studiograph 1.3.47 → 1.3.48-beta.0

package/dist/server/routes/connectors-api.js

@@ -0,0 +1,410 @@
+/**
+ * Connectors API routes
+ *
+ * REST endpoints for MCP connector management:
+ *   GET    /api/connectors                        — list configured MCP connectors
+ *   POST   /api/connectors/import                 — import connector(s) from JSON config block
+ *   GET    /api/connectors/:name/config           — get connector config (secrets masked)
+ *   POST   /api/connectors/:name/config           — create/update connector config
+ *   DELETE /api/connectors/:name/config           — remove connector config
+ *   POST   /api/connectors/:name/oauth/connect    — initiate OAuth flow (MCP SDK auto-discovery)
+ *   GET    /api/oauth/callback/:name              — OAuth callback (browser redirect)
+ *   GET    /api/connectors/:name/oauth/status     — poll OAuth connection status
+ *   POST   /api/connectors/:name/oauth/disconnect — clear OAuth tokens
+ */
+import { isWorkspaceOwner } from '../../services/auth-service.js';
+import { ConnectorManager } from '../../mcp/connector-manager.js';
+import { McpOAuthProvider } from '../../mcp/oauth-provider.js';
+import { getBrokerConnectUrl, hasBrokerSupport, listAvailableBrokerConnectors, BROKER_URL } from '../../mcp/oauth-registry.js';
+import { auth as mcpAuth } from '@modelcontextprotocol/sdk/client/auth.js';
+import { log } from '../../utils/log.js';
+function isOwner(req) {
+    const user = req.user;
+    if (!user)
+        return true; // API key / open mode
+    return isWorkspaceOwner(user.role);
+}
+/**
+ * Minimal HTML escape for string interpolation into static templates served
+ * by this route. Covers the five characters that can break out of element
+ * content or attribute context. Used for the OAuth claim success page which
+ * embeds the route's `:connector` path param — that param is supplied by
+ * the broker's redirect (instance can't fully control its content) and the
+ * route is served without auth, so an unescaped value is an XSS surface
+ * for any user who clicks a crafted broker callback URL.
+ */
+function htmlEscape(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/** Resolve OAuth credentials from connector config (user-provided). */
+function resolveOAuthCredentials(config) {
+    if (config.oauth?.client_id) {
+        return {
+            client_id: config.oauth.client_id,
+            client_secret: config.oauth.client_secret,
+        };
+    }
+    return undefined;
+}
+/** Probe an MCP server URL to detect if it requires OAuth. */
+async function probeOAuthSupport(url) {
+    try {
+        // Try the protected resource discovery endpoint first
+        const prUrl = new URL('/.well-known/oauth-protected-resource', new URL(url).origin);
+        const prRes = await fetch(prUrl.toString(), { signal: AbortSignal.timeout(5000) });
+        if (prRes.ok)
+            return true;
+        // Fall back to authorization server discovery
+        const asUrl = new URL('/.well-known/oauth-authorization-server', new URL(url).origin);
+        const asRes = await fetch(asUrl.toString(), { signal: AbortSignal.timeout(5000) });
+        if (asRes.ok)
+            return true;
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+function getServerUrl(req) {
+    const proto = req.headers['x-forwarded-proto'] || req.protocol || 'http';
+    const host = req.headers['x-forwarded-host'] || req.headers.host || req.hostname;
+    return `${proto}://${host}`;
+}
+export async function registerConnectorsApiRoutes(fastify, authService, workspacePath) {
+    // GET /api/connectors — list configured MCP connectors
+    //
+    // Returns the two connection states separately so the UI can render the
+    // correct affordances per connector:
+    //   - `workspaceConnected`: a shared `Authorization` header exists in
+    //     config — anyone (or no one — non-interactive callers) uses it.
+    //   - `userConnected`: the calling user has personally OAuth-bound this
+    //     connector — the agent will use their tokens when serving their
+    //     session (precedence: user OAuth wins over workspace header).
+    //
+    // Both flags can be true at once — the user's OAuth takes precedence at
+    // tool-call time, the workspace header serves non-interactive callers.
+    fastify.get('/api/connectors', async (req, _reply) => {
+        const user = req.user;
+        const configs = ConnectorManager.loadConfigs(workspacePath);
+        const connectors = configs.map(c => ({
+            name: c.name,
+            url: c.url,
+            description: c.description || '',
+            configured: true,
+            workspaceConnected: !!(c.headers?.['Authorization']),
+            userConnected: user ? authService.hasOAuthTokens(user.id, c.name) : false,
+            hasOAuth: !!resolveOAuthCredentials(c) || hasBrokerSupport(c.url) || c.requiresOAuth === true,
+        }));
+        // Curated catalog of broker-backed connectors that aren't yet
+        // configured in this workspace. The owner-only UI surfaces these
+        // as one-click "Add" tiles so an admin doesn't have to know the
+        // canonical URL. Filter out the ones already configured (by name
+        // OR display-name match) so the same connector isn't visible in
+        // both lists.
+        const configuredNames = new Set(configs.map(c => c.name));
+        const available = listAvailableBrokerConnectors(configuredNames);
+        return { success: true, connectors, available };
+    });
+    // POST /api/connectors/import — import connector(s) from JSON config block
+    fastify.post('/api/connectors/import', async (req, reply) => {
+        if (!isOwner(req))
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        const { json, name } = req.body;
+        if (!json)
+            return reply.status(400).send({ error: 'json is required' });
+        if (!name?.trim())
+            return reply.status(400).send({ error: 'name is required' });
+        try {
+            const configs = ConnectorManager.parseConfigBlock(json, name);
+            const created = [];
+            for (const config of configs) {
+                // Probe for OAuth support if no auth is configured
+                if (!config.headers?.['Authorization'] && !config.oauth) {
+                    config.requiresOAuth = await probeOAuthSupport(config.url);
+                }
+                ConnectorManager.saveConfig(config);
+                ConnectorManager.saveWorkspaceConfig(config, workspacePath);
+                created.push(config.name);
+            }
+            return { success: true, created };
+        }
+        catch (err) {
+            return reply.status(400).send({ error: err.message || 'Failed to parse config' });
+        }
+    });
+    // GET /api/connectors/:name/config — get connector config with masked secrets
+    fastify.get('/api/connectors/:name/config', async (req, reply) => {
+        if (!isOwner(req))
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        const config = ConnectorManager.loadConfig(req.params.name, workspacePath);
+        if (!config)
+            return { success: true, config: null };
+        const masked = { ...config };
+        if (masked.headers) {
+            masked.headers = { ...masked.headers };
+            for (const key of Object.keys(masked.headers)) {
+                if (key.toLowerCase() === 'authorization')
+                    masked.headers[key] = '••••••••';
+            }
+        }
+        if (masked.oauth?.client_secret) {
+            masked.oauth = { ...masked.oauth, client_secret: '••••••••' };
+        }
+        return { success: true, config: masked };
+    });
+    // POST /api/connectors/:name/config — create or update connector config
+    fastify.post('/api/connectors/:name/config', async (req, reply) => {
+        if (!isOwner(req))
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        const body = req.body;
+        if (!body?.url)
+            return reply.status(400).send({ error: 'url is required' });
+        const config = {
+            name: req.params.name,
+            url: body.url,
+            ...(body.headers ? { headers: body.headers } : {}),
+            ...(body.oauth ? { oauth: body.oauth } : {}),
+            description: body.description ?? req.params.name,
+        };
+        // Re-probe for OAuth support if no auth is configured
+        if (!config.headers?.['Authorization'] && !config.oauth) {
+            config.requiresOAuth = await probeOAuthSupport(config.url);
+        }
+        ConnectorManager.saveConfig(config);
+        ConnectorManager.saveWorkspaceConfig(config, workspacePath);
+        return { success: true, message: `Connector "${req.params.name}" configured` };
+    });
+    // DELETE /api/connectors/:name/config — remove connector config
+    fastify.delete('/api/connectors/:name/config', async (req, reply) => {
+        if (!isOwner(req))
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        const removed = ConnectorManager.removeConfig(req.params.name, workspacePath);
+        if (removed)
+            return { success: true, message: `Connector "${req.params.name}" removed` };
+        return reply.status(404).send({ success: false, error: `No config for "${req.params.name}"` });
+    });
+    // ── OAuth flow (MCP SDK auto-discovery) ──
+    // POST /api/connectors/:name/oauth/connect — initiate OAuth flow
+    fastify.post('/api/connectors/:name/oauth/connect', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { name } = req.params;
+        const config = ConnectorManager.loadConfig(name, workspacePath);
+        if (!config?.url)
+            return reply.status(400).send({ error: `Connector "${name}" not found or not an HTTP connector` });
+        const serverUrl = getServerUrl(req);
+        // Check if broker handles this connector (pre-registered OAuth app).
+        // HMAC-signed state so the broker's eventual /claim payload — which
+        // round-trips this exact `state` — proves the userId came from us.
+        const state = authService.signOAuthState({
+            connectorName: name,
+            userId: user.id,
+            origin: serverUrl,
+        });
+        const brokerUrl = getBrokerConnectUrl(config.url, state);
+        if (brokerUrl) {
+            // Broker handles OAuth — redirect the user there
+            return { success: true, authorizationUrl: brokerUrl };
+        }
+        // Construct the provider unconditionally. When the connector config has
+        // an explicit `oauth.client_id`, we use those credentials. Otherwise
+        // we hand the SDK a provider with no preRegistered creds and let it
+        // try Dynamic Client Registration (RFC 7591) — most modern MCP
+        // servers advertise a `registration_endpoint` in
+        // `.well-known/oauth-authorization-server` and the SDK + our
+        // McpOAuthProvider already implement the `clientInformation` /
+        // `saveClientInformation` hooks needed to persist the dynamically-
+        // assigned client id back into the user's `oauth_tokens` row.
+        //
+        // If the server supports neither pre-registered creds nor DCR, the
+        // SDK throws inside `mcpAuth` — surfaced below as a 500 with the
+        // SDK's error message intact.
+        const oauthCreds = resolveOAuthCredentials(config);
+        const provider = new McpOAuthProvider(name, user.id, authService, serverUrl, oauthCreds);
+        try {
+            const result = await mcpAuth(provider, { serverUrl: config.url });
+            if (result === 'AUTHORIZED') {
+                return { success: true, connected: true };
+            }
+            if (!provider.authorizationUrl) {
+                return reply.status(500).send({ error: 'OAuth flow did not produce an authorization URL' });
+            }
+            return { success: true, authorizationUrl: provider.authorizationUrl };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log.error(`[oauth] connect error for ${name}:`, msg);
+            // Detect the specific case where the server doesn't support DCR
+            // AND no client_id was supplied — that's a config problem the
+            // user can fix by editing the connector JSON, not an upstream
+            // outage. The SDK's error messages around this vary, so we
+            // pattern-match the common shapes (no registration endpoint,
+            // 400/404 on /register, missing client_id).
+            const looksLikeRegistrationGap = !oauthCreds &&
+                /registration|register|client_id|unauthorized_client/i.test(msg);
+            if (looksLikeRegistrationGap) {
+                return reply.status(400).send({
+                    error: `This server requires manual OAuth setup (it doesn't support automatic registration). ` +
+                        `Register an OAuth app with the provider, then edit the connector and add oauth.client_id and oauth.client_secret to the JSON config.`,
+                });
+            }
+            return reply.status(500).send({ error: `OAuth initialization failed: ${msg}` });
+        }
+    });
+    // GET /api/oauth/callback/:name — OAuth callback (browser redirect from provider)
+    // Public endpoint — user identity comes from the state parameter.
+    fastify.get('/api/oauth/callback/:name', async (req, reply) => {
+        const { name } = req.params;
+        const { code, state } = req.query;
+        if (!code) {
+            // Phase 11: don't echo `error_description` / `error` verbatim — log
+            // detail server-side, return a generic message to the browser.
+            const errDetail = req.query.error || 'missing authorization code';
+            log.warn(`[oauth] callback for ${name} without code: ${errDetail}`);
+            return reply.type('text/html').send(`<html><body><h2>Authorization failed</h2><p>The provider returned an authorization error. You can close this tab.</p></body></html>`);
+        }
+        // HMAC-verified — rejects forged, tampered, expired (>10min), or unsigned
+        // pre-launch states. Pre-launch breaking-change: any OAuth flows in
+        // flight at the time of this deploy will fail on callback; users restart.
+        const decoded = state ? authService.verifyOAuthState(state) : null;
+        if (!decoded) {
+            log.warn(`[oauth] callback for ${name} rejected: invalid or expired state`);
+            return reply.status(400).type('text/html').send('<html><body><h2>Authorization failed</h2><p>Invalid or expired authorization session. Please try connecting again.</p></body></html>');
+        }
+        // Cross-check the URL path against the signed connector binding — same
+        // defense-in-depth posture as the /claim handler. The signed state is
+        // already trusted for connector/userId attribution; rejecting a path
+        // mismatch removes the misleading "Connected to <name>" success UI when
+        // the path was forged independent of the signed binding.
+        if (decoded.connectorName !== name) {
+            log.warn(`[oauth] callback for ${name} rejected: state binds connector=${decoded.connectorName}, path mismatch`);
+            return reply.status(400).type('text/html').send('<html><body><h2>Authorization failed</h2><p>Connector mismatch. Please try connecting again.</p></body></html>');
+        }
+        const config = ConnectorManager.loadConfig(decoded.connectorName, workspacePath);
+        if (!config?.url) {
+            return reply.status(400).type('text/html').send(`<html><body><h2>Unknown connector</h2><p>"${decoded.connectorName}" not found.</p></body></html>`);
+        }
+        const serverUrl = getServerUrl(req);
+        const oauthCreds = resolveOAuthCredentials(config);
+        const provider = new McpOAuthProvider(decoded.connectorName, decoded.userId, authService, serverUrl, oauthCreds);
+        try {
+            await mcpAuth(provider, { serverUrl: config.url, authorizationCode: code });
+            return reply.type('text/html').send(`<html><body><h2>Connected to ${name}</h2><p>You can close this tab and return to Studiograph.</p></body></html>`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log.error(`[oauth] callback error for ${name}:`, msg);
+            // Phase 11: don't echo upstream error message verbatim.
+            return reply.type('text/html').send(`<html><body><h2>Authorization failed</h2><p>Could not complete the connection. Please try again.</p></body></html>`);
+        }
+    });
+    // GET /api/connectors/:name/oauth/status — poll for OAuth connection status
+    fastify.get('/api/connectors/:name/oauth/status', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const connected = authService.hasOAuthTokens(user.id, req.params.name);
+        return { connected };
+    });
+    // POST /api/connectors/:name/oauth/disconnect — clear OAuth tokens
+    fastify.post('/api/connectors/:name/oauth/disconnect', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        authService.clearOAuthData(user.id, req.params.name);
+        return { success: true };
+    });
+    // GET /api/oauth/claim/:connector — Receive tokens from the OAuth broker
+    // Browser is redirected here after the broker exchanges the code for tokens.
+    // Fetches tokens from the broker using the one-time claim code, stores them, redirects to settings.
+    fastify.get('/api/oauth/claim/:connector', async (req, reply) => {
+        const { connector } = req.params;
+        const claimCode = req.query.code;
+        // Escape the connector name before interpolating into the HTML success
+        // page below — the path param is user-influenced (whoever crafts the
+        // broker callback chooses it) and the response is served unauthed.
+        // Without this a connector name like `<script>...</script>` becomes XSS.
+        const connectorHtml = htmlEscape(connector);
+        if (!claimCode) {
+            return reply.type('text/html').send('<html><body><h2>Missing claim code</h2><p>No claim code provided.</p></body></html>');
+        }
+        try {
+            // Fetch tokens from the broker (server-to-server)
+            const claimRes = await fetch(`${BROKER_URL}/claim/${encodeURIComponent(claimCode)}`);
+            if (!claimRes.ok) {
+                return reply.type('text/html').send('<html><body><h2>Claim failed</h2><p>The claim code has expired or was already used. Please try connecting again.</p></body></html>');
+            }
+            const claim = await claimRes.json();
+            // Verify the broker round-tripped the original signed state. Without
+            // this, the instance would have to trust the broker's `userId` field
+            // verbatim — which means anyone who can hit /claim/:connector with a
+            // crafted claim code can attribute tokens to an arbitrary user. The
+            // signature pins {connector, userId, origin} to this instance's
+            // master key, so a forged or stale state can't pass verification.
+            if (!claim.state) {
+                log.warn(`[oauth] claim for ${connector} rejected: broker did not return state`);
+                return reply.type('text/html').send('<html><body><h2>Authorization failed</h2><p>The authorization broker did not return a valid session. Please try connecting again.</p></body></html>');
+            }
+            const verified = authService.verifyOAuthState(claim.state);
+            if (!verified) {
+                log.warn(`[oauth] claim for ${connector} rejected: state failed verification`);
+                return reply.type('text/html').send('<html><body><h2>Authorization failed</h2><p>Invalid or expired authorization session. Please try connecting again.</p></body></html>');
+            }
+            // Cross-check the URL path matches the signed connector binding —
+            // otherwise an attacker who obtains a valid signed state for one
+            // connector could redirect to /api/oauth/claim/<other> and bind the
+            // tokens to a different connector slot.
+            if (verified.connectorName !== connector) {
+                log.warn(`[oauth] claim for ${connector} rejected: state binds connector=${verified.connectorName}, path mismatch`);
+                return reply.type('text/html').send('<html><body><h2>Authorization failed</h2><p>Connector mismatch. Please try connecting again.</p></body></html>');
+            }
+            // Bind the tokens to the verified userId/connector from state — NOT
+            // the broker's untrusted `userId` field. Use the verified connector
+            // name as the storage key for the same reason.
+            const userId = verified.userId;
+            const verifiedConnector = verified.connectorName;
+            // Store tokens in auth.db
+            const data = authService.getOAuthData(userId, verifiedConnector) ?? {};
+            data.tokens = claim.tokens;
+            authService.saveOAuthData(userId, verifiedConnector, data);
+            // Don't redirect to /settings — the original tab is already there and
+            // its polling will pick up the new `userConnected: true` state within
+            // a couple seconds. Show a self-closing "all done" page in the new
+            // tab so the user isn't left staring at a duplicate Settings view.
+            // window.close() works because the tab was opened via window.open in
+            // handleOAuthConnect.
+            return reply.type('text/html').send(`<!doctype html><html><head><meta charset="utf-8"><title>Connected</title>
+<style>
+body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #fafafa; color: #1a1a1a; margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
+.card { text-align: center; padding: 2rem 3rem; }
+.check { font-size: 3rem; line-height: 1; margin-bottom: 0.5rem; color: #2a8f4a; }
+h2 { font-size: 1.25rem; font-weight: 500; margin: 0 0 0.5rem; }
+p { color: #666; margin: 0; font-size: 0.95rem; }
+@media (prefers-color-scheme: dark) {
+  body { background: #0d0d0d; color: #f0f0f0; }
+  p { color: #999; }
+}
+</style></head>
+<body><div class="card">
+<div class="check">✓</div>
+<h2>Connected to ${connectorHtml}</h2>
+<p>You can close this tab.</p>
+</div>
+<script>setTimeout(function(){ try { window.close(); } catch (e) {} }, 1200);</script>
+</body></html>`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log.error(`[oauth] claim error for ${connector}:`, msg);
+            // Phase 11: don't echo upstream/internal error message verbatim.
+            return reply.type('text/html').send(`<html><body><h2>Connection failed</h2><p>Could not retrieve the connection token. Please try again.</p></body></html>`);
+        }
+    });
+}
+//# sourceMappingURL=connectors-api.js.map

package/dist/server/routes/connectors-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectors-api.js","sourceRoot":"","sources":["../../../src/server/routes/connectors-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAmC,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAwB,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC/H,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,SAAS,OAAO,CAAC,GAAmB;IAClC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IAC9C,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,uEAAuE;AACvE,SAAS,uBAAuB,CAAC,MAAuB;IACtD,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;SAC1C,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,sDAAsD;QACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,uCAAuC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE1B,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,yCAAyC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE1B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB;IACvC,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAY,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;IACrF,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAK,GAAG,CAAC,OAAO,CAAC,IAAe,IAAI,GAAG,CAAC,QAAQ,CAAC;IACzG,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAwB,EACxB,WAAwB,EACxB,aAAqB;IAGrB,uDAAuD;IACvD,EAAE;IACF,wEAAwE;IACxE,qCAAqC;IACrC,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAChC,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;YACpD,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;YACzE,QAAQ,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;SAC9F,CAAC,CAAC,CAAC;QACJ,8DAA8D;QAC9D,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,cAAc;QACd,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,6BAA6B,CAAC,eAAe,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC/F,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAwC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,mDAAmD;gBACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACxD,MAAM,CAAC,aAAa,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,CAAC;gBACD,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACpC,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,wBAAwB,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,OAAO,CAAC,GAAG,CAA+B,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe;oBAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,OAAO,CAAC,IAAI,CAA+B,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,GAAG,CAAC,IAA8B,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,GAAG;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAoB;YAC9B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI;SACjD,CAAC;QACF,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACxD,MAAM,CAAC,aAAa,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,OAAO,CAAC,MAAM,CAA+B,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9E,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAE5C,iEAAiE;IACjE,OAAO,CAAC,IAAI,CAA+B,qCAAqC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACrG,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAE/E,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,GAAG;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,IAAI,sCAAsC,EAAE,CAAC,CAAC;QAErH,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEpC,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC;YACvC,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEzD,IAAI,SAAS,EAAE,CAAC;YACd,iDAAiD;YACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;QACxD,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,+DAA+D;QAC/D,iDAAiD;QACjD,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,8DAA8D;QAC9D,EAAE;QACF,mEAAmE;QACnE,iEAAiE;QACjE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,gEAAgE;YAChE,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,4CAA4C;YAC5C,MAAM,wBAAwB,GAC5B,CAAC,UAAU;gBACX,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EACH,uFAAuF;wBACvF,sIAAsI;iBACzI,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,kEAAkE;IAClE,OAAO,CAAC,GAAG,CAA+B,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1F,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAA0C,CAAC;QAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,SAAS,GAAI,GAAG,CAAC,KAAa,CAAC,KAAK,IAAI,4BAA4B,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,kBAAkB,SAAS,EAAE,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,qIAAqI,CACtI,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,qCAAqC,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAC7C,sIAAsI,CACvI,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CACN,wBAAwB,IAAI,oCAAoC,OAAO,CAAC,aAAa,iBAAiB,CACvG,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAC7C,gHAAgH,CACjH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAC7C,6CAA6C,OAAO,CAAC,aAAa,gCAAgC,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAEjH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,gCAAgC,IAAI,6EAA6E,CAClH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,8BAA8B,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;YACtD,wDAAwD;YACxD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,oHAAoH,CACrH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,OAAO,CAAC,GAAG,CAA+B,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnG,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,OAAO,CAAC,IAAI,CAA+B,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxG,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,6EAA6E;IAC7E,oGAAoG;IACpG,OAAO,CAAC,GAAG,CAAoC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACjG,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,SAAS,GAAI,GAAG,CAAC,KAAa,CAAC,IAAI,CAAC;QAC1C,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,kDAAkD;YAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,UAAU,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,oIAAoI,CACrI,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAMhC,CAAC;YAEF,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,qBAAqB,SAAS,wCAAwC,CAAC,CAAC;gBACjF,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,qJAAqJ,CACtJ,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,qBAAqB,SAAS,sCAAsC,CAAC,CAAC;gBAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,sIAAsI,CACvI,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,iEAAiE;YACjE,oEAAoE;YACpE,wCAAwC;YACxC,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CACN,qBAAqB,SAAS,oCAAoC,QAAQ,CAAC,aAAa,iBAAiB,CAC1G,CAAC;gBACF,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,gHAAgH,CACjH,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,MAAM,iBAAiB,GAAG,QAAQ,CAAC,aAAa,CAAC;YAEjD,0BAA0B;YAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACvE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3B,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAE3D,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,qEAAqE;YACrE,sBAAsB;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC;;;;;;;;;;;;;;mBAcW,aAAa;;;;eAIjB,CACR,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACxD,iEAAiE;YACjE,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACjC,uHAAuH,CACxH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/event-ingest-api.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Event Ingest API — meeting capture adapter
+ *
+ * POST /api/repos/:repo/events/ingest
+ * GET  /api/repos/:repo/events/ingest/:entityId/extraction
+ *
+ * Thin route that accepts desktop or external meeting payloads and delegates
+ * to the source-agnostic EventProcessor.
+ */
+import type { FastifyInstance } from 'fastify';
+import { WorkspaceManager } from '../../core/workspace-manager.js';
+import { AuthService } from '../../services/auth-service.js';
+import type { WsHub } from '../ws-hub.js';
+import type { YjsManager } from '../yjs-manager.js';
+export declare function registerEventIngestRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, wsHub: WsHub | undefined, yjsManager?: YjsManager): Promise<void>;

package/dist/server/routes/event-ingest-api.js

@@ -0,0 +1,125 @@
+/**
+ * Event Ingest API — meeting capture adapter
+ *
+ * POST /api/repos/:repo/events/ingest
+ * GET  /api/repos/:repo/events/ingest/:entityId/extraction
+ *
+ * Thin route that accepts desktop or external meeting payloads and delegates
+ * to the source-agnostic EventProcessor.
+ */
+import * as access from '../../services/access-control.js';
+import { EventProcessor } from '../../services/event-processor.js';
+// ── Adapter: transform event payload → common MeetingPayload ──────────
+function toMeetingPayload(body) {
+    return {
+        sourceId: body.meetingId,
+        source: body.source || 'desktop-client',
+        title: body.title,
+        startedAt: body.startedAt,
+        endedAt: body.endedAt,
+        durationMinutes: body.durationMinutes,
+        participants: body.participants.map(p => ({
+            name: p.name,
+            email: p.email,
+            isSelf: p.isSelf,
+        })),
+        transcript: body.transcript.map(s => ({
+            speaker: s.speaker,
+            text: s.text,
+            timestamp: s.timestamp,
+            isFinal: s.isFinal,
+            channel: s.channel,
+        })),
+        memo: body.memo || undefined,
+        platform: body.platform,
+        meetingUrl: body.meetingUrl,
+    };
+}
+function reqGitUser(req) {
+    const user = req.user;
+    if (!user)
+        return undefined;
+    // Use email as id (see graph-api.ts reqGitUser for rationale).
+    return { id: user.email, name: user.displayName, email: user.email };
+}
+// ── Route Registration ────────────────────────────────────────────────
+export async function registerEventIngestRoutes(fastify, workspaceManager, authService, wsHub, yjsManager) {
+    const processor = new EventProcessor(workspaceManager, wsHub, yjsManager);
+    const handlePost = async (req, reply) => {
+        const { repo } = req.params;
+        const body = req.body;
+        // Access gate: ingest writes to disk + invokes LLM, both as the
+        // calling user. Without this, any authenticated user could inject
+        // meetings into a folder they don't have access to.
+        const user = req.user;
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        try {
+            workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Transcript required unless updating an existing entity (desktop app flow)
+        if (!body.existingEntityId && (!body.transcript || body.transcript.length === 0)) {
+            return reply.status(400).send({ error: 'transcript is required and must not be empty' });
+        }
+        try {
+            const payload = toMeetingPayload(body);
+            if (body.existingEntityId) {
+                // Meeting capture UI: entity already created by the web app.
+                // Update it with transcript and run LLM processing.
+                const result = await processor.processExisting(payload, repo, body.existingEntityId, reqGitUser(req));
+                return reply.status(200).send({
+                    entityId: result.entityId,
+                    url: result.url,
+                    linkedPeople: result.attendeeLinks,
+                    extractionPending: result.extractionPending,
+                });
+            }
+            const result = await processor.process(payload, repo, reqGitUser(req));
+            return reply.status(201).send({
+                entityId: result.entityId,
+                url: result.url,
+                linkedPeople: result.attendeeLinks,
+                extractionPending: result.extractionPending,
+            });
+        }
+        catch (err) {
+            if (err.message?.includes('already exists')) {
+                return reply.status(409).send({ error: err.message });
+            }
+            return reply.status(400).send({ error: err.message });
+        }
+    };
+    const handleGetExtraction = async (req, reply) => {
+        const { repo, entityId } = req.params;
+        const user = req.user;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        try {
+            const graph = workspaceManager.getGraph(repo);
+            const entity = graph.get('event', entityId);
+            const d = entity.data;
+            const content = entity.document?.content || '';
+            const ready = d?.processing !== true;
+            return reply.send({
+                entityId,
+                ready,
+                summary: ready ? content.split('\n---\n')[0]?.trim() : null,
+                actionItems: Array.isArray(d?.action_items) ? d.action_items : [],
+                decisions: [],
+            });
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+    };
+    // POST — ingest an event (currently only meeting recordings).
+    fastify.post('/api/repos/:repo/events/ingest', handlePost);
+    // GET — poll for summary completion.
+    fastify.get('/api/repos/:repo/events/ingest/:entityId/extraction', handleGetExtraction);
+}
+//# sourceMappingURL=event-ingest-api.js.map

package/dist/server/routes/event-ingest-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-ingest-api.js","sourceRoot":"","sources":["../../../src/server/routes/event-ingest-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,MAAM,MAAM,kCAAkC,CAAC;AAK3D,OAAO,EAAE,cAAc,EAA+C,MAAM,mCAAmC,CAAC;AAkChH,yEAAyE;AAEzE,SAAS,gBAAgB,CAAC,IAAqB;IAC7C,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gBAAgB;QACvC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;QACH,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAmB;IACrC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,yEAAyE;AAEzE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,KAAwB,EACxB,UAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAE1E,MAAM,UAAU,GAAG,KAAK,EAAE,GAAwE,EAAE,KAAU,EAAE,EAAE;QAC9G,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,gEAAgE;QAChE,kEAAkE;QAClE,oDAAoD;QACpD,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC;YACH,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEvC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,6DAA6D;gBAC7D,oDAAoD;gBACpD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,CAAC,CACtD,CAAC;gBACF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,YAAY,EAAE,MAAM,CAAC,aAAa;oBAClC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC5C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAEvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,KAAK,EAC/B,GAAmE,EACnE,KAAU,EACV,EAAE;QACA,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEtC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAqB,EAAE,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,GAAG,MAAM,CAAC,IAA2B,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;YAErC,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,QAAQ;gBACR,KAAK;gBACL,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC3D,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;gBACjE,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACL,CAAC,CAAC;IAEF,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CACV,gCAAgC,EAAE,UAAU,CAC7C,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,qDAAqD,EAAE,mBAAmB,CAC3E,CAAC;AACJ,CAAC"}

package/dist/server/routes/git-http.d.ts

@@ -12,12 +12,12 @@
  *
  * Access rules:
  *   - No users configured (open mode) → full access
- *   - Admin → all collections
- *   - Member → only granted collections
+ *   - Admin → all folders
+ *   - Member → only granted folders
  *   - Private repos → owner only
  */
 import type { FastifyInstance } from 'fastify';
 import type { WsHub } from '../ws-hub.js';
 import type { WorkspaceManager } from '../../core/workspace-manager.js';
-import type { AuthService } from '../../services/auth-service.js';
+import { type AuthService } from '../../services/auth-service.js';
 export declare function registerGitHttpRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, workspacePath: string, wsHub?: WsHub): Promise<void>;