daemora 1.0.0-alpha.0

package/dist/server/routes/goals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"goals.js","sourceRoot":"","sources":["../../../src/server/routes/goals.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,IAAgB;IAC5D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,IAAI,GAAgE;YACxE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAgB,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/integrations.d.ts

@@ -0,0 +1,35 @@
+/**
+ * /api/integrations — OAuth-backed integration management.
+ *
+ * Endpoints:
+ *   GET    /api/integrations                          — availability + connected accounts
+ *   POST   /api/integrations/:integration/start       — begin OAuth; returns { url, state }
+ *   GET    /oauth/providers/:provider/callback        — provider redirect target (preferred)
+ *   GET    /oauth/integrations/:integration/callback  — legacy per-integration callback (compat)
+ *   DELETE /api/integrations/:integration/:accountId  — revoke connection
+ *
+ * Callback is a GET redirect from the provider (Twitter / Google / Meta / …).
+ * It exchanges the authorization code for tokens and then redirects the
+ * browser back to /integrations?connected=<id>&label=... so the UI
+ * can show a success state.
+ *
+ * Why per-provider instead of per-integration in the URL: a single OAuth
+ * client owns all integrations for one provider (youtube + gmail +
+ * google_calendar all ride Google's client), so they all need to share
+ * one Authorized redirect URI in that provider's console. The per-
+ * integration path is kept as a fallback so already-registered URIs
+ * (e.g. `…/oauth/integrations/youtube/callback`) keep working.
+ */
+import type { Express } from "express";
+import type { ConfigManager } from "../../config/ConfigManager.js";
+import type { IntegrationManager } from "../../integrations/IntegrationManager.js";
+export interface IntegrationRoutesDeps {
+    readonly integrations: IntegrationManager;
+    readonly getPublicUrl: () => string;
+    /** For reading/writing OAuth client creds into the vault. */
+    readonly cfg: ConfigManager;
+    /** Loopback file token to bounce back through /integrations page. */
+    readonly getUiToken?: () => string | undefined;
+}
+export declare function mountIntegrationRoutes(app: Express, deps: IntegrationRoutesDeps): void;
+//# sourceMappingURL=integrations.d.ts.map

package/dist/server/routes/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../../src/server/routes/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAmCnF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,MAAM,CAAC;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAChD;AA8FD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAwStF"}

package/dist/server/routes/integrations.js

@@ -0,0 +1,448 @@
+/**
+ * /api/integrations — OAuth-backed integration management.
+ *
+ * Endpoints:
+ *   GET    /api/integrations                          — availability + connected accounts
+ *   POST   /api/integrations/:integration/start       — begin OAuth; returns { url, state }
+ *   GET    /oauth/providers/:provider/callback        — provider redirect target (preferred)
+ *   GET    /oauth/integrations/:integration/callback  — legacy per-integration callback (compat)
+ *   DELETE /api/integrations/:integration/:accountId  — revoke connection
+ *
+ * Callback is a GET redirect from the provider (Twitter / Google / Meta / …).
+ * It exchanges the authorization code for tokens and then redirects the
+ * browser back to /integrations?connected=<id>&label=... so the UI
+ * can show a success state.
+ *
+ * Why per-provider instead of per-integration in the URL: a single OAuth
+ * client owns all integrations for one provider (youtube + gmail +
+ * google_calendar all ride Google's client), so they all need to share
+ * one Authorized redirect URI in that provider's console. The per-
+ * integration path is kept as a fallback so already-registered URIs
+ * (e.g. `…/oauth/integrations/youtube/callback`) keep working.
+ */
+import { z } from "zod";
+import { NotFoundError, ValidationError } from "../../util/errors.js";
+import { extraScopesVaultKey, redirectUriOverrideVaultKey, readRedirectUriOverride, } from "../../integrations/keys.js";
+import { createLogger } from "../../util/logger.js";
+const log = createLogger("integrations.routes");
+const INTEGRATION_IDS = new Set([
+    "twitter",
+    "youtube",
+    "facebook",
+    "instagram",
+    "github",
+    "notion",
+    "gmail",
+    "google_calendar",
+    "reddit",
+    "linkedin",
+    "tiktok",
+]);
+const startBody = z.object({
+    /**
+     * Where the browser is calling from. The callback URL we send to the
+     * provider uses the server's own public URL (tunnel), so this is
+     * informational only — the UI passes its origin so the callback can
+     * redirect back to the right /integrations page.
+     */
+    uiOrigin: z.string().url().optional(),
+});
+const PROVIDER_CREDS = {
+    twitter: {
+        provider: "twitter",
+        clientIdKey: "TWITTER_CLIENT_ID",
+        // X supports both Public (PKCE-only) and Confidential (PKCE + Basic
+        // auth) OAuth 2.0 apps. We surface the secret field but allow blank —
+        // populate only when the X portal app is type "Confidential".
+        clientSecretKey: "TWITTER_CLIENT_SECRET",
+        clientSecretOptional: true,
+        sharedWith: ["twitter"],
+        clientIdLabel: "Client ID",
+        consoleUrl: "https://developer.twitter.com/en/portal/dashboard",
+    },
+    google: {
+        provider: "google",
+        clientIdKey: "GOOGLE_CLIENT_ID",
+        clientSecretKey: "GOOGLE_CLIENT_SECRET",
+        sharedWith: ["youtube", "gmail", "google_calendar"],
+        clientIdLabel: "Client ID",
+        consoleUrl: "https://console.cloud.google.com/apis/credentials",
+    },
+    meta: {
+        provider: "meta",
+        clientIdKey: "META_APP_ID",
+        clientSecretKey: "META_APP_SECRET",
+        sharedWith: ["facebook", "instagram"],
+        clientIdLabel: "App ID",
+        consoleUrl: "https://developers.facebook.com/apps",
+    },
+    github: {
+        provider: "github",
+        clientIdKey: "GITHUB_CLIENT_ID",
+        clientSecretKey: "GITHUB_CLIENT_SECRET",
+        sharedWith: ["github"],
+        clientIdLabel: "Client ID",
+        consoleUrl: "https://github.com/settings/apps",
+    },
+    notion: {
+        provider: "notion",
+        clientIdKey: "NOTION_CLIENT_ID",
+        clientSecretKey: "NOTION_CLIENT_SECRET",
+        sharedWith: ["notion"],
+        clientIdLabel: "OAuth Client ID",
+        consoleUrl: "https://www.notion.so/my-integrations",
+    },
+    reddit: {
+        provider: "reddit",
+        clientIdKey: "REDDIT_CLIENT_ID",
+        clientSecretKey: "REDDIT_CLIENT_SECRET",
+        sharedWith: ["reddit"],
+        clientIdLabel: "Client ID",
+        consoleUrl: "https://www.reddit.com/prefs/apps",
+    },
+    linkedin: {
+        provider: "linkedin",
+        clientIdKey: "LINKEDIN_CLIENT_ID",
+        clientSecretKey: "LINKEDIN_CLIENT_SECRET",
+        sharedWith: ["linkedin"],
+        clientIdLabel: "Client ID",
+        consoleUrl: "https://www.linkedin.com/developers/apps",
+    },
+    tiktok: {
+        provider: "tiktok",
+        clientIdKey: "TIKTOK_CLIENT_KEY",
+        clientSecretKey: "TIKTOK_CLIENT_SECRET",
+        sharedWith: ["tiktok"],
+        clientIdLabel: "Client Key",
+        consoleUrl: "https://developers.tiktok.com/apps",
+    },
+};
+export function mountIntegrationRoutes(app, deps) {
+    app.get("/api/integrations", (_req, res) => {
+        res.json({
+            availability: deps.integrations.availability(),
+            accounts: deps.integrations.listAccounts(),
+        });
+    });
+    app.post("/api/integrations/:integration/start", (req, res) => {
+        const integration = parseIntegration(req);
+        const body = startBody.safeParse(req.body ?? {});
+        if (!body.success)
+            throw new ValidationError(body.error.message);
+        // Build the callback URL from whichever origin the USER'S browser
+        // is on — not the server's public URL. If they loaded Daemora at
+        // localhost:8081, Google gets localhost:8081 as the redirect URI;
+        // if they're going through a tunnel, Google gets the tunnel URL.
+        // Falls back to getPublicUrl() when uiOrigin isn't supplied (e.g.
+        // from a CLI-driven connect).
+        //
+        // The URL is keyed by PROVIDER, not integration, so one registered
+        // redirect URI in each provider's console covers every integration
+        // that rides that provider (youtube + gmail + calendar all share
+        // `/oauth/providers/google/callback`).
+        // Precedence: per-integration pinned override > UI browser origin >
+        // hosted public URL. The pin lets users register a tunnel URL in
+        // their provider portal once and stop caring about which browser
+        // tab they're in (TikTok specifically rejects http://localhost).
+        const provider = deps.integrations.providerFor(integration);
+        const pinned = readRedirectUriOverride(deps.cfg, integration);
+        const redirectUri = pinned
+            ?? buildCallbackUrl(body.data.uiOrigin ?? deps.getPublicUrl(), provider);
+        log.info({ integration, provider, redirectUri, source: pinned ? "pinned" : "uiOrigin" }, "OAuth start — exact redirect_uri being sent to provider");
+        const { url, state } = deps.integrations.startAuth(integration, redirectUri);
+        // Remember the UI origin so the callback can redirect back. Keyed
+        // by state to survive the round-trip.
+        if (body.data.uiOrigin)
+            rememberUiOrigin(state, body.data.uiOrigin);
+        res.json({ url, state });
+    });
+    // The callback hits this route directly from the provider's redirect
+    // — no auth headers, since the browser is following a 302 from
+    // twitter.com / facebook.com / google.com. Lives under /oauth/ so
+    // the requireAuth middleware can bypass it by prefix without
+    // opening up the rest of /api/integrations.
+    //
+    // Preferred unified route — ONE URI to register across every
+    // provider console regardless of which integration. The integration
+    // is always recovered from the `pending` map via `state`, so the URL
+    // carries no identifying path segment at all.
+    app.get("/oauth/callback", (req, res) => handleCallback(req, res));
+    // Legacy per-provider route — kept so already-registered URIs like
+    // `/oauth/providers/google/callback` keep working while users migrate.
+    app.get("/oauth/providers/:provider/callback", (req, res) => handleCallback(req, res));
+    // Legacy per-integration route — same compat story for early
+    // YouTube installs that registered `/oauth/integrations/youtube/callback`.
+    app.get("/oauth/integrations/:integration/callback", (req, res) => handleCallback(req, res));
+    async function handleCallback(req, res) {
+        const state = typeof req.query["state"] === "string" ? req.query["state"] : "";
+        const code = typeof req.query["code"] === "string" ? req.query["code"] : "";
+        const providerError = typeof req.query["error"] === "string" ? req.query["error"] : "";
+        // For error messages only — the real integration id comes from `state`.
+        const pathLabel = req.params["provider"] ?? req.params["integration"] ?? "unknown";
+        const uiOrigin = consumeUiOrigin(state) ?? req.protocol + "://" + (req.get("host") ?? "localhost");
+        const redirectBack = (qs) => {
+            res.redirect(302, `${uiOrigin.replace(/\/+$/, "")}/integrations?${qs}`);
+        };
+        if (providerError) {
+            redirectBack(`error=${encodeURIComponent(providerError)}&integration=${pathLabel}`);
+            return;
+        }
+        if (!state || !code) {
+            redirectBack(`error=missing_state_or_code&integration=${pathLabel}`);
+            return;
+        }
+        try {
+            const { integration, accountLabel } = await deps.integrations.completeAuth(state, code);
+            redirectBack(`connected=${integration}&label=${encodeURIComponent(accountLabel)}`);
+        }
+        catch (e) {
+            redirectBack(`error=${encodeURIComponent(e.message.slice(0, 200))}&integration=${pathLabel}`);
+        }
+    }
+    // NOTE: DELETE /api/integrations/:integration/:accountId is declared
+    // AFTER the more-specific `/credentials` path below — otherwise Express
+    // matches `/credentials` against `:accountId` and the wrong handler runs.
+    // (Express matches in declaration order; we put specific paths first.)
+    // ── Per-integration OAuth client credentials (UI-managed) ──────────
+    //
+    // Users register their own OAuth apps in each provider's console and
+    // paste the client id / secret here. Values are persisted encrypted
+    // in the vault; we never return them again (GET only exposes a
+    // boolean). Extra scopes beyond the defaults are stored as a JSON
+    // array under `<INTEGRATION>_EXTRA_SCOPES`.
+    app.get("/api/integrations/:integration/credentials", (req, res) => {
+        const integration = parseIntegration(req);
+        const provider = deps.integrations.providerFor(integration);
+        const spec = PROVIDER_CREDS[provider];
+        const vault = deps.cfg.vault;
+        const hasId = vault.isUnlocked() && vault.has(spec.clientIdKey);
+        const hasSecret = spec.clientSecretKey
+            ? vault.isUnlocked() && vault.has(spec.clientSecretKey)
+            : true;
+        // For "configured" we treat optional secrets as never-required, so a
+        // Public-client X app reads as configured with just the client_id.
+        const secretRequired = spec.clientSecretKey !== null && !spec.clientSecretOptional;
+        const origin = deps.getPublicUrl();
+        const redirectUri = buildCallbackUrl(origin, provider);
+        const legacyRedirectUri = `${origin.replace(/\/+$/, "")}/oauth/integrations/${integration}/callback`;
+        res.json({
+            integration,
+            provider,
+            configured: hasId && (!secretRequired || hasSecret),
+            hasClientId: hasId,
+            hasClientSecret: hasSecret,
+            requiresClientSecret: secretRequired,
+            // Show the secret field even when optional, so the user can fill
+            // it in for Confidential X apps without re-deploying the UI.
+            showsClientSecret: spec.clientSecretKey !== null,
+            clientIdLabel: spec.clientIdLabel,
+            clientSecretLabel: spec.clientSecretKey
+                ? (spec.clientSecretOptional ? "Client Secret (optional — only for Confidential apps)" : "Client Secret")
+                : null,
+            consoleUrl: spec.consoleUrl,
+            redirectUri,
+            legacyRedirectUri,
+            sharedWith: spec.sharedWith,
+            defaultScopes: deps.integrations.defaultScopesFor(integration),
+            extraScopes: readExtraScopesList(deps.cfg, integration),
+            // Echo the pinned redirect URI back so the UI can pre-fill the
+            // override field. Empty string when the user hasn't pinned one.
+            redirectUriOverride: readRedirectUriOverride(deps.cfg, integration) ?? "",
+        });
+    });
+    // The form pattern is "leave blank to keep existing value" — empty or
+    // missing fields mean "don't touch what's in the vault". Required-on-
+    // first-save is enforced in the handler below, where we know whether
+    // an existing entry is already present.
+    const credsBody = z.object({
+        clientId: z.string().max(512).optional(),
+        clientSecret: z.string().max(512).optional(),
+        extraScopes: z.array(z.string().min(1).max(256)).max(64).optional(),
+        /** Optional pinned redirect URI — bypasses uiOrigin derivation.
+         *  Must be a fully-qualified URL with scheme + host. Empty string
+         *  clears the override on the next save. */
+        redirectUriOverride: z.string().max(512).optional(),
+    });
+    /**
+     * Heuristic: real OAuth scopes are either short (< 32 chars) OR contain
+     * a structural separator (`.`, `:`, or `/`). Bare 32+ char base64-url
+     * blobs are almost always credentials someone pasted by accident — we
+     * reject them so they don't end up appended to the auth URL's scope
+     * param and break the OAuth handshake.
+     */
+    function looksLikeCredentialNotScope(scope) {
+        if (scope.length < 32)
+            return false;
+        if (/[.:/]/.test(scope))
+            return false;
+        return /^[A-Za-z0-9_-]+$/.test(scope);
+    }
+    app.post("/api/integrations/:integration/credentials", (req, res) => {
+        const integration = parseIntegration(req);
+        const provider = deps.integrations.providerFor(integration);
+        const spec = PROVIDER_CREDS[provider];
+        const vault = deps.cfg.vault;
+        if (!vault.isUnlocked()) {
+            res.status(503).json({ code: "vault_locked", error: "Unlock the vault before saving credentials." });
+            return;
+        }
+        const body = credsBody.safeParse(req.body ?? {});
+        if (!body.success)
+            throw new ValidationError(body.error.message);
+        // Client ID — "leave blank to keep" semantics. Only write when a
+        // non-empty value is supplied. If the vault is empty AND the user
+        // didn't provide one, refuse — can't save a config with no client_id.
+        const clientIdInput = body.data.clientId?.trim();
+        if (clientIdInput) {
+            vault.set(spec.clientIdKey, clientIdInput);
+        }
+        else if (!vault.has(spec.clientIdKey)) {
+            throw new ValidationError(`${integration}: ${spec.clientIdLabel} is required.`);
+        }
+        if (spec.clientSecretKey) {
+            const secret = body.data.clientSecret?.trim();
+            if (secret) {
+                vault.set(spec.clientSecretKey, secret);
+            }
+            else if (spec.clientSecretOptional) {
+                // For Twitter (optional secret): a blank field on subsequent
+                // saves means "leave existing alone" rather than "clear" — only
+                // an explicit clear via the Clear button wipes it. This keeps
+                // the "leave blank to keep" pattern consistent with client_id.
+                // No-op here.
+            }
+            else if (!vault.has(spec.clientSecretKey)) {
+                throw new ValidationError(`${integration}: client secret is required for this provider.`);
+            }
+        }
+        // Extra scopes are stored per INTEGRATION (not per provider) so
+        // the user can, say, add a Gmail-only scope without touching the
+        // YouTube scope set. We validate the format here to catch the
+        // common mistake of pasting a credential into this field.
+        if (body.data.extraScopes !== undefined) {
+            const cleaned = Array.from(new Set(body.data.extraScopes.map((s) => s.trim()).filter(Boolean)));
+            const offenders = cleaned.filter(looksLikeCredentialNotScope);
+            if (offenders.length > 0) {
+                throw new ValidationError(`${integration}: extra scopes contain what looks like a credential, not a scope: ` +
+                    `${offenders.map((s) => `"${s.slice(0, 8)}…${s.slice(-4)}"`).join(", ")}. ` +
+                    `If you meant to set a Client ID or Client Secret, paste it in those fields instead.`);
+            }
+            if (cleaned.length > 0)
+                vault.set(extraScopesVaultKey(integration), JSON.stringify(cleaned));
+            else
+                vault.delete(extraScopesVaultKey(integration));
+        }
+        // Pinned redirect-URI override. Empty / undefined = no override
+        // (uiOrigin-based). Anything else must look like a real URL.
+        if (body.data.redirectUriOverride !== undefined) {
+            const override = body.data.redirectUriOverride.trim();
+            if (override === "") {
+                vault.delete(redirectUriOverrideVaultKey(integration));
+            }
+            else {
+                try {
+                    const u = new URL(override);
+                    if (u.protocol !== "http:" && u.protocol !== "https:") {
+                        throw new ValidationError(`Redirect URI must be http(s): ${override}`);
+                    }
+                }
+                catch (e) {
+                    if (e instanceof ValidationError)
+                        throw e;
+                    throw new ValidationError(`Redirect URI is not a valid URL: ${override}`);
+                }
+                vault.set(redirectUriOverrideVaultKey(integration), override);
+            }
+        }
+        log.info({ integration, provider, hasSecret: !!body.data.clientSecret, extras: body.data.extraScopes?.length ?? 0 }, "integration credentials saved");
+        res.json({
+            ok: true,
+            configured: true,
+            sharedWith: spec.sharedWith,
+        });
+    });
+    app.delete("/api/integrations/:integration/credentials", (req, res) => {
+        const integration = parseIntegration(req);
+        const provider = deps.integrations.providerFor(integration);
+        const spec = PROVIDER_CREDS[provider];
+        const vault = deps.cfg.vault;
+        if (!vault.isUnlocked()) {
+            res.status(503).json({ code: "vault_locked", error: "Unlock the vault before modifying credentials." });
+            return;
+        }
+        vault.delete(spec.clientIdKey);
+        if (spec.clientSecretKey)
+            vault.delete(spec.clientSecretKey);
+        vault.delete(extraScopesVaultKey(integration));
+        vault.delete(redirectUriOverrideVaultKey(integration));
+        log.info({ integration, provider }, "integration credentials cleared");
+        res.json({ ok: true });
+    });
+    // Wildcard `:accountId` route — registered LAST so the specific
+    // `/credentials` paths above always win on dispatch.
+    app.delete("/api/integrations/:integration/:accountId", (req, res) => {
+        const integration = parseIntegration(req);
+        const accountId = req.params["accountId"];
+        if (!accountId)
+            throw new ValidationError("Missing accountId");
+        const accounts = deps.integrations.listAccounts(integration);
+        if (!accounts.some((a) => a.accountId === accountId)) {
+            throw new NotFoundError(`No ${integration} account ${accountId} connected`);
+        }
+        deps.integrations.disconnect(integration, accountId);
+        res.json({ ok: true });
+    });
+}
+function readExtraScopesList(cfg, integration) {
+    if (!cfg.vault.isUnlocked())
+        return [];
+    const raw = cfg.vault.get(extraScopesVaultKey(integration))?.reveal();
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed.filter((s) => typeof s === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+function parseIntegration(req) {
+    const raw = req.params["integration"];
+    if (!raw || !INTEGRATION_IDS.has(raw)) {
+        throw new ValidationError(`Unknown integration: ${raw}`);
+    }
+    return raw;
+}
+function buildCallbackUrl(publicUrl, _provider) {
+    // Unified callback — one URI for every provider. Integration is
+    // recovered from `state` inside the handler, so the URL doesn't need
+    // to carry it. `_provider` is kept in the signature only because the
+    // caller (start route) still passes it; its value no longer affects
+    // the URL emitted.
+    const base = publicUrl.replace(/\/+$/, "");
+    return `${base}/oauth/callback`;
+}
+/** In-memory UI origin map keyed by state. 10-min TTL. */
+const UI_ORIGINS = new Map();
+const UI_ORIGIN_TTL_MS = 10 * 60_000;
+function rememberUiOrigin(state, origin) {
+    UI_ORIGINS.set(state, { origin, at: Date.now() });
+    // Lazy GC.
+    if (UI_ORIGINS.size > 100) {
+        const cutoff = Date.now() - UI_ORIGIN_TTL_MS;
+        for (const [s, v] of UI_ORIGINS)
+            if (v.at < cutoff)
+                UI_ORIGINS.delete(s);
+    }
+}
+function consumeUiOrigin(state) {
+    const entry = UI_ORIGINS.get(state);
+    if (!entry)
+        return null;
+    UI_ORIGINS.delete(state);
+    if (Date.now() - entry.at > UI_ORIGIN_TTL_MS)
+        return null;
+    return entry.origin;
+}
+//# sourceMappingURL=integrations.js.map

package/dist/server/routes/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../../src/server/routes/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAEhD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAgB;IAC7C,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAgCH,MAAM,cAAc,GAAyC;IAC3D,OAAO,EAAE;QACP,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,mBAAmB;QAChC,oEAAoE;QACpE,sEAAsE;QACtE,8DAA8D;QAC9D,eAAe,EAAE,uBAAuB;QACxC,oBAAoB,EAAE,IAAI;QAC1B,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,aAAa,EAAE,WAAW;QAC1B,UAAU,EAAE,mDAAmD;KAChE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kBAAkB;QAC/B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC;QACnD,aAAa,EAAE,WAAW;QAC1B,UAAU,EAAE,mDAAmD;KAChE;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,aAAa;QAC1B,eAAe,EAAE,iBAAiB;QAClC,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;QACrC,aAAa,EAAE,QAAQ;QACvB,UAAU,EAAE,sCAAsC;KACnD;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kBAAkB;QAC/B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,aAAa,EAAE,WAAW;QAC1B,UAAU,EAAE,kCAAkC;KAC/C;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kBAAkB;QAC/B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,aAAa,EAAE,iBAAiB;QAChC,UAAU,EAAE,uCAAuC;KACpD;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kBAAkB;QAC/B,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,aAAa,EAAE,WAAW;QAC1B,UAAU,EAAE,mCAAmC;KAChD;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oBAAoB;QACjC,eAAe,EAAE,wBAAwB;QACzC,UAAU,EAAE,CAAC,UAAU,CAAC;QACxB,aAAa,EAAE,WAAW;QAC1B,UAAU,EAAE,0CAA0C;KACvD;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,sBAAsB;QACvC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,oCAAoC;KACjD;CACF,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,IAA2B;IAC9E,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5D,GAAG,CAAC,IAAI,CAAC;YACP,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;YAC9C,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/E,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,8BAA8B;QAC9B,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,uCAAuC;QACvC,oEAAoE;QACpE,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM;eACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3E,GAAG,CAAC,IAAI,CACN,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,EAC9E,yDAAyD,CAC1D,CAAC;QACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7E,kEAAkE;QAClE,sCAAsC;QACtC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,6DAA6D;IAC7D,4CAA4C;IAC5C,EAAE;IACF,6DAA6D;IAC7D,oEAAoE;IACpE,qEAAqE;IACrE,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE,CACzD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CACzB,CAAC;IAEF,mEAAmE;IACnE,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,qCAAqC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE,CAC7E,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CACzB,CAAC;IAEF,6DAA6D;IAC7D,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE,CACnF,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CACzB,CAAC;IAEF,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,wEAAwE;QACxE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;QAEnF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC;QACnG,MAAM,YAAY,GAAG,CAAC,EAAU,EAAQ,EAAE;YACxC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC;QAEF,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,SAAS,kBAAkB,CAAC,aAAa,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,YAAY,CAAC,2CAA2C,SAAS,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxF,YAAY,CACV,aAAa,WAAW,UAAU,kBAAkB,CAAC,YAAY,CAAC,EAAE,CACrE,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CACV,SAAS,kBAAkB,CAAE,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,gBAAgB,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IAEvE,sEAAsE;IACtE,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,4CAA4C;IAE5C,GAAG,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;YACpC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC;QACT,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,iBAAiB,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,WAAW,WAAW,CAAC;QACrG,GAAG,CAAC,IAAI,CAAC;YACP,WAAW;YACX,QAAQ;YACR,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,cAAc,IAAI,SAAS,CAAC;YACnD,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,SAAS;YAC1B,oBAAoB,EAAE,cAAc;YACpC,iEAAiE;YACjE,6DAA6D;YAC7D,iBAAiB,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;YAChD,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,IAAI,CAAC,eAAe;gBACrC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,eAAe,CAAC;gBACzG,CAAC,CAAC,IAAI;YACR,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW;YACX,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,WAAW,CAAC;YAC9D,WAAW,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;YACvD,+DAA+D;YAC/D,gEAAgE;YAChE,mBAAmB,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,wCAAwC;IACxC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACnE;;oDAE4C;QAC5C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACpD,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,SAAS,2BAA2B,CAAC,KAAa;QAChD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACrF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,iEAAiE;QACjE,kEAAkE;QAClE,sEAAsE;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,aAAa,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,KAAK,IAAI,CAAC,aAAa,eAAe,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACrC,6DAA6D;gBAC7D,gEAAgE;gBAChE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,cAAc;YAChB,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,gDAAgD,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,8DAA8D;QAC9D,0DAA0D;QAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChG,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC9D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,GAAG,WAAW,oEAAoE;oBAClF,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC3E,qFAAqF,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACxF,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,gEAAgE;QAChE,6DAA6D;QAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACtD,MAAM,IAAI,eAAe,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;oBACzE,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,eAAe;wBAAE,MAAM,CAAC,CAAC;oBAC1C,MAAM,IAAI,eAAe,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACtJ,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,4CAA4C,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,eAAe;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,qDAAqD;IACrD,GAAG,CAAC,MAAM,CAAC,2CAA2C,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACtF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,aAAa,CAAC,MAAM,WAAW,YAAY,SAAS,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAkB,EAAE,WAA0B;IACzE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAoB,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;IAC5D,gEAAgE;IAChE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,mBAAmB;IACnB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,IAAI,iBAAiB,CAAC;AAClC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0C,CAAC;AACrE,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAErC,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,WAAW;IACX,IAAI,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU;YAAE,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;gBAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC"}

package/dist/server/routes/mcp.d.ts

@@ -0,0 +1,7 @@
+/**
+ * /api/mcp — MCP server lifecycle + tool discovery.
+ */
+import type { Express } from "express";
+import type { ServerDeps } from "../index.js";
+export declare function mountMCPRoutes(app: Express, deps: ServerDeps): void;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/server/routes/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/server/routes/mcp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAI1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAU9C,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CA0EnE"}

package/dist/server/routes/mcp.js

@@ -0,0 +1,88 @@
+/**
+ * /api/mcp — MCP server lifecycle + tool discovery.
+ */
+import { z } from "zod";
+import { ValidationError } from "../../util/errors.js";
+const addServerSchema = z.object({
+    name: z.string().min(1).max(64),
+    command: z.string().min(1).max(512),
+    args: z.array(z.string()).default([]),
+    env: z.record(z.string(), z.string()).default({}),
+    enabled: z.boolean().default(true),
+});
+export function mountMCPRoutes(app, deps) {
+    app.get("/api/mcp", (_req, res) => {
+        res.json({
+            servers: deps.mcp.listStatus(),
+            tools: deps.mcp.allTools(),
+        });
+    });
+    app.get("/api/mcp/:name", (req, res) => {
+        const name = req.params.name ?? "";
+        const status = deps.mcp.listStatus().find((s) => s.name === name);
+        if (!status)
+            return res.status(404).json({ error: "mcp server not found" });
+        res.json({ server: status });
+    });
+    app.post("/api/mcp", async (req, res) => {
+        const parsed = addServerSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.message);
+        const existing = deps.mcpStore.get(parsed.data.name);
+        if (existing) {
+            deps.mcpStore.update(parsed.data.name, {
+                command: parsed.data.command,
+                args: parsed.data.args,
+                env: parsed.data.env,
+                enabled: parsed.data.enabled,
+            });
+        }
+        else {
+            deps.mcpStore.add(parsed.data.name, {
+                command: parsed.data.command,
+                args: parsed.data.args,
+                env: parsed.data.env,
+                enabled: parsed.data.enabled,
+            });
+        }
+        await deps.mcp.loadAll();
+        res.status(201).json({ ok: true });
+    });
+    app.patch("/api/mcp/:name", async (req, res) => {
+        const name = req.params.name ?? "";
+        const updated = deps.mcpStore.update(name, req.body ?? {});
+        if (!updated)
+            return res.status(404).json({ error: "mcp server not found" });
+        await deps.mcp.loadAll();
+        res.json({ server: updated });
+    });
+    app.post("/api/mcp/:name/enable", async (req, res) => {
+        const name = req.params.name ?? "";
+        const updated = deps.mcpStore.update(name, { enabled: true });
+        if (!updated)
+            return res.status(404).json({ error: "mcp server not found" });
+        await deps.mcp.loadAll();
+        res.json({ ok: true });
+    });
+    app.post("/api/mcp/:name/disable", async (req, res) => {
+        const name = req.params.name ?? "";
+        const updated = deps.mcpStore.update(name, { enabled: false });
+        if (!updated)
+            return res.status(404).json({ error: "mcp server not found" });
+        await deps.mcp.loadAll();
+        res.json({ ok: true });
+    });
+    app.delete("/api/mcp/:name", async (req, res) => {
+        const name = req.params.name ?? "";
+        const ok = deps.mcpStore.remove(name);
+        if (!ok)
+            return res.status(404).json({ error: "mcp server not found" });
+        await deps.mcp.loadAll();
+        res.status(204).end();
+    });
+    app.post("/api/mcp/reload", async (_req, res) => {
+        await deps.mcp.loadAll();
+        res.json({ ok: true, servers: deps.mcp.listStatus().length, tools: deps.mcp.allTools().length });
+    });
+}
+//# sourceMappingURL=mcp.js.map

package/dist/server/routes/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/server/routes/mcp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,IAAgB;IAC3D,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;gBACrC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBACtB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;aAC7B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;gBAClC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBACtB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC"}