch: z.string().optional(),\n  rate: z.string().optional(),\n  volume: z.string().optional(),\n  proxy: z.string().optional(),\n  timeoutMs: z.number().int().min(1000).max(120000).optional(),\n});\n\nexport const TTSSummarizationConfigSchema = z.object({\n  enabled: z.boolean().optional(),\n  targetLength: z.number().int().min(1).optional(),\n  threshold: z.number().int().min(1).optional(),\n  model: z.string().optional(),\n});\n\nexport const TTSConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    /** Primary provider id — any registered SpeechProviderPlugin id. */\n    provider: z.string().min(1).default('edge'),\n    trigger: z.enum(['off', 'always', 'inbound', 'tagged']).default('always'),\n    fallback: TTSFallbackConfigSchema.optional(),\n    maxTextLength: z.number().int().min(1).default(512), // Conservative default to accommodate all providers (Alibaba limit is 512)\n    timeoutMs: z.number().int().min(1000).max(180000).default(60000),\n    summarization: TTSSummarizationConfigSchema.optional(),\n    modelOverrides: TTSModelOverridesConfigSchema.optional(),\n    /** Provider settings map keyed by provider id. */\n    providers: z.record(z.string(), TTSProviderConfigSchema).optional(),\n  })\n  .strict();\n\n// ============================================\n// messages.* — delivery / presentation concerns\n// ============================================\n\nexport const MessagesConfigSchema = z.object({\n  /** Voice (text-to-speech) output configuration. */\n  tts: TTSConfigSchema.optional(),\n}).optional();\n\nexport const ToolsMediaAudioConfigSchema = STTConfigSchema;\n\nexport const ToolsMediaConfigSchema = z\n  .object({\n    /** Shared model entries applied across media capabilities when entry lacks capabilities. */\n    models: z.array(MediaUnderstandingModelSchema).optional(),\n    /** Audio (speech-to-text) capability provider config. */\n    audio: ToolsMediaAudioConfigSchema.optional(),\n  })\n  .optional();\n\n// ============================================\n// Provider Configs (capability providers: image / audio / video)\n// ============================================\n\n/**\n * Optional Azure OpenAI overrides used when an OpenAI image-generation\n * request should hit an Azure deployment instead of `api.openai.com`.\n *\n * URL template (when present):\n *   `https://<resource>.openai.azure.com/openai/deployments/<deployment>/images/generations?api-version=<apiVersion>`\n */\nexport const ProviderAzureConfigSchema = z\n  .object({\n    /** Azure resource name (subdomain before `.openai.azure.com`). */\n    resource: z.string().min(1).optional(),\n    /** Azure deployment id (configured per model). */\n    deployment: z.string().min(1).optional(),\n    /** Azure REST API version, e.g. `2024-08-01-preview`. */\n    apiVersion: z.string().min(1).optional(),\n  })\n  .strict();\n\n/** Per-vendor request overrides applied by the provider HTTP layer. */\nexport const ProviderRequestOverridesSchema = z\n  .object({\n    /** Hard cap for a single HTTP call (ms). */\n    timeoutMs: z.number().int().positive().optional(),\n    /** Extra headers merged into every outbound request. */\n    headers: z.record(z.string(), z.string()).optional(),\n  })\n  .strict();\n\n/**\n * Generic per-vendor provider config — used by image / audio / video\n * capability providers via `cfg.providers.<id>`. Kept loose (`.strict()` but\n * everything optional) so adding a new vendor never requires a config\n * migration.\n */\nexport const ProviderAuthConfigSchema = z\n  .object({\n    /** Static API key (api-key / azure-key modes). */\n    apiKey: z.string().optional(),\n    /** Override the default REST base URL. */\n    baseUrl: z.string().url().optional(),\n    /** Vendor region (DashScope: `beijing` / `singapore`; AWS: region id). */\n    region: z.string().optional(),\n    /** Image-only base URL override (DashScope splits image vs LLM). */\n    imageBaseUrl: z.string().url().optional(),\n    /** Per-vendor request overrides. */\n    request: ProviderRequestOverridesSchema.optional(),\n    /** Azure OpenAI deployment overrides; only consumed by OpenAI image provider. */\n    azure: ProviderAzureConfigSchema.optional(),\n  })\n  .strict();\n\nexport type ProviderAuthConfig = z.infer<typeof ProviderAuthConfigSchema>;\n\n/**\n * `cfg.providers.<id>` is keyed by provider id (`openai`, `dashscope`,\n * `minimax`, `google`, `fal`, …). Every entry is optional and validated by\n * {@link ProviderAuthConfigSchema}.\n */\nexport const ProvidersConfigSchema = z.record(z.string(), ProviderAuthConfigSchema);\n\nexport type ProvidersConfig = z.infer<typeof ProvidersConfigSchema>;\n\n// ============================================\n// Extension Configs \n// ============================================\n\n// Security config for extensions \nexport const ExtensionSecurityConfigSchema = z.object({\n  checkPermissions: z.boolean().default(true),\n  allowUntrusted: z.boolean().default(false),\n  allow: z.array(z.string()).default([]),\n  trackProvenance: z.boolean().default(true),\n  allowPromptInjection: z.boolean().default(false),\n});\n\n// Slot config for extensions \nexport const ExtensionSlotsConfigSchema = z.object({\n  memory: z.string().optional(),\n  tts: z.string().optional(),\n  imageGeneration: z.string().optional(),\n  webSearch: z.string().optional(),\n});\n\n// Complete extensions config\n// Extension config allows both known fields AND arbitrary extension-specific config\n// Known fields: enabled (array), allow (array), security (object), slots (object)\n// Arbitrary: any other key is extension-specific config (e.g., extensions.hello.greeting)\nexport const ExtensionsConfigSchema: z.ZodType<Record<string, unknown>> = z.record(z.string(), z.unknown());\n\n// ============================================\n// Update Config\n// ============================================\n\nexport const UpdateAutoConfigSchema = z\n  .object({\n    /** Enable automatic update installation. Default false. */\n    enabled: z.boolean().default(false),\n    /** Hours to wait before applying a stable update after first detection. */\n    stableDelayHours: z.number().min(0).default(6),\n    /** Additional random jitter hours for stable rollout (avoids thundering herd). */\n    stableJitterHours: z.number().min(0).default(12),\n    /** How often to re-check for beta updates (hours). Min 0.25. */\n    betaCheckIntervalHours: z.number().min(0.25).default(1),\n  })\n  .strict()\n  .optional();\n\n/** Persistent `/goal` (Ralph loop) — Hermes-aligned defaults. */\nexport const GoalNotificationEventSchema = z.enum([\n  'done',\n  'blocked',\n  'needs_input',\n  'queue_failed',\n  'queue_retry',\n  'queue_succeeded',\n  'queue_skipped',\n]);\n\nexport const GoalNotificationTargetSchema = z\n  .object({\n    channel: z.string().min(1),\n    chatId: z.string().min(1),\n    accountId: z.string().optional(),\n    threadId: z.union([z.string(), z.number()]).optional(),\n    silent: z.boolean().optional(),\n    events: z.array(GoalNotificationEventSchema).optional(),\n  })\n  .strict();\n\nexport const GoalNotificationsConfigSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    /** Notify Telegram/Weixin chats bound to the goal activeSessionKey. */\n    includeLinkedSessions: z.boolean().default(true),\n    /** Channels eligible for linked-session notifications. */\n    channels: z.array(z.string().min(1)).default(['telegram', 'weixin']),\n    events: z\n      .array(GoalNotificationEventSchema)\n      .default(['done', 'blocked', 'needs_input', 'queue_failed', 'queue_retry']),\n    targets: z.array(GoalNotificationTargetSchema).default([]),\n  })\n  .strict()\n  .default({\n    enabled: false,\n    includeLinkedSessions: true,\n    channels: ['telegram', 'weixin'],\n    events: ['done', 'blocked', 'needs_input', 'queue_failed', 'queue_retry'],\n    targets: [],\n  });\n\nexport const GoalsConfigSchema = z\n  .object({\n    /** Max continuation turns before auto-pause (Hermes default 20). */\n    maxTurns: z.number().int().min(1).max(500).default(20),\n    /** Optional judge model ref; defaults to the active agent model. */\n    judgeModelRef: z.string().optional(),\n    /**\n     * When true (default), first post-turn runs a decomposition judge to build a checklist;\n     * subsequent turns evaluate progress per item (Hermes-style). When false, use legacy freeform judge only.\n     */\n    checklistMode: z.boolean().default(true),\n    /**\n     * empty_only preserves legacy behavior: the first post-turn decomposition runs only when the\n     * goal has no checklist. supplement_existing lets the first post-turn add non-duplicate judge\n     * criteria even when the user supplied initial acceptance criteria.\n     */\n    checklistDecomposePolicy: z.enum(['empty_only', 'supplement_existing']).default('empty_only'),\n    /** Auto-pause after this many consecutive judge JSON/tool parse failures (Hermes default 3). */\n    maxConsecutiveParseFailures: z.number().int().min(1).max(20).default(3),\n    /** Judge LLM call timeout in ms (Hermes uses 60s). */\n    judgeTimeoutMs: z.number().int().min(5_000).max(120_000).default(60_000),\n    /** Max characters of recent transcript JSON passed to the checklist judge as extra context. */\n    checklistHistoryChars: z.number().int().min(0).max(100_000).default(24_000),\n    /** External channel notification policy for durable goal lifecycle events. */\n    notifications: GoalNotificationsConfigSchema,\n  })\n  .strict();\n\nexport type GoalsConfig = z.infer<typeof GoalsConfigSchema>;\n\nexport const UpdateConfigSchema = z\n  .object({\n    /** Check for updates on gateway startup. Default true. */\n    checkOnStart: z.boolean().default(true),\n    /** Update channel: stable (default), beta, or dev. */\n    channel: z.enum(['stable', 'beta', 'dev']).default('stable'),\n    /** Automatic update policy. */\n    auto: UpdateAutoConfigSchema,\n  })\n  .strict()\n  .optional();\n\nexport type UpdateConfig = z.infer<typeof UpdateConfigSchema>;\n\nexport const CommandsConfigSchema = z\n  .object({\n    restart: z.boolean().optional(),\n  })\n  .strict()\n  .optional();\n\nexport type CommandsConfig = z.infer<typeof CommandsConfigSchema>;\n\nexport const TuiConfigSchema = z\n  .object({\n    /** Default agent id for fresh TUI sessions. Leaves global routing (`agents.default`) untouched. */\n    defaultAgent: z.string().min(1).optional(),\n  })\n  .strict()\n  .default({});\n\nexport type TuiConfig = z.infer<typeof TuiConfigSchema>;\n\n// ============================================\n// MCP (Model Context Protocol)\n// ============================================\n\nconst McpHttpUrlSchema = z\n  .string()\n  .url()\n  .refine((value) => {\n    try {\n      const protocol = new URL(value).protocol;\n      return protocol === 'http:' || protocol === 'https:';\n    } catch {\n      return false;\n    }\n  }, 'MCP server URL must use http or https');\n\nconst ConnectorSecretReferenceSchema = z.object({\n  xopcSecretRef: z.object({\n    provider: z.string().min(1),\n    fieldKey: z.string().min(1),\n  }),\n});\n\nconst McpConfigScalarSchema = z.union([z.string(), z.number(), z.boolean(), ConnectorSecretReferenceSchema]);\n\nexport const McpServerSchema = z\n  .object({\n    command: z.string().optional(),\n    args: z.array(z.string()).optional(),\n    env: z.record(z.string(), McpConfigScalarSchema).optional(),\n    cwd: z.string().optional(),\n    workingDirectory: z.string().optional(),\n    url: McpHttpUrlSchema.optional(),\n    transport: z.enum(['sse', 'streamable-http']).optional(),\n    headers: z.record(z.string(), McpConfigScalarSchema).optional(),\n    connectionTimeoutMs: z.number().finite().positive().optional(),\n  })\n  .catchall(z.unknown())\n  .superRefine((value, ctx) => {\n    const hasCommand = typeof value.command === 'string' && value.command.trim().length > 0;\n    const hasUrl = typeof value.url === 'string' && value.url.trim().length > 0;\n    if (hasCommand && hasUrl) {\n      ctx.addIssue({\n        code: 'custom',\n        message: 'MCP server cannot define both command and url',\n      });\n    }\n  });\n\nexport const McpConfigSchema = z\n  .object({\n    servers: z.record(z.string(), McpServerSchema).optional(),\n    sessionIdleTtlMs: z.number().finite().min(0).optional(),\n  })\n  .strict()\n  .optional();\n\nexport type McpServerConfig = z.infer<typeof McpServerSchema>;\nexport type McpConfig = z.infer<typeof McpConfigSchema>;\n\nexport const ConnectorsConfigSchema = z\n  .object({\n    instances: z.record(z.string(), z.record(z.string(), z.unknown())).optional(),\n  })\n  .strict()\n  .optional();\n\nexport type ConnectorsConfig = z.infer<typeof ConnectorsConfigSchema>;\n\n// ============================================\n// Root Config\n// ============================================\n\nexport const ConfigSchema = z.object({\n  agents: AgentsConfigSchema,\n  bindings: BindingsConfigSchema,\n  session: SessionConfigSchema,\n  channels: ChannelsConfigSchema,\n  gateway: GatewayConfigSchema,\n  browser: BrowserConfigSchema,\n  tunnel: TunnelConfigSchema.optional(),\n  workspace: WorkspaceConfigSchema,\n  tools: ToolsConfigSchema,\n  mcp: McpConfigSchema,\n  connectors: ConnectorsConfigSchema,\n  goals: GoalsConfigSchema.optional(),\n  extensions: ExtensionsConfigSchema.default({}),\n  /** Per-vendor capability provider config (image / audio / video). */\n  providers: ProvidersConfigSchema.optional(),\n  modelsDev: ModelsDevConfigSchema,\n  /** Delivery / presentation concerns (currently `tts`). */\n  messages: MessagesConfigSchema,\n  update: UpdateConfigSchema,\n  commands: CommandsConfigSchema,\n  tui: TuiConfigSchema,\n}).default({\n  agents: {\n    default: 'main',\n    defaultPreset: DEFAULT_CAPABILITY_PRESET_ID,\n    capabilityPresets: {\n      [DEFAULT_CAPABILITY_PRESET_ID]: {\n        id: DEFAULT_CAPABILITY_PRESET_ID,\n        name: 'Global defaults',\n        description: 'Default capabilities inherited by every agent.',\n        version: 1,\n        models: DEFAULT_AGENT_MODELS,\n      },\n    },\n    list: [\n      {\n        id: 'main',\n        enabled: true,\n        identity: {\n          name: 'Main',\n          role: 'General assistant',\n          language: 'en',\n          tone: 'direct',\n        },\n        responsibilities: {\n          primary: ['Help the user complete tasks'],\n        },\n        workspace: { root: '~/.xopc/workspace/main' },\n        tools: { builtin: {} },\n        skills: { mode: 'all' },\n        memory: {\n          mode: 'confirmWrite',\n          sources: ['session', 'curated'],\n          writePolicy: { curated: 'confirm' },\n        },\n        workflows: {},\n        boundaries: { requiresConfirmation: [], forbidden: [], escalation: [] },\n      },\n    ],\n  },\n  bindings: [],\n  session: {\n    scope: 'per-sender' as const,\n    mainKey: 'main',\n    dmScope: 'main' as const,\n  },\n  channels: {\n    telegram: {\n      enabled: false,\n      debug: false,\n      defaults: {\n        dmPolicy: 'pairing' as const,\n        groupPolicy: 'open' as const,\n        replyToMode: 'off' as const,\n        historyLimit: 50,\n        textChunkLimit: 4000,\n        streaming: { mode: 'partial' as const },\n      },\n      accounts: {\n        default: {\n          accountId: 'default',\n          enabled: true,\n          botToken: '',\n          allowFrom: [],\n          groupAllowFrom: [],\n        },\n      },\n    },\n  },\n  gateway: {\n    bind: 'loopback',\n    port: 18790,\n    auth: {\n      mode: 'token',\n    },\n    heartbeat: {\n      enabled: true,\n      intervalMs: 1_800_000,\n      includeSystemPromptSection: false,\n    },\n    maxSseConnections: 100,\n    corsOrigins: [],\n    skillsMarketplaceProvider: 'store',\n    skillsStoreBaseUrl: 'https://store.xopc.ai',\n  },\n  browser: {\n    enabled: true,\n    backend: 'extension' as const,\n  },\n  tools: {\n    web: {\n      search: {\n        maxResults: 5,\n        providers: [],\n      },\n    },\n  },\n  goals: {\n    maxTurns: 20,\n    checklistMode: true,\n    checklistDecomposePolicy: 'empty_only',\n    maxConsecutiveParseFailures: 3,\n    judgeTimeoutMs: 60_000,\n    checklistHistoryChars: 24_000,\n    notifications: {\n      enabled: false,\n      includeLinkedSessions: true,\n      channels: ['telegram', 'weixin'],\n      events: ['done', 'blocked', 'needs_input', 'queue_failed', 'queue_retry'],\n      targets: [],\n    },\n  },\n  extensions: {\n    allow: [],\n    security: {\n      checkPermissions: true,\n      allowUntrusted: false,\n      allow: [],\n      trackProvenance: true,\n      allowPromptInjection: false,\n    },\n    slots: {},\n  },\n  modelsDev: {\n    enabled: true,\n  },\n  tui: {},\n  // messages.tts / tools.media.audio start undefined; the factory layer fills\n  // in provider-level defaults (model/voice) on demand. Fresh configs don't\n  // ship with enabled providers so they never make surprise STT/TTS calls.\n});\n\nexport type Config = z.infer<typeof ConfigSchema>;\nexport type GatewayAuthConfig = z.infer<typeof GatewayAuthSchema>;\nexport type GatewayTrustedProxyConfig = z.infer<typeof GatewayTrustedProxySchema>;\nexport type GatewayAuthRateLimitConfig = z.infer<typeof GatewayAuthRateLimitSchema>;\nexport type GatewayBindMode = z.infer<typeof GatewayBindModeSchema>;\nexport type STTConfig = z.infer<typeof STTConfigSchema>;\nexport type TTSConfig = z.infer<typeof TTSConfigSchema>;\n\n// ============================================\n// Helper Functions\n// ============================================\n\n/**\n * Parse a model reference string.\n */\nexport interface ParsedModelRef {\n  provider: string;\n  model: string;\n}\n\nexport function getAgentDefaultModelRef(config: Config): string | undefined {\n  const list = Array.isArray(config.agents?.list) ? config.agents.list : [];\n  const defaultId =\n    config.agents?.default?.trim() ||\n    list.find((entry) => (entry as { default?: boolean }).default === true)?.id?.trim() ||\n    list[0]?.id;\n  const agent = list.find((entry) => entry.enabled !== false && entry.id === defaultId) ?? list[0];\n  if (!agent) return undefined;\n\n  let modelRef: string | undefined;\n  const visited = new Set<string>();\n  const applyModels = (models: AgentModelsConfig | undefined): void => {\n    const roles = models?.roles ?? {};\n    const defaultRole = models?.defaultRole ?? Object.keys(roles)[0];\n    const role = defaultRole ? roles[defaultRole] : undefined;\n    const next = role?.model.trim();\n    if (next) modelRef = next;\n  };\n  const applyPreset = (presetId: string): void => {\n    if (visited.has(presetId)) return;\n    visited.add(presetId);\n    const preset = config.agents.capabilityPresets[presetId];\n    if (!preset) return;\n    for (const parent of preset.extends ?? []) {\n      applyPreset(parent);\n    }\n    applyModels(preset.models);\n  };\n\n  applyPreset(config.agents.defaultPreset);\n  for (const presetId of agent.extends ?? []) {\n    if (presetId !== config.agents.defaultPreset) {\n      applyPreset(presetId);\n    }\n  }\n  applyModels(agent.models);\n  return modelRef;\n}\n\nfunction getAgentDefaultModelsConfig(config: Config): AgentModelsConfig | undefined {\n  const list = Array.isArray(config.agents?.list) ? config.agents.list : [];\n  const defaultId =\n    config.agents?.default?.trim() ||\n    list.find((entry) => (entry as { default?: boolean }).default === true)?.id?.trim() ||\n    list[0]?.id;\n  const agent = list.find((entry) => entry.enabled !== false && entry.id === defaultId) ?? list[0];\n  if (!agent) return undefined;\n\n  let modelConfig: AgentModelsConfig | undefined;\n  const visited = new Set<string>();\n  const applyModels = (models: AgentModelsConfig | undefined): void => {\n    if (!models) return;\n    modelConfig = {\n      ...modelConfig,\n      ...models,\n      roles: {\n        ...(modelConfig?.roles ?? {}),\n        ...(models.roles ?? {}),\n      },\n    };\n  };\n  const applyPreset = (presetId: string): void => {\n    if (visited.has(presetId)) return;\n    visited.add(presetId);\n    const preset = config.agents.capabilityPresets[presetId];\n    if (!preset) return;\n    for (const parent of preset.extends ?? []) {\n      applyPreset(parent);\n    }\n    applyModels(preset.models);\n  };\n\n  applyPreset(config.agents.defaultPreset);\n  for (const presetId of agent.extends ?? []) {\n    if (presetId !== config.agents.defaultPreset) {\n      applyPreset(presetId);\n    }\n  }\n  applyModels(agent.models);\n  return modelConfig;\n}\n\nexport function getAgentDefaultImageModelConfig(config: Config): AgentModelConfig | undefined {\n  return getAgentDefaultModelsConfig(config)?.imageModel;\n}\n\nexport function getAgentDefaultImageGenerationModelConfig(\n  config: Config,\n): AgentImageGenerationModelConfig | undefined {\n  return getAgentDefaultModelsConfig(config)?.imageGenerationModel;\n}\n\n/** `provider/model` or null when invalid. */\nexport function parseModelRef(ref: string): ParsedModelRef | null {\n  const trimmed = ref.trim();\n  const idx = trimmed.indexOf('/');\n  if (idx <= 0 || idx === trimmed.length - 1) {\n    return null;\n  }\n  return { provider: trimmed.slice(0, idx).trim(), model: trimmed.slice(idx + 1).trim() };\n}\n"],"mappings":";;;;;;;;;AAsyCA,SAAgB,wBAAwB,QAAoC;CAC1E,MAAM,OAAO,MAAM,QAAQ,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,OAAO,EAAE;CACzE,MAAM,YACJ,OAAO,QAAQ,SAAS,MAAM,IAC9B,KAAK,MAAM,UAAW,MAAgC,YAAY,KAAK,EAAE,IAAI,MAAM,IACnF,KAAK,IAAI;CACX,MAAM,QAAQ,KAAK,MAAM,UAAU,MAAM,YAAY,SAAS,MAAM,OAAO,UAAU,IAAI,KAAK;AAC9F,KAAI,CAAC,MAAO,QAAO,KAAA;CAEnB,IAAI;CACJ,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,eAAe,WAAgD;EACnE,MAAM,QAAQ,QAAQ,SAAS,EAAE;EACjC,MAAM,cAAc,QAAQ,eAAe,OAAO,KAAK,MAAM,CAAC;EAE9D,MAAM,QADO,cAAc,MAAM,eAAe,KAAA,IAC7B,MAAM,MAAM;AAC/B,MAAI,KAAM,YAAW;;CAEvB,MAAM,eAAe,aAA2B;AAC9C,MAAI,QAAQ,IAAI,SAAS,CAAE;AAC3B,UAAQ,IAAI,SAAS;EACrB,MAAM,SAAS,OAAO,OAAO,kBAAkB;AAC/C,MAAI,CAAC,OAAQ;AACb,OAAK,MAAM,UAAU,OAAO,WAAW,EAAE,CACvC,aAAY,OAAO;AAErB,cAAY,OAAO,OAAO;;AAG5B,aAAY,OAAO,OAAO,cAAc;AACxC,MAAK,MAAM,YAAY,MAAM,WAAW,EAAE,CACxC,KAAI,aAAa,OAAO,OAAO,cAC7B,aAAY,SAAS;AAGzB,aAAY,MAAM,OAAO;AACzB,QAAO;;AAGT,SAAS,4BAA4B,QAA+C;CAClF,MAAM,OAAO,MAAM,QAAQ,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,OAAO,EAAE;CACzE,MAAM,YACJ,OAAO,QAAQ,SAAS,MAAM,IAC9B,KAAK,MAAM,UAAW,MAAgC,YAAY,KAAK,EAAE,IAAI,MAAM,IACnF,KAAK,IAAI;CACX,MAAM,QAAQ,KAAK,MAAM,UAAU,MAAM,YAAY,SAAS,MAAM,OAAO,UAAU,IAAI,KAAK;AAC9F,KAAI,CAAC,MAAO,QAAO,KAAA;CAEnB,IAAI;CACJ,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,eAAe,WAAgD;AACnE,MAAI,CAAC,OAAQ;AACb,gBAAc;GACZ,GAAG;GACH,GAAG;GACH,OAAO;IACL,GAAI,aAAa,SAAS,EAAE;IAC5B,GAAI,OAAO,SAAS,EAAE;IACvB;GACF;;CAEH,MAAM,eAAe,aAA2B;AAC9C,MAAI,QAAQ,IAAI,SAAS,CAAE;AAC3B,UAAQ,IAAI,SAAS;EACrB,MAAM,SAAS,OAAO,OAAO,kBAAkB;AAC/C,MAAI,CAAC,OAAQ;AACb,OAAK,MAAM,UAAU,OAAO,WAAW,EAAE,CACvC,aAAY,OAAO;AAErB,cAAY,OAAO,OAAO;;AAG5B,aAAY,OAAO,OAAO,cAAc;AACxC,MAAK,MAAM,YAAY,MAAM,WAAW,EAAE,CACxC,KAAI,aAAa,OAAO,OAAO,cAC7B,aAAY,SAAS;AAGzB,aAAY,MAAM,OAAO;AACzB,QAAO;;AAGT,SAAgB,gCAAgC,QAA8C;AAC5F,QAAO,4BAA4B,OAAO,EAAE;;AAG9C,SAAgB,0CACd,QAC6C;AAC7C,QAAO,4BAA4B,OAAO,EAAE;;;AAI9C,SAAgB,cAAc,KAAoC;CAChE,MAAM,UAAU,IAAI,MAAM;CAC1B,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAChC,KAAI,OAAO,KAAK,QAAQ,QAAQ,SAAS,EACvC,QAAO;AAET,QAAO;EAAE,UAAU,QAAQ,MAAM,GAAG,IAAI,CAAC,MAAM;EAAE,OAAO,QAAQ,MAAM,MAAM,EAAE,CAAC,MAAM;EAAE;;;;gBAn4CpD;wBAC0B;qBACL;kBACN;qBA4MI;uBAEqD;AAnMhG,uBAAsB,EAChC,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;AAQE,mCAAkC,EAC5C,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAEzC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;;;;;EAKjD,sBAAsB,EAAE,SAAS,CAAC,UAAU;EAC7C,CAAC,CACD,QAAQ;AAIE,6BAA4B,EACtC,OAAO;EACN,aAAa,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU;EAC3C,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;EACjD,CAAC,CACD,QAAQ,CACR,aAAa,OAAO,QAAQ;EAC3B,MAAM,eAAe,QAAgB;GACnC,MAAM,UAAU,IAAI,MAAM;GAC1B,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAChC,UAAO,MAAM,KAAK,MAAM,QAAQ,SAAS;;AAE3C,MAAI,CAAC,YAAY,MAAM,MAAM,CAC3B,KAAI,SAAS;GACX,MAAM;GACN,SAAS,6CAA6C,MAAM,MAAM;GAClE,MAAM,CAAC,QAAQ;GAChB,CAAC;AAEJ,OAAK,MAAM,CAAC,OAAO,cAAc,MAAM,aAAa,EAAE,EAAE,SAAS,CAC/D,KAAI,CAAC,YAAY,SAAS,CACxB,KAAI,SAAS;GACX,MAAM;GACN,SAAS,gDAAgD,SAAS;GAClE,MAAM,CAAC,aAAa,MAAM;GAC3B,CAAC;GAGN;AAIE,8BAA6B,EAChC,OAAO,EAAE,QAAQ,CAAC,MAAM,0BAA0B,EAAE,0BAA0B,CAC9E,UAAU;AAEA,qBAAoB,EAC9B,OAAO;EACN,aAAa,EAAE,QAAQ,CAAC,MAAM,0BAA0B,CAAC,UAAU;EACnE,OAAO;EACP,YAAY,oBAAoB,UAAU;EAC1C,sBAAsB,gCAAgC,UAAU;EACjE,CAAC,CACD,QAAQ,CACR,UAAU;AAMA,sBAAqB,EAAE,OAAO;;EAEzC,SAAS,EAAE,QAAQ,CAAC,UAAU;;EAE9B,eAAe,EAAE,QAAQ,CAAC,QAAQ,6BAA6B;EAC/D,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC;EAC3E,MAAM,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;EAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ;EAClB,SAAS;EACT,eAAe;EACf,mBAAmB,GAChB,+BAA+B;GAC9B,IAAI;GACJ,MAAM;GACN,aAAa;GACb,SAAS;GACT,QAAQ;GACT,EACF;EACD,MAAM,CACJ;GACE,IAAI;GACJ,SAAS;GACT,UAAU;IACR,MAAM;IACN,MAAM;IACN,UAAU;IACV,MAAM;IACP;GACD,kBAAkB,EAChB,SAAS,CAAC,+BAA+B,EAC1C;GACD,WAAW,EAAE,MAAM,0BAA0B;GAC7C,OAAO,EAAE,SAAS,EAAE,EAAE;GACtB,QAAQ,EAAE,MAAM,OAAO;GACvB,QAAQ;IACN,MAAM;IACN,SAAS,CAAC,WAAW,UAAU;IAC/B,aAAa,EAAE,SAAS,WAAW;IACpC;GACD,WAAW,EAAE;GACb,YAAY;IAAE,sBAAsB,EAAE;IAAE,WAAW,EAAE;IAAE,YAAY,EAAE;IAAE;GACxE,CACF;EACF,CAAC;AAEI,4BAA2B,EAC9B,OAAO;EACN,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC,CACD,QAAQ,CACR,UAAU;AAEP,gCAA+B,EAClC,OAAO;EACN,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU;EACtD,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EAClC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;EAC1D,CAAC,CACD,QAAQ,CACR,UAAU;AAEP,4BAA2B,EAC9B,OAAO;EACN,UAAU,EAAE,SAAS,CAAC,UAAU;EAChC,kBAAkB,EAAE,SAAS,CAAC,UAAU;EACxC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa,OAAO,QAAQ;GAC1D,MAAM,SAAS,cAAc,MAAM;AACnC,OAAI,OAAO,OAAO,MAChB,KAAI,SAAS;IAAE,MAAM;IAAU,SAAS,OAAO;IAAS,CAAC;IAE3D;EACF,YAAY,EAAE,QAAQ,CAAC,UAAU;EACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,qBAAqB,EAAE,QAAQ,CAAC,UAAU;EAC1C,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ,CACR,UAAU;AAEA,uBAAsB,EAChC,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,SAAS,EAAE,KAAK;GAAC;GAAS;GAAO;GAAS;GAAa;GAAe,CAAC,CAAC,QAAQ,YAAY;EAC5F,UAAU,EAAE,SAAS,CAAC,UAAU;EAChC,kBAAkB,EAAE,SAAS,CAAC,UAAU;EACxC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;EAC3D,eAAe,EAAE,KAAK;GAAC;GAAS;GAAe;GAAc,CAAC,CAAC,UAAU;EACzE,OAAO;EACP,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,WAAW;EACX,cAAc;EACd,UAAU,EAAE,SAAS,CAAC,UAAU;EAChC,aAAa,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC,CAAC,UAAU;EACtD,cAAc,EAAE,KAAK;GAAC;GAAgB;GAAgB;GAAc,CAAC,CAAC,UAAU;EAChF,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;EAC7D,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,SAAS;EAAM,SAAS;EAAa,CAAC;AAmBtC,sBAAqB,EAAE,OAAO;EACzC,SAAS,EAAE,QAAQ;EACnB,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC9C,CAAC;AAEW,qBAAoB,EAAE,OAAO;EACxC,IAAI,EAAE,QAAQ,CAAC,UAAU;EACzB,SAAS,EAAE,QAAQ;EACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,IAAI;EACjC,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EACnC,CAAC;AAEW,wBAAuB,EAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,CAAC;AAE7D,wBAAuB,EAAE,KAAK;EACzC;EACA;EACA;EACA;EACD,CAAC;AAEW,8BAA6B,EAAE,OAAO;EACjD,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,YAAY,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;AAEW,0BAAyB,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAElD,4BAA2B,EACrC,OAAO;EACN,MAAM,uBAAuB,UAAU;;EAEvC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU;;EAElD,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;EAChD,CAAC,CACD,QAAQ;AAEE,4BAA2B,EACrC,OAAO;EACN,QAAQ,yBAAyB,UAAU;EAC3C,OAAO,yBAAyB,UAAU;EAC1C,QAAQ,yBAAyB,UAAU;EAC5C,CAAC,CACD,QAAQ;AAEE,sBAAqB,EAAE,KAAK,CAAC,cAAc,SAAS,CAAC;AAErD,uBAAsB,EAAE,OAAO;EAC1C,OAAO,mBAAmB,QAAQ,aAAa;EAC/C,SAAS,EAAE,QAAQ,CAAC,QAAQ,OAAO;EACnC,SAAS,qBAAqB,QAAQ,OAAO;EAC7C,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU;EACnE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EAC7C,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;EACnD,OAAO,yBAAyB,UAAU;EAC1C,aAAa,yBAAyB,UAAU;EAChD,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,UAAU;EACzE,SAAS,2BAA2B,UAAU;EAC/C,CAAC,CAAC,QAAQ;EACT,OAAO;EACP,SAAS;EACT,SAAS;EACV,CAAC;AAGW,wBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEpE,6BAA4B,EAAE,OAAO;EAChD,MAAM,EAAE,KAAK;GAAC;GAAS;GAAU;GAAQ;GAAU,CAAC;EACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;;EAE7B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;EACjC,CAAC;AAIW,yBAAwB,EAAE,OAAO;EAC5C,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;;EAEjC,WAAW,EAAE,MAAM,0BAA0B,CAAC,QAAQ,EAAE,CAAC;EAC1D,CAAC;AAIW,0BAAyB,EAAE,OAAO;;EAE7C,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;EACzC,CAAC;AAIW,wBAAuB,EAAE,OAAO;;EAE3C,QAAQ,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,UAAU;EAC3C,QAAQ,sBAAsB,UAAU;;EAExC,WAAW,uBAAuB,UAAU;EAC7C,CAAC;AAIW,qBAAoB,EAAE,OAAO;EACxC,KAAK,qBAAqB,UAAU;;;;;EAKpC,OAAO,EAAE,WAAW,uBAAuB;EAC5C,CAAC,CAAC,QAAQ,EACT,KAAK,EACH,QAAQ;EACN,YAAY;EACZ,WAAW,EAAE;EACd,EACF,EACF,CAAC;AAMW,8BAA6B,EACvC,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;EAC/C,UAAU,EAAE,QAAQ,CAAC,QAAQ,IAAQ;EACrC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,IAAQ;;EAE5C,WAAW,EAAE,QAAQ,CAAC,UAAU;;EAEhC,gBAAgB,EAAE,SAAS,CAAC,QAAQ,KAAK;;;;;;;EAOzC,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAK;EACvD,CAAC,CACD,UAAU;AAEA,yBAAwB,EAClC,OAAO;;AAEN,QAAQ,EAAE,SAAS,CAAC,UAAU,EAC/B,CAAC,CACD,UAAU;AAEA,6BAA4B,EACtC,OAAO;;EAEN,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;;EAE7B,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAE/C,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAE1C,eAAe,EAAE,SAAS,CAAC,UAAU;EACtC,CAAC,CACD,QAAQ;AAEE,qBAAoB,EAC9B,OAAO;EACN,MAAM,EAAE,KAAK;GAAC;GAAQ;GAAS;GAAY;GAAgB,CAAC,CAAC,QAAQ,QAAQ;EAC7E,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;;EAE/B,gBAAgB,EAAE,SAAS,CAAC,UAAU;EACtC,WAAW;EACX,cAAc,0BAA0B,UAAU;EACnD,CAAC,CACD,QAAQ,EACP,MAAM,SACP,CAAC;AAES,iCAAgC,EAAE,OAAO;EACpD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC9B,CAAC;AAEW,0BAAyB,EACnC,OAAO;EACN,MAAM,EAAE,KAAK;GAAC;GAAO;GAAS;GAAS,CAAC,CAAC,QAAQ,MAAM;EACvD,aAAa,EAAE,SAAS,CAAC,QAAQ,KAAK;EACtC,SAAS,8BAA8B,UAAU;EAClD,CAAC,CACD,QAAQ;EACP,MAAM;EACN,aAAa;EACd,CAAC;AAES,uBAAsB,EAAE,OAAO;EAC1C,KAAK,EAAE,QAAQ,CAAC,KAAK;EACrB,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,WAAW,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC,CAAC,QAAQ,SAAS;EACtD,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,gBAAgB,EAAE,QAAQ,CAAC,UAAU;EACtC,CAAC;AAEW,oBAAmB,EAC7B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;EACnC,cAAc,EAAE,SAAS,CAAC,QAAQ,MAAM;EACxC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC/B,CAAC,CACD,QAAQ;EACP,SAAS;EACT,cAAc;EACf,CAAC;AAES,qBAAoB,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,CAAC,QAAQ,QAAQ;AAEhE,yBAAwB,EAClC,OAAO;EACN,SAAS,EAAE,SAAS;EACpB,YAAY,EAAE,QAAQ;;EAEtB,4BAA4B,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,MAAM;EACjE,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,iBAAiB,EAAE,SAAS,CAAC,UAAU;EACvC,aAAa,EACV,OAAO;GACN,OAAO,EAAE,QAAQ;GACjB,KAAK,EAAE,QAAQ;GACf,UAAU,EAAE,QAAQ,CAAC,UAAU;GAChC,CAAC,CACD,UAAU;EACd,CAAC,CACD,QAAQ;EACP,SAAS;EACT,YAAY;EACZ,4BAA4B;EAC7B,CAAC;AAES,wCAAuC,EAAE,KAAK;EAAC;EAAQ;EAAO;EAAW,CAAC;AAE1E,uBAAsB,EAAE,OAAO;EAC1C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC9B,CAAC;AAEW,sBAAqB,EAC/B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;EACnC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,0BAA0B;;EAE9D,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EAChD,WAAW,EAAE,SAAS,CAAC,QAAQ,MAAM;EACrC,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,SAAS,oBAAoB,UAAU;EACxC,CAAC,CACD,QAAQ;EACP,SAAS;EACT,WAAW;EACX,WAAW;EACZ,CAAC;AASS,+BAA8B,EAAE,OAAO;;EAElD,WAAW,EAAE,QAAQ,CAAC,QAAQ,UAAU;;EAExC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,YAAe,CAAC,QAAQ,UAAY;;EAE7E,gBAAgB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC1C,CAAC;AAGW,yBAAwB,EAAE,OAAO,EAC5C,QAAQ,4BAA4B,UAAU,EAC/C,CAAC,CAAC,UAAU;AAGA,yBAAwB,EAAE,KAAK;EAAC;EAAQ;EAAY;EAAO;EAAW;EAAS,CAAC;AAEhF,uBAAsB,EAAE,OAAO;;EAE1C,MAAM,sBAAsB,UAAU;;EAEtC,gBAAgB,EAAE,QAAQ,CAAC,UAAU;EACrC,MAAM,EAAE,QAAQ,CAAC,UAAU;;EAE3B,MAAM,kBAAkB,UAAU;;EAElC,QAAQ,oBAAoB,UAAU;EACtC,WAAW,uBAAuB,UAAU;EAC5C,KAAK,iBAAiB,UAAU;EAChC,MAAM,kBAAkB,UAAU;EAClC,WAAW,sBAAsB,UAAU;EAC3C,mBAAmB,EAAE,QAAQ,CAAC,UAAU;EACxC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;;;;;;;;EAS3C,WAAW,EACR,QAAQ,CACR,aAAa,OAAO,QAAQ;GAC3B,MAAM,SAAS,kBAAkB,MAAM;AACvC,OAAI,OAAO,OAAO,MAChB,KAAI,SAAS;IAAE,MAAM;IAAU,SAAS,sBAAsB,OAAO;IAAW,CAAC;IAEnF,CACD,UAAU;;EAEb,0CAA0C,EAAE,SAAS,CAAC,UAAU;;EAEhE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;;EAE9C,qBAAqB,EAAE,SAAS,CAAC,UAAU;EAC3C,UAAU;;;;;;;EAOV,yBAAyB,qCAAqC,UAAU;;EAExE,wBAAwB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU;;EAErE,4BAA4B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU;;EAEzE,2BAA2B,EAAE,QAAQ,CAAC,UAAU;;EAEhD,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;EAE/C,OAAO,EAAE,OAAO;GACd,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;GAElC,cAAc,EAAE,QAAQ,CAAC,IAAI,IAAO,CAAC,IAAI,OAAY,CAAC,QAAQ,MAAW;;GAEzE,UAAU,EAAE,QAAQ,CAAC,IAAI,IAAO,CAAC,IAAI,OAAc,CAAC,QAAQ,OAAY;;GAExE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAO,CAAC,QAAQ,IAAI;;GAE3D,aAAa,EAAE,QAAQ,CAAC,IAAI,QAAU,CAAC,IAAI,YAAe,CAAC,QAAQ,UAAY;;GAE/E,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;GAEF,WAAW,EAAE,OAAO;IAClB,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAElC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAU,CAAC,IAAI,YAAe,CAAC,QAAQ,WAAc;;IAEzF,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAM;;IAEjE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG;;IAErD,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAO;;IAEpE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC1D,CAAC,CAAC,QAAQ;IACT,SAAS;IACT,eAAe;IACf,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,gBAAgB;IACjB,CAAC;GACH,CAAC,CAAC,UAAU;;EAEb,WAAW,EAAE,OAAO;GAClB,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;GAElC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,gBAAgB;;GAE5D,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAO,CAAC,IAAI,OAAY,CAAC,QAAQ,MAAW;;GAE/E,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAO,CAAC,IAAI,OAAc,CAAC,QAAQ,OAAY;;GAE9E,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAM,CAAC,QAAQ,EAAE;GAC7D,QAAQ,EAAE,OAAO;IACf,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAElC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAU,CAAC,IAAI,YAAe,CAAC,QAAQ,SAAY;;IAExF,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAO;;IAElE,yBAAyB,EAAE,SAAS,CAAC,QAAQ,MAAM;IACpD,CAAC,CAAC,QAAQ;IACT,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,yBAAyB;IAC1B,CAAC;GACF,OAAO,EAAE,OAAO;;IAEd,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAElC,sBAAsB,EACnB,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CACxB,QAAQ;KAAC;KAAa;KAAa;KAAM,CAAC;;IAE7C,sBAAsB,EACnB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,CACzC,QAAQ;KAAC;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAK,CAAC;;IAE5D,kBAAkB,EAAE,SAAS,CAAC,QAAQ,KAAK;;IAE3C,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,WAAc,CAAC,QAAQ,SAAW;;IAE7E,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAM,CAAC,IAAI,IAAQ,CAAC,QAAQ,IAAO;;IAE1E,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAO,CAAC,IAAI,KAAU,CAAC,QAAQ,IAAQ;;IAE7E,sBAAsB,EAAE,SAAS,CAAC,QAAQ,KAAK;IAChD,CAAC,CAAC,QAAQ;IACT,SAAS;IACT,sBAAsB;KAAC;KAAa;KAAa;KAAM;IACvD,sBAAsB;KAAC;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAM;KAAK;IACtE,kBAAkB;IAClB,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACvB,CAAC;GACH,CAAC,CAAC,UAAU;EACd,CAAC,CAAC,QAAQ;EACT,MAAM;EACN,MAAM;EACN,MAAM,EACJ,MAAM,SACP;EACD,WAAW;GACT,SAAS;GACT,YAAY;GACZ,4BAA4B;GAC7B;EACD,mBAAmB;EACnB,aAAa,EAAE;EACf,2BAA2B;EAC3B,oBAAoB;EACrB,CAAC;AAEW,yBAAwB,EAAE,OAAO,EAC5C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK,EACnC,CAAC,CAAC,QAAQ,EACT,SAAS,MACV,CAAC;AAMI,mCAAkC,EAAE,MAAM;EAC9C,EAAE,QAAQ;EACV,EAAE,QAAQ;EACV,EAAE,SAAS;EACX,EAAE,MAAM;EACR,EAAE,MAAM,EAAE,SAAS,CAAC;EACpB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;EAClC,CAAC;AAEW,2BAA0B,EACpC,OAAO;EACN,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EACpD,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC,CACD,SAAS,gCAAgC;AAE/B,2BAA0B,EAAE,OAAO;EAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,SAAS,CAAC;EACjE,CAAC;AAEW,wCAAuC,EACjD,MAAM,EAAE,KAAK;EAAC;EAAS;EAAS;EAAQ,CAAC,CAAC,CAC1C,UAAU;AAEA,iCAAgC,EAC1C,OAAO;EACN,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,cAAc;EACd,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,WAAW,EAAE,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,UAAU;EACnE,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC,CACD,SAAS,gCAAgC;AAE/B,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,UAAU;EAC9C,UAAU,wBAAwB,UAAU;EAC5C,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAK,CAAC,IAAI,KAAO,CAAC,UAAU;;EAE5D,QAAQ,EAAE,MAAM,8BAA8B,CAAC,UAAU;;EAEzD,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,UAAU;EACpE,CAAC,CACD,QAAQ;AAML,mCAAkC,EAAE,MAAM;EAC9C,EAAE,QAAQ;EACV,EAAE,QAAQ;EACV,EAAE,SAAS;EACX,EAAE,MAAM;EACR,EAAE,MAAM,EAAE,SAAS,CAAC;EACpB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;EAClC,CAAC;AAEW,2BAA0B,EACpC,OAAO;EACN,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC7B,CAAC,CACD,SAAS,gCAAgC;AAE/B,2BAA0B,EAAE,OAAO;EAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,OAAO,EACJ,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CACxB,QAAQ;GAAC;GAAU;GAAW;GAAW;GAAO,CAAC;EACrD,CAAC;AAEW,iCAAgC,EAAE,OAAO;EACpD,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,WAAW,EAAE,SAAS,CAAC,QAAQ,KAAK;EACpC,eAAe,EAAE,SAAS,CAAC,QAAQ,MAAM;EACzC,YAAY,EAAE,SAAS,CAAC,QAAQ,KAAK;EACrC,cAAc,EAAE,SAAS,CAAC,QAAQ,KAAK;EACvC,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC9C,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC9C,WAAW,EAAE,SAAS,CAAC,QAAQ,MAAM;EACtC,CAAC;AAEW,uBAAsB,EAAE,OAAO;EAC1C,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,MAAM,EAAE,QAAQ,CAAC,UAAU;EAC3B,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,MAAM,EAAE,QAAQ,CAAC,UAAU;EAC3B,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAK,CAAC,IAAI,KAAO,CAAC,UAAU;EAC7D,CAAC;AAEW,gCAA+B,EAAE,OAAO;EACnD,SAAS,EAAE,SAAS,CAAC,UAAU;EAC/B,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;EAChD,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;EAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC7B,CAAC;AAEW,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,OAAO;EAC3C,SAAS,EAAE,KAAK;GAAC;GAAO;GAAU;GAAW;GAAS,CAAC,CAAC,QAAQ,SAAS;EACzE,UAAU,wBAAwB,UAAU;EAC5C,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI;EACnD,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAK,CAAC,IAAI,KAAO,CAAC,QAAQ,IAAM;EAChE,eAAe,6BAA6B,UAAU;EACtD,gBAAgB,8BAA8B,UAAU;;EAExD,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,UAAU;EACpE,CAAC,CACD,QAAQ;AAME,wBAAuB,EAAE,OAAO;;AAE3C,KAAK,gBAAgB,UAAU,EAChC,CAAC,CAAC,UAAU;AAEA,+BAA8B;AAE9B,0BAAyB,EACnC,OAAO;;EAEN,QAAQ,EAAE,MAAM,8BAA8B,CAAC,UAAU;;EAEzD,OAAO,4BAA4B,UAAU;EAC9C,CAAC,CACD,UAAU;AAaA,6BAA4B,EACtC,OAAO;;EAEN,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;;EAEtC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;;EAExC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EACzC,CAAC,CACD,QAAQ;AAGE,kCAAiC,EAC3C,OAAO;;EAEN,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;;EAEjD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EACrD,CAAC,CACD,QAAQ;AAQE,4BAA2B,EACrC,OAAO;;EAEN,QAAQ,EAAE,QAAQ,CAAC,UAAU;;EAE7B,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;EAEpC,QAAQ,EAAE,QAAQ,CAAC,UAAU;;EAE7B,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;EAEzC,SAAS,+BAA+B,UAAU;;EAElD,OAAO,0BAA0B,UAAU;EAC5C,CAAC,CACD,QAAQ;AASE,yBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB;AAStE,iCAAgC,EAAE,OAAO;EACpD,kBAAkB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC3C,gBAAgB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;EACtC,iBAAiB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC1C,sBAAsB,EAAE,SAAS,CAAC,QAAQ,MAAM;EACjD,CAAC;AAGW,8BAA6B,EAAE,OAAO;EACjD,QAAQ,EAAE,QAAQ,CAAC,UAAU;EAC7B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,iBAAiB,EAAE,QAAQ,CAAC,UAAU;EACtC,WAAW,EAAE,QAAQ,CAAC,UAAU;EACjC,CAAC;AAMW,0BAA6D,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;AAM9F,0BAAyB,EACnC,OAAO;;EAEN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;;EAE9C,mBAAmB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,GAAG;;EAEhD,wBAAwB,EAAE,QAAQ,CAAC,IAAI,IAAK,CAAC,QAAQ,EAAE;EACxD,CAAC,CACD,QAAQ,CACR,UAAU;AAGA,+BAA8B,EAAE,KAAK;EAChD;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEW,gCAA+B,EACzC,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;EACzB,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU;EACtD,QAAQ,EAAE,SAAS,CAAC,UAAU;EAC9B,QAAQ,EAAE,MAAM,4BAA4B,CAAC,UAAU;EACxD,CAAC,CACD,QAAQ;AAEE,iCAAgC,EAC1C,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;;EAEnC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,KAAK;;EAEhD,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,SAAS,CAAC;EACpE,QAAQ,EACL,MAAM,4BAA4B,CAClC,QAAQ;GAAC;GAAQ;GAAW;GAAe;GAAgB;GAAc,CAAC;EAC7E,SAAS,EAAE,MAAM,6BAA6B,CAAC,QAAQ,EAAE,CAAC;EAC3D,CAAC,CACD,QAAQ,CACR,QAAQ;EACP,SAAS;EACT,uBAAuB;EACvB,UAAU,CAAC,YAAY,SAAS;EAChC,QAAQ;GAAC;GAAQ;GAAW;GAAe;GAAgB;GAAc;EACzE,SAAS,EAAE;EACZ,CAAC;AAES,qBAAoB,EAC9B,OAAO;;EAEN,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG;;EAEtD,eAAe,EAAE,QAAQ,CAAC,UAAU;;;;;EAKpC,eAAe,EAAE,SAAS,CAAC,QAAQ,KAAK;;;;;;EAMxC,0BAA0B,EAAE,KAAK,CAAC,cAAc,sBAAsB,CAAC,CAAC,QAAQ,aAAa;;EAE7F,6BAA6B,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE;;EAEvE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAM,CAAC,IAAI,KAAQ,CAAC,QAAQ,IAAO;;EAExE,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ,CAAC,QAAQ,KAAO;;EAE3E,eAAe;EAChB,CAAC,CACD,QAAQ;AAIE,sBAAqB,EAC/B,OAAO;;EAEN,cAAc,EAAE,SAAS,CAAC,QAAQ,KAAK;;EAEvC,SAAS,EAAE,KAAK;GAAC;GAAU;GAAQ;GAAM,CAAC,CAAC,QAAQ,SAAS;;EAE5D,MAAM;EACP,CAAC,CACD,QAAQ,CACR,UAAU;AAIA,wBAAuB,EACjC,OAAO,EACN,SAAS,EAAE,SAAS,CAAC,UAAU,EAChC,CAAC,CACD,QAAQ,CACR,UAAU;AAIA,mBAAkB,EAC5B,OAAO;;AAEN,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EAC3C,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,CAAC;AAQR,oBAAmB,EACtB,QAAQ,CACR,KAAK,CACL,QAAQ,UAAU;AACjB,MAAI;GACF,MAAM,WAAW,IAAI,IAAI,MAAM,CAAC;AAChC,UAAO,aAAa,WAAW,aAAa;UACtC;AACN,UAAO;;IAER,wCAAwC;AAEvC,kCAAiC,EAAE,OAAO,EAC9C,eAAe,EAAE,OAAO;EACtB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC3B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC5B,CAAC,EACH,CAAC;AAEI,yBAAwB,EAAE,MAAM;EAAC,EAAE,QAAQ;EAAE,EAAE,QAAQ;EAAE,EAAE,SAAS;EAAE;EAA+B,CAAC;AAE/F,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;EACpC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;EAC3D,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,UAAU;EACvC,KAAK,iBAAiB,UAAU;EAChC,WAAW,EAAE,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC,UAAU;EACxD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;EAC/D,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;EAC/D,CAAC,CACD,SAAS,EAAE,SAAS,CAAC,CACrB,aAAa,OAAO,QAAQ;EAC3B,MAAM,aAAa,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,MAAM,CAAC,SAAS;EACtF,MAAM,SAAS,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,MAAM,CAAC,SAAS;AAC1E,MAAI,cAAc,OAChB,KAAI,SAAS;GACX,MAAM;GACN,SAAS;GACV,CAAC;GAEJ;AAES,mBAAkB,EAC5B,OAAO;EACN,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU;EACzD,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EACxD,CAAC,CACD,QAAQ,CACR,UAAU;AAKA,0BAAyB,EACnC,OAAO,EACN,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,UAAU;AAQA,gBAAe,EAAE,OAAO;EACnC,QAAQ;EACR,UAAU;EACV,SAAS;EACT,UAAU;EACV,SAAS;EACT,SAAS;EACT,QAAQ,mBAAmB,UAAU;EACrC,WAAW;EACX,OAAO;EACP,KAAK;EACL,YAAY;EACZ,OAAO,kBAAkB,UAAU;EACnC,YAAY,uBAAuB,QAAQ,EAAE,CAAC;;EAE9C,WAAW,sBAAsB,UAAU;EAC3C,WAAW;;EAEX,UAAU;EACV,QAAQ;EACR,UAAU;EACV,KAAK;EACN,CAAC,CAAC,QAAQ;EACT,QAAQ;GACN,SAAS;GACT,eAAe;GACf,mBAAmB,GAChB,+BAA+B;IAC9B,IAAI;IACJ,MAAM;IACN,aAAa;IACb,SAAS;IACT,QAAQ;IACT,EACF;GACD,MAAM,CACJ;IACE,IAAI;IACJ,SAAS;IACT,UAAU;KACR,MAAM;KACN,MAAM;KACN,UAAU;KACV,MAAM;KACP;IACD,kBAAkB,EAChB,SAAS,CAAC,+BAA+B,EAC1C;IACD,WAAW,EAAE,MAAM,0BAA0B;IAC7C,OAAO,EAAE,SAAS,EAAE,EAAE;IACtB,QAAQ,EAAE,MAAM,OAAO;IACvB,QAAQ;KACN,MAAM;KACN,SAAS,CAAC,WAAW,UAAU;KAC/B,aAAa,EAAE,SAAS,WAAW;KACpC;IACD,WAAW,EAAE;IACb,YAAY;KAAE,sBAAsB,EAAE;KAAE,WAAW,EAAE;KAAE,YAAY,EAAE;KAAE;IACxE,CACF;GACF;EACD,UAAU,EAAE;EACZ,SAAS;GACP,OAAO;GACP,SAAS;GACT,SAAS;GACV;EACD,UAAU,EACR,UAAU;GACR,SAAS;GACT,OAAO;GACP,UAAU;IACR,UAAU;IACV,aAAa;IACb,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,WAAW,EAAE,MAAM,WAAoB;IACxC;GACD,UAAU,EACR,SAAS;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW,EAAE;IACb,gBAAgB,EAAE;IACnB,EACF;GACF,EACF;EACD,SAAS;GACP,MAAM;GACN,MAAM;GACN,MAAM,EACJ,MAAM,SACP;GACD,WAAW;IACT,SAAS;IACT,YAAY;IACZ,4BAA4B;IAC7B;GACD,mBAAmB;GACnB,aAAa,EAAE;GACf,2BAA2B;GAC3B,oBAAoB;GACrB;EACD,SAAS;GACP,SAAS;GACT,SAAS;GACV;EACD,OAAO,EACL,KAAK,EACH,QAAQ;GACN,YAAY;GACZ,WAAW,EAAE;GACd,EACF,EACF;EACD,OAAO;GACL,UAAU;GACV,eAAe;GACf,0BAA0B;GAC1B,6BAA6B;GAC7B,gBAAgB;GAChB,uBAAuB;GACvB,eAAe;IACb,SAAS;IACT,uBAAuB;IACvB,UAAU,CAAC,YAAY,SAAS;IAChC,QAAQ;KAAC;KAAQ;KAAW;KAAe;KAAgB;KAAc;IACzE,SAAS,EAAE;IACZ;GACF;EACD,YAAY;GACV,OAAO,EAAE;GACT,UAAU;IACR,kBAAkB;IAClB,gBAAgB;IAChB,OAAO,EAAE;IACT,iBAAiB;IACjB,sBAAsB;IACvB;GACD,OAAO,EAAE;GACV;EACD,WAAW,EACT,SAAS,MACV;EACD,KAAK,EAAE;EAIR,CAAC"}

package/dist/src/connectors/health.js

@@ -1,7 +1,7 @@
 import { listBundleMcpServerCapabilitiesForGateway } from "../agent/mcp/bundle-mcp-materialize.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { materializeConnectorMcpServer } from "./materialize.js";
 import { getConnectorInstance } from "./instances.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 //#region src/connectors/health.ts
 function classifyConnectorHealthError(error) {
 	const message = error instanceof Error ? error.message : String(error);

package/dist/src/connectors/install.js

@@ -21,7 +21,9 @@ async function installConnectorDefinition(config, definition, input, resolver =
 					connectorId: definition.id,
 					version: definition.version,
 					enabled: true,
-					displayName: definition.displayName
+					displayName: definition.displayName,
+					source: definition.source,
+					artifactSha256: definition.provenance?.sha256
 				},
 				runtime: definition.runtime,
 				...definition.runtime.type === "composio" && definition.runtime.toolkit !== "composio" ? { scope: "read" } : {}

package/dist/src/connectors/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","names":[],"sources":["../../../src/connectors/install.ts"],"sourcesContent":["import { CredentialResolver } from '../auth/credentials.js';\nimport type { Config } from '../config/schema.js';\nimport { getConnectorDefinition } from './catalog.js';\nimport { listConnectorInstances } from './instances.js';\nimport { isManagedConnectorServer, materializeConnectorMcpServer } from './materialize.js';\nimport { saveComposioApiKey } from './composio.js';\nimport { assertConnectorOAuthReady } from './oauth.js';\nimport { saveConnectorSecrets } from './secret-store.js';\nimport { appendConnectorAuditRecord } from './usage.js';\nimport type { ConnectorDefinition, ConnectorInstallInput, ConnectorInstance } from './types.js';\n\nexport async function installConnectorDefinition(\n  config: Config,\n  definition: ConnectorDefinition,\n  input: ConnectorInstallInput,\n  resolver = new CredentialResolver(),\n): Promise<ConnectorInstance> {\n  if (definition.runtime.type !== 'mcp') {\n    const instanceId = definition.id;\n    if (definition.runtime.type === 'composio' && definition.id === 'composio-api-key') {\n      await saveComposioApiKey(input, resolver);\n    }\n    config.connectors = config.connectors ?? {};\n    config.connectors.instances = {\n      ...(config.connectors.instances ?? {}),\n      [instanceId]: {\n        xopcConnector: {\n          managed: true,\n          connectorId: definition.id,\n          version: definition.version,\n          enabled: true,\n          displayName: definition.displayName,\n        },\n        runtime: definition.runtime,\n        ...(definition.runtime.type === 'composio' && definition.runtime.toolkit !== 'composio' ? { scope: 'read' } : {}),\n      },\n    };\n    const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === instanceId);\n    if (!instance) {\n      throw new Error(`Connector \"${definition.id}\" was installed but could not be resolved.`);\n    }\n    return instance;\n  }\n\n  const { serverId, server } = materializeConnectorMcpServer(definition, input);\n  const existingServer = config.mcp?.servers?.[serverId];\n  if (existingServer && !isManagedConnectorServer(existingServer)) {\n    throw new Error(`MCP server \"${serverId}\" already exists and is not managed by Connectors.`);\n  }\n\n  await assertConnectorOAuthReady(definition, resolver);\n  await saveConnectorSecrets(definition, input, resolver);\n\n  config.mcp = config.mcp ?? {};\n  config.mcp.servers = {\n    ...(config.mcp.servers ?? {}),\n    [serverId]: server,\n  };\n\n  const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === serverId);\n  if (!instance) {\n    throw new Error(`Connector \"${definition.id}\" was installed but could not be resolved.`);\n  }\n  appendConnectorAuditRecord(config, serverId, { action: 'installed' });\n  return instance;\n}\n\nexport async function installConnector(\n  config: Config,\n  connectorId: string,\n  input: ConnectorInstallInput,\n  resolver = new CredentialResolver(),\n): Promise<ConnectorInstance> {\n  const definition = getConnectorDefinition(connectorId);\n  if (!definition) {\n    throw new Error(`Unknown connector: ${connectorId}`);\n  }\n  return installConnectorDefinition(config, definition, input, resolver);\n}\n\nexport function updateConnectorConfig(\n  config: Config,\n  instanceId: string,\n  input: ConnectorInstallInput,\n): ConnectorInstance {\n  const existingServer = config.mcp?.servers?.[instanceId];\n  if (!existingServer || !isManagedConnectorServer(existingServer)) {\n    throw new Error(`MCP server \"${instanceId}\" is not managed by Connectors.`);\n  }\n  const definition = getConnectorDefinition(existingServer.xopcConnector.connectorId);\n  if (!definition) {\n    throw new Error(`Unknown connector: ${existingServer.xopcConnector.connectorId}`);\n  }\n  if (definition.runtime.type !== 'mcp') {\n    throw new Error(`Connector type \"${definition.runtime.type}\" does not support config updates.`);\n  }\n  if ((definition.setup.secrets ?? []).length > 0) {\n    throw new Error('Connectors with secrets must be reinstalled to change configuration.');\n  }\n\n  const { serverId, server } = materializeConnectorMcpServer(definition, input);\n  if (serverId !== instanceId) {\n    throw new Error(`Connector config update cannot change server id from \"${instanceId}\" to \"${serverId}\".`);\n  }\n\n  config.mcp = config.mcp ?? {};\n  config.mcp.servers = {\n    ...(config.mcp.servers ?? {}),\n    [serverId]: {\n      ...server,\n      xopcConnector: {\n        ...existingServer.xopcConnector,\n        ...(server.xopcConnector as Record<string, unknown>),\n        enabled: existingServer.xopcConnector.enabled,\n        lastConnectedAt: existingServer.xopcConnector.lastConnectedAt,\n        lastError: existingServer.xopcConnector.lastError,\n      },\n    },\n  };\n\n  const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === serverId);\n  if (!instance) {\n    throw new Error(`Connector \"${definition.id}\" was updated but could not be resolved.`);\n  }\n  return instance;\n}\n\nexport function uninstallConnector(config: Config, instanceId: string): ConnectorInstance {\n  const server = config.mcp?.servers?.[instanceId];\n  const connectorRecord = config.connectors?.instances?.[instanceId];\n  if (!server && !connectorRecord) {\n    throw new Error(`Connector instance not found: ${instanceId}`);\n  }\n  if (server && !isManagedConnectorServer(server)) {\n    throw new Error(`MCP server \"${instanceId}\" is not managed by Connectors.`);\n  }\n\n  const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === instanceId);\n  if (!instance) {\n    throw new Error(`Connector instance not found: ${instanceId}`);\n  }\n  appendConnectorAuditRecord(config, instanceId, { action: 'removed' });\n\n  if (server) {\n    const nextServers = { ...(config.mcp?.servers ?? {}) };\n    delete nextServers[instanceId];\n    config.mcp = {\n      ...(config.mcp ?? {}),\n      servers: nextServers,\n    };\n  }\n  if (connectorRecord) {\n    const nextInstances = { ...(config.connectors?.instances ?? {}) };\n    delete nextInstances[instanceId];\n    config.connectors = { ...(config.connectors ?? {}), instances: nextInstances };\n  }\n  return instance;\n}\n"],"mappings":";;;;;;;;;kBAA4D;AAW5D,eAAsB,2BACpB,QACA,YACA,OACA,WAAW,IAAI,oBAAoB,EACP;AAC5B,KAAI,WAAW,QAAQ,SAAS,OAAO;EACrC,MAAM,aAAa,WAAW;AAC9B,MAAI,WAAW,QAAQ,SAAS,cAAc,WAAW,OAAO,mBAC9D,OAAM,mBAAmB,OAAO,SAAS;AAE3C,SAAO,aAAa,OAAO,cAAc,EAAE;AAC3C,SAAO,WAAW,YAAY;GAC5B,GAAI,OAAO,WAAW,aAAa,EAAE;IACpC,aAAa;IACZ,eAAe;KACb,SAAS;KACT,aAAa,WAAW;KACxB,SAAS,WAAW;KACpB,SAAS;KACT,aAAa,WAAW;KACzB;IACD,SAAS,WAAW;IACpB,GAAI,WAAW,QAAQ,SAAS,cAAc,WAAW,QAAQ,YAAY,aAAa,EAAE,OAAO,QAAQ,GAAG,EAAE;IACjH;GACF;EACD,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,WAAW;AACxG,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,cAAc,WAAW,GAAG,4CAA4C;AAE1F,SAAO;;CAGT,MAAM,EAAE,UAAU,WAAW,8BAA8B,YAAY,MAAM;CAC7E,MAAM,iBAAiB,OAAO,KAAK,UAAU;AAC7C,KAAI,kBAAkB,CAAC,yBAAyB,eAAe,CAC7D,OAAM,IAAI,MAAM,eAAe,SAAS,oDAAoD;AAG9F,OAAM,0BAA0B,YAAY,SAAS;AACrD,OAAM,qBAAqB,YAAY,OAAO,SAAS;AAEvD,QAAO,MAAM,OAAO,OAAO,EAAE;AAC7B,QAAO,IAAI,UAAU;EACnB,GAAI,OAAO,IAAI,WAAW,EAAE;GAC3B,WAAW;EACb;CAED,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,SAAS;AACtG,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,cAAc,WAAW,GAAG,4CAA4C;AAE1F,4BAA2B,QAAQ,UAAU,EAAE,QAAQ,aAAa,CAAC;AACrE,QAAO;;AAGT,eAAsB,iBACpB,QACA,aACA,OACA,WAAW,IAAI,oBAAoB,EACP;CAC5B,MAAM,aAAa,uBAAuB,YAAY;AACtD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM,sBAAsB,cAAc;AAEtD,QAAO,2BAA2B,QAAQ,YAAY,OAAO,SAAS;;AAGxE,SAAgB,sBACd,QACA,YACA,OACmB;CACnB,MAAM,iBAAiB,OAAO,KAAK,UAAU;AAC7C,KAAI,CAAC,kBAAkB,CAAC,yBAAyB,eAAe,CAC9D,OAAM,IAAI,MAAM,eAAe,WAAW,iCAAiC;CAE7E,MAAM,aAAa,uBAAuB,eAAe,cAAc,YAAY;AACnF,KAAI,CAAC,WACH,OAAM,IAAI,MAAM,sBAAsB,eAAe,cAAc,cAAc;AAEnF,KAAI,WAAW,QAAQ,SAAS,MAC9B,OAAM,IAAI,MAAM,mBAAmB,WAAW,QAAQ,KAAK,oCAAoC;AAEjG,MAAK,WAAW,MAAM,WAAW,EAAE,EAAE,SAAS,EAC5C,OAAM,IAAI,MAAM,uEAAuE;CAGzF,MAAM,EAAE,UAAU,WAAW,8BAA8B,YAAY,MAAM;AAC7E,KAAI,aAAa,WACf,OAAM,IAAI,MAAM,yDAAyD,WAAW,QAAQ,SAAS,IAAI;AAG3G,QAAO,MAAM,OAAO,OAAO,EAAE;AAC7B,QAAO,IAAI,UAAU;EACnB,GAAI,OAAO,IAAI,WAAW,EAAE;GAC3B,WAAW;GACV,GAAG;GACH,eAAe;IACb,GAAG,eAAe;IAClB,GAAI,OAAO;IACX,SAAS,eAAe,cAAc;IACtC,iBAAiB,eAAe,cAAc;IAC9C,WAAW,eAAe,cAAc;IACzC;GACF;EACF;CAED,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,SAAS;AACtG,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,cAAc,WAAW,GAAG,0CAA0C;AAExF,QAAO;;AAGT,SAAgB,mBAAmB,QAAgB,YAAuC;CACxF,MAAM,SAAS,OAAO,KAAK,UAAU;CACrC,MAAM,kBAAkB,OAAO,YAAY,YAAY;AACvD,KAAI,CAAC,UAAU,CAAC,gBACd,OAAM,IAAI,MAAM,iCAAiC,aAAa;AAEhE,KAAI,UAAU,CAAC,yBAAyB,OAAO,CAC7C,OAAM,IAAI,MAAM,eAAe,WAAW,iCAAiC;CAG7E,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,WAAW;AACxG,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,iCAAiC,aAAa;AAEhE,4BAA2B,QAAQ,YAAY,EAAE,QAAQ,WAAW,CAAC;AAErE,KAAI,QAAQ;EACV,MAAM,cAAc,EAAE,GAAI,OAAO,KAAK,WAAW,EAAE,EAAG;AACtD,SAAO,YAAY;AACnB,SAAO,MAAM;GACX,GAAI,OAAO,OAAO,EAAE;GACpB,SAAS;GACV;;AAEH,KAAI,iBAAiB;EACnB,MAAM,gBAAgB,EAAE,GAAI,OAAO,YAAY,aAAa,EAAE,EAAG;AACjE,SAAO,cAAc;AACrB,SAAO,aAAa;GAAE,GAAI,OAAO,cAAc,EAAE;GAAG,WAAW;GAAe;;AAEhF,QAAO"}
+{"version":3,"file":"install.js","names":[],"sources":["../../../src/connectors/install.ts"],"sourcesContent":["import { CredentialResolver } from '../auth/credentials.js';\nimport type { Config } from '../config/schema.js';\nimport { getConnectorDefinition } from './catalog.js';\nimport { listConnectorInstances } from './instances.js';\nimport { isManagedConnectorServer, materializeConnectorMcpServer } from './materialize.js';\nimport { saveComposioApiKey } from './composio.js';\nimport { assertConnectorOAuthReady } from './oauth.js';\nimport { saveConnectorSecrets } from './secret-store.js';\nimport { appendConnectorAuditRecord } from './usage.js';\nimport type { ConnectorDefinition, ConnectorInstallInput, ConnectorInstance } from './types.js';\n\nexport async function installConnectorDefinition(\n  config: Config,\n  definition: ConnectorDefinition,\n  input: ConnectorInstallInput,\n  resolver = new CredentialResolver(),\n): Promise<ConnectorInstance> {\n  if (definition.runtime.type !== 'mcp') {\n    const instanceId = definition.id;\n    if (definition.runtime.type === 'composio' && definition.id === 'composio-api-key') {\n      await saveComposioApiKey(input, resolver);\n    }\n    config.connectors = config.connectors ?? {};\n    config.connectors.instances = {\n      ...(config.connectors.instances ?? {}),\n      [instanceId]: {\n        xopcConnector: {\n          managed: true,\n          connectorId: definition.id,\n          version: definition.version,\n          enabled: true,\n          displayName: definition.displayName,\n          source: definition.source,\n          artifactSha256: definition.provenance?.sha256,\n        },\n        runtime: definition.runtime,\n        ...(definition.runtime.type === 'composio' && definition.runtime.toolkit !== 'composio' ? { scope: 'read' } : {}),\n      },\n    };\n    const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === instanceId);\n    if (!instance) {\n      throw new Error(`Connector \"${definition.id}\" was installed but could not be resolved.`);\n    }\n    return instance;\n  }\n\n  const { serverId, server } = materializeConnectorMcpServer(definition, input);\n  const existingServer = config.mcp?.servers?.[serverId];\n  if (existingServer && !isManagedConnectorServer(existingServer)) {\n    throw new Error(`MCP server \"${serverId}\" already exists and is not managed by Connectors.`);\n  }\n\n  await assertConnectorOAuthReady(definition, resolver);\n  await saveConnectorSecrets(definition, input, resolver);\n\n  config.mcp = config.mcp ?? {};\n  config.mcp.servers = {\n    ...(config.mcp.servers ?? {}),\n    [serverId]: server,\n  };\n\n  const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === serverId);\n  if (!instance) {\n    throw new Error(`Connector \"${definition.id}\" was installed but could not be resolved.`);\n  }\n  appendConnectorAuditRecord(config, serverId, { action: 'installed' });\n  return instance;\n}\n\nexport async function installConnector(\n  config: Config,\n  connectorId: string,\n  input: ConnectorInstallInput,\n  resolver = new CredentialResolver(),\n): Promise<ConnectorInstance> {\n  const definition = getConnectorDefinition(connectorId);\n  if (!definition) {\n    throw new Error(`Unknown connector: ${connectorId}`);\n  }\n  return installConnectorDefinition(config, definition, input, resolver);\n}\n\nexport function updateConnectorConfig(\n  config: Config,\n  instanceId: string,\n  input: ConnectorInstallInput,\n): ConnectorInstance {\n  const existingServer = config.mcp?.servers?.[instanceId];\n  if (!existingServer || !isManagedConnectorServer(existingServer)) {\n    throw new Error(`MCP server \"${instanceId}\" is not managed by Connectors.`);\n  }\n  const definition = getConnectorDefinition(existingServer.xopcConnector.connectorId);\n  if (!definition) {\n    throw new Error(`Unknown connector: ${existingServer.xopcConnector.connectorId}`);\n  }\n  if (definition.runtime.type !== 'mcp') {\n    throw new Error(`Connector type \"${definition.runtime.type}\" does not support config updates.`);\n  }\n  if ((definition.setup.secrets ?? []).length > 0) {\n    throw new Error('Connectors with secrets must be reinstalled to change configuration.');\n  }\n\n  const { serverId, server } = materializeConnectorMcpServer(definition, input);\n  if (serverId !== instanceId) {\n    throw new Error(`Connector config update cannot change server id from \"${instanceId}\" to \"${serverId}\".`);\n  }\n\n  config.mcp = config.mcp ?? {};\n  config.mcp.servers = {\n    ...(config.mcp.servers ?? {}),\n    [serverId]: {\n      ...server,\n      xopcConnector: {\n        ...existingServer.xopcConnector,\n        ...(server.xopcConnector as Record<string, unknown>),\n        enabled: existingServer.xopcConnector.enabled,\n        lastConnectedAt: existingServer.xopcConnector.lastConnectedAt,\n        lastError: existingServer.xopcConnector.lastError,\n      },\n    },\n  };\n\n  const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === serverId);\n  if (!instance) {\n    throw new Error(`Connector \"${definition.id}\" was updated but could not be resolved.`);\n  }\n  return instance;\n}\n\nexport function uninstallConnector(config: Config, instanceId: string): ConnectorInstance {\n  const server = config.mcp?.servers?.[instanceId];\n  const connectorRecord = config.connectors?.instances?.[instanceId];\n  if (!server && !connectorRecord) {\n    throw new Error(`Connector instance not found: ${instanceId}`);\n  }\n  if (server && !isManagedConnectorServer(server)) {\n    throw new Error(`MCP server \"${instanceId}\" is not managed by Connectors.`);\n  }\n\n  const instance = listConnectorInstances(config).find((candidate) => candidate.instanceId === instanceId);\n  if (!instance) {\n    throw new Error(`Connector instance not found: ${instanceId}`);\n  }\n  appendConnectorAuditRecord(config, instanceId, { action: 'removed' });\n\n  if (server) {\n    const nextServers = { ...(config.mcp?.servers ?? {}) };\n    delete nextServers[instanceId];\n    config.mcp = {\n      ...(config.mcp ?? {}),\n      servers: nextServers,\n    };\n  }\n  if (connectorRecord) {\n    const nextInstances = { ...(config.connectors?.instances ?? {}) };\n    delete nextInstances[instanceId];\n    config.connectors = { ...(config.connectors ?? {}), instances: nextInstances };\n  }\n  return instance;\n}\n"],"mappings":";;;;;;;;;kBAA4D;AAW5D,eAAsB,2BACpB,QACA,YACA,OACA,WAAW,IAAI,oBAAoB,EACP;AAC5B,KAAI,WAAW,QAAQ,SAAS,OAAO;EACrC,MAAM,aAAa,WAAW;AAC9B,MAAI,WAAW,QAAQ,SAAS,cAAc,WAAW,OAAO,mBAC9D,OAAM,mBAAmB,OAAO,SAAS;AAE3C,SAAO,aAAa,OAAO,cAAc,EAAE;AAC3C,SAAO,WAAW,YAAY;GAC5B,GAAI,OAAO,WAAW,aAAa,EAAE;IACpC,aAAa;IACZ,eAAe;KACb,SAAS;KACT,aAAa,WAAW;KACxB,SAAS,WAAW;KACpB,SAAS;KACT,aAAa,WAAW;KACxB,QAAQ,WAAW;KACnB,gBAAgB,WAAW,YAAY;KACxC;IACD,SAAS,WAAW;IACpB,GAAI,WAAW,QAAQ,SAAS,cAAc,WAAW,QAAQ,YAAY,aAAa,EAAE,OAAO,QAAQ,GAAG,EAAE;IACjH;GACF;EACD,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,WAAW;AACxG,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,cAAc,WAAW,GAAG,4CAA4C;AAE1F,SAAO;;CAGT,MAAM,EAAE,UAAU,WAAW,8BAA8B,YAAY,MAAM;CAC7E,MAAM,iBAAiB,OAAO,KAAK,UAAU;AAC7C,KAAI,kBAAkB,CAAC,yBAAyB,eAAe,CAC7D,OAAM,IAAI,MAAM,eAAe,SAAS,oDAAoD;AAG9F,OAAM,0BAA0B,YAAY,SAAS;AACrD,OAAM,qBAAqB,YAAY,OAAO,SAAS;AAEvD,QAAO,MAAM,OAAO,OAAO,EAAE;AAC7B,QAAO,IAAI,UAAU;EACnB,GAAI,OAAO,IAAI,WAAW,EAAE;GAC3B,WAAW;EACb;CAED,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,SAAS;AACtG,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,cAAc,WAAW,GAAG,4CAA4C;AAE1F,4BAA2B,QAAQ,UAAU,EAAE,QAAQ,aAAa,CAAC;AACrE,QAAO;;AAGT,eAAsB,iBACpB,QACA,aACA,OACA,WAAW,IAAI,oBAAoB,EACP;CAC5B,MAAM,aAAa,uBAAuB,YAAY;AACtD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM,sBAAsB,cAAc;AAEtD,QAAO,2BAA2B,QAAQ,YAAY,OAAO,SAAS;;AAGxE,SAAgB,sBACd,QACA,YACA,OACmB;CACnB,MAAM,iBAAiB,OAAO,KAAK,UAAU;AAC7C,KAAI,CAAC,kBAAkB,CAAC,yBAAyB,eAAe,CAC9D,OAAM,IAAI,MAAM,eAAe,WAAW,iCAAiC;CAE7E,MAAM,aAAa,uBAAuB,eAAe,cAAc,YAAY;AACnF,KAAI,CAAC,WACH,OAAM,IAAI,MAAM,sBAAsB,eAAe,cAAc,cAAc;AAEnF,KAAI,WAAW,QAAQ,SAAS,MAC9B,OAAM,IAAI,MAAM,mBAAmB,WAAW,QAAQ,KAAK,oCAAoC;AAEjG,MAAK,WAAW,MAAM,WAAW,EAAE,EAAE,SAAS,EAC5C,OAAM,IAAI,MAAM,uEAAuE;CAGzF,MAAM,EAAE,UAAU,WAAW,8BAA8B,YAAY,MAAM;AAC7E,KAAI,aAAa,WACf,OAAM,IAAI,MAAM,yDAAyD,WAAW,QAAQ,SAAS,IAAI;AAG3G,QAAO,MAAM,OAAO,OAAO,EAAE;AAC7B,QAAO,IAAI,UAAU;EACnB,GAAI,OAAO,IAAI,WAAW,EAAE;GAC3B,WAAW;GACV,GAAG;GACH,eAAe;IACb,GAAG,eAAe;IAClB,GAAI,OAAO;IACX,SAAS,eAAe,cAAc;IACtC,iBAAiB,eAAe,cAAc;IAC9C,WAAW,eAAe,cAAc;IACzC;GACF;EACF;CAED,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,SAAS;AACtG,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,cAAc,WAAW,GAAG,0CAA0C;AAExF,QAAO;;AAGT,SAAgB,mBAAmB,QAAgB,YAAuC;CACxF,MAAM,SAAS,OAAO,KAAK,UAAU;CACrC,MAAM,kBAAkB,OAAO,YAAY,YAAY;AACvD,KAAI,CAAC,UAAU,CAAC,gBACd,OAAM,IAAI,MAAM,iCAAiC,aAAa;AAEhE,KAAI,UAAU,CAAC,yBAAyB,OAAO,CAC7C,OAAM,IAAI,MAAM,eAAe,WAAW,iCAAiC;CAG7E,MAAM,WAAW,uBAAuB,OAAO,CAAC,MAAM,cAAc,UAAU,eAAe,WAAW;AACxG,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,iCAAiC,aAAa;AAEhE,4BAA2B,QAAQ,YAAY,EAAE,QAAQ,WAAW,CAAC;AAErE,KAAI,QAAQ;EACV,MAAM,cAAc,EAAE,GAAI,OAAO,KAAK,WAAW,EAAE,EAAG;AACtD,SAAO,YAAY;AACnB,SAAO,MAAM;GACX,GAAI,OAAO,OAAO,EAAE;GACpB,SAAS;GACV;;AAEH,KAAI,iBAAiB;EACnB,MAAM,gBAAgB,EAAE,GAAI,OAAO,YAAY,aAAa,EAAE,EAAG;AACjE,SAAO,cAAc;AACrB,SAAO,aAAa;GAAE,GAAI,OAAO,cAAc,EAAE;GAAG,WAAW;GAAe;;AAEhF,QAAO"}

package/dist/src/connectors/materialize.js

@@ -54,6 +54,8 @@ function materializeConnectorMcpServer(definition, input) {
 		connectorId: definition.id,
 		version: definition.version,
 		displayName: definition.displayName,
+		source: definition.source,
+		artifactSha256: definition.provenance?.sha256,
 		...input.config && Object.keys(input.config).length > 0 ? { config: input.config } : {}
 	};
 	const server = {

package/dist/src/connectors/materialize.js.map

@@ -1 +1 @@
-{"version":3,"file":"materialize.js","names":[],"sources":["../../../src/connectors/materialize.ts"],"sourcesContent":["import { McpServerSchema } from '../config/schema.js';\nimport { createConnectorSecretReference } from './secret-store.js';\nimport type { ConnectorDefinition, ConnectorInstallInput, ManagedConnectorMarker } from './types.js';\n\nconst SERVER_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\nconst TEMPLATE_PATTERN = /^\\{\\{(secrets|config)\\.([A-Za-z0-9_.-]+)\\}\\}$/;\n\nexport function assertValidConnectorServerId(serverId: string): void {\n  if (!SERVER_ID_PATTERN.test(serverId)) {\n    throw new Error('Connector server name must start with a lowercase letter and only contain lowercase letters, numbers, dashes, and underscores.');\n  }\n}\n\nfunction readInputValue(\n  definition: ConnectorDefinition,\n  input: ConnectorInstallInput,\n  scope: 'secrets' | 'config',\n  key: string,\n): unknown {\n  if (scope === 'secrets') {\n    return createConnectorSecretReference(definition.id, key);\n  }\n  return input.config?.[key];\n}\n\nfunction resolveTemplateValue(value: unknown, definition: ConnectorDefinition, input: ConnectorInstallInput): unknown {\n  if (typeof value !== 'string') {\n    return value;\n  }\n  const match = TEMPLATE_PATTERN.exec(value.trim());\n  if (!match) {\n    return value;\n  }\n  return readInputValue(definition, input, match[1] as 'secrets' | 'config', match[2]);\n}\n\nfunction materializeTemplate(value: unknown, definition: ConnectorDefinition, input: ConnectorInstallInput): unknown {\n  const resolved = resolveTemplateValue(value, definition, input);\n  if (Array.isArray(resolved)) {\n    return resolved.map((item) => materializeTemplate(item, definition, input));\n  }\n  if (resolved && typeof resolved === 'object') {\n    const output: Record<string, unknown> = {};\n    for (const [key, child] of Object.entries(resolved as Record<string, unknown>)) {\n      const materializedChild = materializeTemplate(child, definition, input);\n      if (materializedChild !== undefined) {\n        output[key] = materializedChild;\n      }\n    }\n    return output;\n  }\n  return resolved;\n}\n\nfunction assertRequiredInputs(definition: ConnectorDefinition, input: ConnectorInstallInput): void {\n  for (const secret of definition.setup.secrets ?? []) {\n    const value = input.secrets?.[secret.key];\n    if (secret.required && (typeof value !== 'string' || value.trim().length === 0)) {\n      throw new Error(`Missing required secret: ${secret.key}`);\n    }\n  }\n  for (const field of definition.setup.config ?? []) {\n    const value = input.config?.[field.key];\n    if (field.required && (value === undefined || value === null || value === '')) {\n      throw new Error(`Missing required config: ${field.key}`);\n    }\n  }\n}\n\nexport function materializeConnectorMcpServer(\n  definition: ConnectorDefinition,\n  input: ConnectorInstallInput,\n): { serverId: string; server: Record<string, unknown> } {\n  assertRequiredInputs(definition, input);\n  if (definition.runtime.type !== 'mcp') {\n    throw new Error(`Unsupported connector runtime: ${definition.runtime.type}`);\n  }\n\n  const rawServerId = materializeTemplate(definition.runtime.serverId, definition, input);\n  if (typeof rawServerId !== 'string') {\n    throw new Error('Connector server name must be a string.');\n  }\n  const serverId = rawServerId.trim();\n  assertValidConnectorServerId(serverId);\n\n  const rawServer = materializeTemplate(definition.runtime.serverTemplate, definition, input);\n  if (!rawServer || typeof rawServer !== 'object' || Array.isArray(rawServer)) {\n    throw new Error('Connector MCP server template must resolve to a JSON object.');\n  }\n\n  const marker: ManagedConnectorMarker = {\n    managed: true,\n    connectorId: definition.id,\n    version: definition.version,\n    displayName: definition.displayName,\n    ...(input.config && Object.keys(input.config).length > 0 ? { config: input.config } : {}),\n  };\n  const server = {\n    ...(rawServer as Record<string, unknown>),\n    xopcConnector: marker,\n  };\n  const parsed = McpServerSchema.safeParse(server);\n  if (!parsed.success) {\n    throw new Error(parsed.error.issues[0]?.message ?? 'Invalid MCP server config.');\n  }\n  return { serverId, server };\n}\n\nexport function isManagedConnectorServer(server: unknown): server is Record<string, unknown> & { xopcConnector: ManagedConnectorMarker } {\n  if (!server || typeof server !== 'object' || Array.isArray(server)) {\n    return false;\n  }\n  const marker = (server as Record<string, unknown>).xopcConnector;\n  return Boolean(\n    marker &&\n      typeof marker === 'object' &&\n      !Array.isArray(marker) &&\n      (marker as Record<string, unknown>).managed === true &&\n      typeof (marker as Record<string, unknown>).connectorId === 'string',\n  );\n}\n"],"mappings":";;;aAAsD;AAItD,MAAM,oBAAoB;AAC1B,MAAM,mBAAmB;AAEzB,SAAgB,6BAA6B,UAAwB;AACnE,KAAI,CAAC,kBAAkB,KAAK,SAAS,CACnC,OAAM,IAAI,MAAM,iIAAiI;;AAIrJ,SAAS,eACP,YACA,OACA,OACA,KACS;AACT,KAAI,UAAU,UACZ,QAAO,+BAA+B,WAAW,IAAI,IAAI;AAE3D,QAAO,MAAM,SAAS;;AAGxB,SAAS,qBAAqB,OAAgB,YAAiC,OAAuC;AACpH,KAAI,OAAO,UAAU,SACnB,QAAO;CAET,MAAM,QAAQ,iBAAiB,KAAK,MAAM,MAAM,CAAC;AACjD,KAAI,CAAC,MACH,QAAO;AAET,QAAO,eAAe,YAAY,OAAO,MAAM,IAA4B,MAAM,GAAG;;AAGtF,SAAS,oBAAoB,OAAgB,YAAiC,OAAuC;CACnH,MAAM,WAAW,qBAAqB,OAAO,YAAY,MAAM;AAC/D,KAAI,MAAM,QAAQ,SAAS,CACzB,QAAO,SAAS,KAAK,SAAS,oBAAoB,MAAM,YAAY,MAAM,CAAC;AAE7E,KAAI,YAAY,OAAO,aAAa,UAAU;EAC5C,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAoC,EAAE;GAC9E,MAAM,oBAAoB,oBAAoB,OAAO,YAAY,MAAM;AACvE,OAAI,sBAAsB,KAAA,EACxB,QAAO,OAAO;;AAGlB,SAAO;;AAET,QAAO;;AAGT,SAAS,qBAAqB,YAAiC,OAAoC;AACjG,MAAK,MAAM,UAAU,WAAW,MAAM,WAAW,EAAE,EAAE;EACnD,MAAM,QAAQ,MAAM,UAAU,OAAO;AACrC,MAAI,OAAO,aAAa,OAAO,UAAU,YAAY,MAAM,MAAM,CAAC,WAAW,GAC3E,OAAM,IAAI,MAAM,4BAA4B,OAAO,MAAM;;AAG7D,MAAK,MAAM,SAAS,WAAW,MAAM,UAAU,EAAE,EAAE;EACjD,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,MAAI,MAAM,aAAa,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IACxE,OAAM,IAAI,MAAM,4BAA4B,MAAM,MAAM;;;AAK9D,SAAgB,8BACd,YACA,OACuD;AACvD,sBAAqB,YAAY,MAAM;AACvC,KAAI,WAAW,QAAQ,SAAS,MAC9B,OAAM,IAAI,MAAM,kCAAkC,WAAW,QAAQ,OAAO;CAG9E,MAAM,cAAc,oBAAoB,WAAW,QAAQ,UAAU,YAAY,MAAM;AACvF,KAAI,OAAO,gBAAgB,SACzB,OAAM,IAAI,MAAM,0CAA0C;CAE5D,MAAM,WAAW,YAAY,MAAM;AACnC,8BAA6B,SAAS;CAEtC,MAAM,YAAY,oBAAoB,WAAW,QAAQ,gBAAgB,YAAY,MAAM;AAC3F,KAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,UAAU,CACzE,OAAM,IAAI,MAAM,+DAA+D;CAGjF,MAAM,SAAiC;EACrC,SAAS;EACT,aAAa,WAAW;EACxB,SAAS,WAAW;EACpB,aAAa,WAAW;EACxB,GAAI,MAAM,UAAU,OAAO,KAAK,MAAM,OAAO,CAAC,SAAS,IAAI,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;EACzF;CACD,MAAM,SAAS;EACb,GAAI;EACJ,eAAe;EAChB;CACD,MAAM,SAAS,gBAAgB,UAAU,OAAO;AAChD,KAAI,CAAC,OAAO,QACV,OAAM,IAAI,MAAM,OAAO,MAAM,OAAO,IAAI,WAAW,6BAA6B;AAElF,QAAO;EAAE;EAAU;EAAQ;;AAG7B,SAAgB,yBAAyB,QAAgG;AACvI,KAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,OAAO,CAChE,QAAO;CAET,MAAM,SAAU,OAAmC;AACnD,QAAO,QACL,UACE,OAAO,WAAW,YAClB,CAAC,MAAM,QAAQ,OAAO,IACrB,OAAmC,YAAY,QAChD,OAAQ,OAAmC,gBAAgB,SAC9D"}
+{"version":3,"file":"materialize.js","names":[],"sources":["../../../src/connectors/materialize.ts"],"sourcesContent":["import { McpServerSchema } from '../config/schema.js';\nimport { createConnectorSecretReference } from './secret-store.js';\nimport type { ConnectorDefinition, ConnectorInstallInput, ManagedConnectorMarker } from './types.js';\n\nconst SERVER_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\nconst TEMPLATE_PATTERN = /^\\{\\{(secrets|config)\\.([A-Za-z0-9_.-]+)\\}\\}$/;\n\nexport function assertValidConnectorServerId(serverId: string): void {\n  if (!SERVER_ID_PATTERN.test(serverId)) {\n    throw new Error('Connector server name must start with a lowercase letter and only contain lowercase letters, numbers, dashes, and underscores.');\n  }\n}\n\nfunction readInputValue(\n  definition: ConnectorDefinition,\n  input: ConnectorInstallInput,\n  scope: 'secrets' | 'config',\n  key: string,\n): unknown {\n  if (scope === 'secrets') {\n    return createConnectorSecretReference(definition.id, key);\n  }\n  return input.config?.[key];\n}\n\nfunction resolveTemplateValue(value: unknown, definition: ConnectorDefinition, input: ConnectorInstallInput): unknown {\n  if (typeof value !== 'string') {\n    return value;\n  }\n  const match = TEMPLATE_PATTERN.exec(value.trim());\n  if (!match) {\n    return value;\n  }\n  return readInputValue(definition, input, match[1] as 'secrets' | 'config', match[2]);\n}\n\nfunction materializeTemplate(value: unknown, definition: ConnectorDefinition, input: ConnectorInstallInput): unknown {\n  const resolved = resolveTemplateValue(value, definition, input);\n  if (Array.isArray(resolved)) {\n    return resolved.map((item) => materializeTemplate(item, definition, input));\n  }\n  if (resolved && typeof resolved === 'object') {\n    const output: Record<string, unknown> = {};\n    for (const [key, child] of Object.entries(resolved as Record<string, unknown>)) {\n      const materializedChild = materializeTemplate(child, definition, input);\n      if (materializedChild !== undefined) {\n        output[key] = materializedChild;\n      }\n    }\n    return output;\n  }\n  return resolved;\n}\n\nfunction assertRequiredInputs(definition: ConnectorDefinition, input: ConnectorInstallInput): void {\n  for (const secret of definition.setup.secrets ?? []) {\n    const value = input.secrets?.[secret.key];\n    if (secret.required && (typeof value !== 'string' || value.trim().length === 0)) {\n      throw new Error(`Missing required secret: ${secret.key}`);\n    }\n  }\n  for (const field of definition.setup.config ?? []) {\n    const value = input.config?.[field.key];\n    if (field.required && (value === undefined || value === null || value === '')) {\n      throw new Error(`Missing required config: ${field.key}`);\n    }\n  }\n}\n\nexport function materializeConnectorMcpServer(\n  definition: ConnectorDefinition,\n  input: ConnectorInstallInput,\n): { serverId: string; server: Record<string, unknown> } {\n  assertRequiredInputs(definition, input);\n  if (definition.runtime.type !== 'mcp') {\n    throw new Error(`Unsupported connector runtime: ${definition.runtime.type}`);\n  }\n\n  const rawServerId = materializeTemplate(definition.runtime.serverId, definition, input);\n  if (typeof rawServerId !== 'string') {\n    throw new Error('Connector server name must be a string.');\n  }\n  const serverId = rawServerId.trim();\n  assertValidConnectorServerId(serverId);\n\n  const rawServer = materializeTemplate(definition.runtime.serverTemplate, definition, input);\n  if (!rawServer || typeof rawServer !== 'object' || Array.isArray(rawServer)) {\n    throw new Error('Connector MCP server template must resolve to a JSON object.');\n  }\n\n  const marker: ManagedConnectorMarker = {\n    managed: true,\n    connectorId: definition.id,\n    version: definition.version,\n    displayName: definition.displayName,\n    source: definition.source,\n    artifactSha256: definition.provenance?.sha256,\n    ...(input.config && Object.keys(input.config).length > 0 ? { config: input.config } : {}),\n  };\n  const server = {\n    ...(rawServer as Record<string, unknown>),\n    xopcConnector: marker,\n  };\n  const parsed = McpServerSchema.safeParse(server);\n  if (!parsed.success) {\n    throw new Error(parsed.error.issues[0]?.message ?? 'Invalid MCP server config.');\n  }\n  return { serverId, server };\n}\n\nexport function isManagedConnectorServer(server: unknown): server is Record<string, unknown> & { xopcConnector: ManagedConnectorMarker } {\n  if (!server || typeof server !== 'object' || Array.isArray(server)) {\n    return false;\n  }\n  const marker = (server as Record<string, unknown>).xopcConnector;\n  return Boolean(\n    marker &&\n      typeof marker === 'object' &&\n      !Array.isArray(marker) &&\n      (marker as Record<string, unknown>).managed === true &&\n      typeof (marker as Record<string, unknown>).connectorId === 'string',\n  );\n}\n"],"mappings":";;;aAAsD;AAItD,MAAM,oBAAoB;AAC1B,MAAM,mBAAmB;AAEzB,SAAgB,6BAA6B,UAAwB;AACnE,KAAI,CAAC,kBAAkB,KAAK,SAAS,CACnC,OAAM,IAAI,MAAM,iIAAiI;;AAIrJ,SAAS,eACP,YACA,OACA,OACA,KACS;AACT,KAAI,UAAU,UACZ,QAAO,+BAA+B,WAAW,IAAI,IAAI;AAE3D,QAAO,MAAM,SAAS;;AAGxB,SAAS,qBAAqB,OAAgB,YAAiC,OAAuC;AACpH,KAAI,OAAO,UAAU,SACnB,QAAO;CAET,MAAM,QAAQ,iBAAiB,KAAK,MAAM,MAAM,CAAC;AACjD,KAAI,CAAC,MACH,QAAO;AAET,QAAO,eAAe,YAAY,OAAO,MAAM,IAA4B,MAAM,GAAG;;AAGtF,SAAS,oBAAoB,OAAgB,YAAiC,OAAuC;CACnH,MAAM,WAAW,qBAAqB,OAAO,YAAY,MAAM;AAC/D,KAAI,MAAM,QAAQ,SAAS,CACzB,QAAO,SAAS,KAAK,SAAS,oBAAoB,MAAM,YAAY,MAAM,CAAC;AAE7E,KAAI,YAAY,OAAO,aAAa,UAAU;EAC5C,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAoC,EAAE;GAC9E,MAAM,oBAAoB,oBAAoB,OAAO,YAAY,MAAM;AACvE,OAAI,sBAAsB,KAAA,EACxB,QAAO,OAAO;;AAGlB,SAAO;;AAET,QAAO;;AAGT,SAAS,qBAAqB,YAAiC,OAAoC;AACjG,MAAK,MAAM,UAAU,WAAW,MAAM,WAAW,EAAE,EAAE;EACnD,MAAM,QAAQ,MAAM,UAAU,OAAO;AACrC,MAAI,OAAO,aAAa,OAAO,UAAU,YAAY,MAAM,MAAM,CAAC,WAAW,GAC3E,OAAM,IAAI,MAAM,4BAA4B,OAAO,MAAM;;AAG7D,MAAK,MAAM,SAAS,WAAW,MAAM,UAAU,EAAE,EAAE;EACjD,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,MAAI,MAAM,aAAa,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IACxE,OAAM,IAAI,MAAM,4BAA4B,MAAM,MAAM;;;AAK9D,SAAgB,8BACd,YACA,OACuD;AACvD,sBAAqB,YAAY,MAAM;AACvC,KAAI,WAAW,QAAQ,SAAS,MAC9B,OAAM,IAAI,MAAM,kCAAkC,WAAW,QAAQ,OAAO;CAG9E,MAAM,cAAc,oBAAoB,WAAW,QAAQ,UAAU,YAAY,MAAM;AACvF,KAAI,OAAO,gBAAgB,SACzB,OAAM,IAAI,MAAM,0CAA0C;CAE5D,MAAM,WAAW,YAAY,MAAM;AACnC,8BAA6B,SAAS;CAEtC,MAAM,YAAY,oBAAoB,WAAW,QAAQ,gBAAgB,YAAY,MAAM;AAC3F,KAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,UAAU,CACzE,OAAM,IAAI,MAAM,+DAA+D;CAGjF,MAAM,SAAiC;EACrC,SAAS;EACT,aAAa,WAAW;EACxB,SAAS,WAAW;EACpB,aAAa,WAAW;EACxB,QAAQ,WAAW;EACnB,gBAAgB,WAAW,YAAY;EACvC,GAAI,MAAM,UAAU,OAAO,KAAK,MAAM,OAAO,CAAC,SAAS,IAAI,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;EACzF;CACD,MAAM,SAAS;EACb,GAAI;EACJ,eAAe;EAChB;CACD,MAAM,SAAS,gBAAgB,UAAU,OAAO;AAChD,KAAI,CAAC,OAAO,QACV,OAAM,IAAI,MAAM,OAAO,MAAM,OAAO,IAAI,WAAW,6BAA6B;AAElF,QAAO;EAAE;EAAU;EAAQ;;AAG7B,SAAgB,yBAAyB,QAAgG;AACvI,KAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,OAAO,CAChE,QAAO;CAET,MAAM,SAAU,OAAmC;AACnD,QAAO,QACL,UACE,OAAO,WAAW,YAClB,CAAC,MAAM,QAAQ,OAAO,IACrB,OAAmC,YAAY,QAChD,OAAQ,OAAmC,gBAAgB,SAC9D"}

package/dist/src/connectors/types.d.ts

@@ -2,6 +2,12 @@ export type ConnectorKind = 'mcp' | 'cli' | 'http' | 'channel' | 'browser' | 'ex
 export type ConnectorCategory = 'code' | 'docs' | 'browser' | 'data' | 'automation' | 'custom';
 export type ConnectorCapability = 'tools' | 'resources' | 'prompts' | 'context' | 'channel' | 'events' | 'ui' | 'memory_source' | 'workflows' | 'auth.apiKey' | 'auth.oauth' | 'runtime.mcp.stdio' | 'runtime.mcp.sse' | 'runtime.mcp.streamableHttp';
 export type ConnectorAuthMode = 'none' | 'apiKey' | 'oauth';
+export type ConnectorPermissions = {
+    data?: string[];
+    networkDomains?: string[];
+    localExec?: boolean;
+    filesystem?: string[];
+};
 export type ConnectorSecretReference = {
     xopcSecretRef: {
         provider: string;
@@ -27,6 +33,11 @@ export type ConnectorRuntimeDefinition = {
     type: 'mcp';
     serverId: string;
     serverTemplate: Record<string, unknown>;
+    localPackage?: {
+        registry: 'npm';
+        name: string;
+        version: string;
+    };
 } | {
     type: 'channel';
     channelId: string;
@@ -48,7 +59,7 @@ export type ConnectorDefinition = {
     description: string;
     category: ConnectorCategory;
     kind: ConnectorKind;
-    source: 'builtin' | 'extension' | 'custom' | 'registry';
+    source: 'builtin' | 'extension' | 'custom' | 'registry' | 'store';
     capabilities: ConnectorCapability[];
     tags?: string[];
     auth: {
@@ -59,6 +70,11 @@ export type ConnectorDefinition = {
         config?: ConnectorConfigField[];
     };
     runtime: ConnectorRuntimeDefinition;
+    permissions?: ConnectorPermissions;
+    provenance?: {
+        packageName: string;
+        sha256: string;
+    };
 };
 export type ConnectorInstallInput = {
     secrets?: Record<string, unknown>;
@@ -144,4 +160,6 @@ export type ManagedConnectorMarker = {
     lastError?: string;
     displayName?: string;
     config?: Record<string, unknown>;
+    source?: ConnectorDefinition['source'];
+    artifactSha256?: string;
 };

package/dist/src/extensions/install.js

@@ -3,8 +3,8 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir as resolveExtensionsDir$1 } from "../config/paths.js";
 import { checkEngineCompatibility } from "./engine-check.js";
-import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
 import { MAX_EXTENSION_STORE_ZIP_BYTES } from "./store-zip-limits.js";
+import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
 import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
 import { execSync } from "child_process";

package/dist/src/extensions/types/manifest.d.ts

@@ -174,7 +174,7 @@ export interface ChatWidgetMatch {
 export interface PageContribution {
     id: string;
     title: string;
-    /** Relative path; host may mount under `/apps/` (see Phase 2). */
+    /** Relative path; host may mount under `/extensions/` (see Phase 2). */
     path: string;
     entrypoint: string;
     showInNav?: boolean;

package/dist/src/extensions/update.js

@@ -2,10 +2,10 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
+import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { getExtensionLockfileManager } from "./lockfile.js";
 import { installExtensionFromStoreZip, installFromNpm } from "./install.js";
 import { findExtension } from "./marketplace.js";
-import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { join } from "node:path";
 import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import semver from "semver";
@@ -51,8 +51,10 @@ async function upsertNpmExtensionLock(lock, targetDir, result, spec) {
 }
 async function installExtensionFromStoreWithLock(params) {
 	try {
-		const { downloadUrl, version } = await resolveExtensionZipDownloadUrl(params.storeBase, params.packageName, params.version);
-		const result = await installExtensionFromStoreZip(await downloadExtensionStoreZipBuffer(params.storeBase, downloadUrl), params.targetDir);
+		const { downloadUrl, version, sha256 } = await resolveExtensionZipDownloadUrl(params.storeBase, params.packageName, params.version);
+		const buf = await downloadExtensionStoreZipBuffer(params.storeBase, downloadUrl);
+		verifyStoreArtifactSha256(buf, sha256);
+		const result = await installExtensionFromStoreZip(buf, params.targetDir);
 		if (!result.ok || !result.extensionId) return {
 			ok: false,
 			error: result.error ?? "install failed"