@customaise/mcp - npm Package Compare versions

Comparing version 1.1.1 to 1.2.0

CHANGELOG.md

+# Changelog
+
+All notable changes to `@customaise/mcp` will be documented in this file.
+
+## [1.2.0] - 2026-04-19
+
+### Added
+- **WebMCP agent tools** (2 tools): `list_webmcp_tools` and `call_webmcp_tool`. AgentScripts can now register tools on web pages via `navigator.modelContext.registerTool(...)`, callable from your IDE through the MCP bridge.
+- **Tab control** (3 tools): `open_tab`, `close_tab`, `focus_tab`. Tool count is now **18** (was 13).
+- **AgentScript conventions resource**: `customaise://agentscript-conventions` with the full reference for declaring and registering WebMCP tools.
+- `CHANGELOG.md` and `LICENSE` now ship in the tarball.
+
+### Changed (behavior MCP clients should know about)
+- **`call_webmcp_tool` can block for up to 5 minutes** when the tool is declared with the `prompt` permission in the AgentScript `@webmcp` header. The Customaise extension surfaces an in-browser consent modal, and the tool body only runs if the user approves. Previously, tool calls were fire-and-forget; this is a **user-visible latency change** for any client that invokes prompt-gated tools. Surface a pending state to the end user rather than timing out aggressively.
+- **"Always allow / Always deny"** persists per-script per-tool on the user's device, so subsequent identical calls may run without showing a modal. Transparent to the MCP client.
+- **Remote HITL approvals (optional, user opt-in)**: if the user has Power User and has enabled Remote HITL Approvals on their account page, prompt-gated calls are also mirrored there. No MCP-client-side change; the tool simply returns whenever any authorised surface resolves.
+- **Server-reported version now tracks `package.json`.** Previously the MCP handshake hardcoded `1.0.3` and drifted silently. The number IDE clients see is now the same as the published version.
+- **`prompts` capability removed from the initialize handshake.** The server never registered any prompts, so advertising `prompts: {}` led clients to list an empty collection. If prompts ship later they will be added back alongside `server.prompt(...)` registrations.
+
+### Security
+- **WebSocket bridge enforces an Origin allowlist.** Only connections from Chrome extension service workers with the known Customaise extension IDs are accepted. A malicious webpage can no longer open `new WebSocket('ws://localhost:4050')` and issue tool calls behind the user's back. See the README "Security Boundary" section for the threat model and the `CUSTOMAISE_MCP_EXTRA_EXTENSION_IDS` / `CUSTOMAISE_MCP_ALLOW_INSECURE` env vars for dev and test flexibility.
+- **Tool-call arguments are KMS-encrypted at rest** in Firestore when remote approvals are enabled. Metadata (toolName, scriptName, origin, timestamps) stays plaintext, matching the sensitivity tier of billing records. Arguments transit HTTPS in plaintext to the backend, then encrypt before persistence.
+- No MCP client-side secrets, cookies, or session tokens cross the bridge. Tool calls run inside the user's browser session; the MCP server only initiates them.
+
+## [1.1.1] - 2026-03-29
+
+### Fixed
+- Documented `CUSTOMAISE_WORKSPACE` for IDEs that don't set cwd to the project root (Claude Desktop, Antigravity).
+- Clarified where `.customaise/dom-context/` files are saved in the README.
+
+## [1.1.0] - 2026-03-29
+
+### Added
+- **Visual DOM Targeting** (1 tool): `get_selected_elements` retrieves user-selected DOM elements with bulletproof tiered selectors and cropped screenshots.
+- **Real-time DOM context push**: when MCP is connected, `.dom.md` files and element screenshots are pushed to the workspace as the user selects elements in the browser.
+- **Screenshot element highlighting**: `take_screenshot` now supports optional high-contrast red element highlighting for visual debugging.
+
+### Fixed
+- **Screenshot reliability**: hardened the capture pipeline with a defensive retry mechanism and pre-injection of content scripts to eliminate race conditions.
+- **Message queueing**: MCP commands are queued via the onboarding queue if the React UI hasn't finished initializing, preventing silently dropped messages on fresh tabs.
+
+### Changed
+- Added Kiro to the supported IDE list in description and README.
+- Added `kiro` and `antigravity` npm keywords for discoverability.
+- Updated tool count from 12 to 13 in README.
+
+## [1.0.1] - 2026-03-23
+
+### Fixed
+- Corrected repository URL in package metadata.
+
+## [1.0.0] - 2026-03-23
+
+### Added
+- **Script Lifecycle** (5 tools): `list_scripts`, `import_script`, `export_script`, `delete_script`, `toggle_script`.
+- **Browser Context** (3 tools): `get_page_context`, `get_console_context`, `list_tabs`.
+- **Testing & Verification** (2 tools): `reload_tab`, `take_screenshot`.
+- **UI Control** (1 tool): `toggle_ui`.
+- **Batch Operations** (1 tool): `sync_scripts` with `.customaise-manifest.json` mapping.
+- **File Watcher**: auto-exports `.user.js` files on save with a 500ms debounce.
+- **MCP Resources**: `customaise://scripts`, `customaise://scripts/{id}`, `customaise://conventions`.
+- **Rich validation feedback**: structured diagnostics from the Customaise sanitization pipeline.
+- **Cross-platform `take_screenshot`**: uses `os.tmpdir()` for auto-generated paths.
+- **Console log filtering**: client-side `level` parameter for `get_console_context`.
+- **Filename collision handling**: deduplication in `sync_scripts` bulk export.

LICENSE

+MIT License
+
+Copyright (c) 2026 CNDLE Studio LTD
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

dist/extension-bridge.d.ts

@@ -18,2 +18,4 @@ /**
     private pushHandler;
+    private allowedOrigins;
+    private allowInsecure;
     constructor(port?: number, requestTimeoutMs?: number);
@@ -44,2 +46,12 @@ /**
      * Handle an incoming response from the extension, matching it to a pending request.
+     *
+     * Recognises three frame shapes:
+     *  1. Final response — `{ id, success, result|error }` — resolves/rejects + clears.
+     *  2. Interim "pending" — `{ id, kind: 'pending', expectedTimeoutMs }` — resets
+     *     the request's timer to the larger value WITHOUT resolving. Used when the
+     *     extension is about to block on a HITL consent modal: we don't want to
+     *     surface a 30-s "timed out" error to the AI client while the user is
+     *     still deciding.
+     *  3. Unprompted push — `{ type, data }` with no matching id — forwarded to
+     *     the registered push handler (e.g. status broadcasts).
      */
@@ -46,0 +58,0 @@ private _handleResponse;

dist/extension-bridge.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"extension-bridge.d.ts","sourceRoot":"","sources":["../src/extension-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA0BH,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,eAAe,CAA0B;IACjD,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAoD;gBAE3D,IAAI,SAAO,EAAE,gBAAgB,SAAS;IAKlD;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8CtB;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBjF;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAIxD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB5B;;OAEG;IACH,OAAO,CAAC,eAAe;IAsBvB;;OAEG;IACH,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"extension-bridge.d.ts","sourceRoot":"","sources":["../src/extension-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA+CH,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,eAAe,CAA0B;IACjD,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAoD;IACvE,OAAO,CAAC,cAAc,CAAc;IACpC,OAAO,CAAC,aAAa,CAAU;gBAEnB,IAAI,SAAO,EAAE,gBAAgB,SAAS;IAqBlD;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgEtB;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBjF;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAIxD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAyCvB;;OAEG;IACH,OAAO,CAAC,IAAI;CAGb"}

dist/extension-bridge.js

@@ -13,2 +13,22 @@ /**
 import { randomUUID } from 'node:crypto';
+/**
+ * Extension IDs permitted to connect to the bridge.
+ *
+ * Threat model: any process (browser tab, native daemon) that can reach
+ * ws://localhost:4050 can list and call WebMCP tools. The most likely
+ * abuse vector is a malicious webpage opening `new WebSocket('ws://localhost:4050')`
+ * and calling `allow`-permissioned tools. We check the WebSocket handshake's
+ * `Origin` header against this allowlist.
+ *
+ * Chrome sends `Origin: chrome-extension://<id>` on handshakes from
+ * extension service workers. Regular webpages send their real origin,
+ * which doesn't start with `chrome-extension://` — so this rejects them.
+ * A malicious native process can still forge the header (Node's `ws`
+ * client accepts an `origin` option); origin-check doesn't stop a
+ * same-user local attacker. That residual risk is documented.
+ */
+const DEFAULT_EXTENSION_IDS = [
+    'anmpijcpaobaabcdncjjmnhdeibipmko', // production
+    'ijjaffggglamocdapoihpkcpealflopp', // staging
+];
 export class ExtensionBridge {
@@ -21,5 +41,21 @@ wss = null;
     pushHandler = null;
+    allowedOrigins;
+    allowInsecure;
     constructor(port = 4050, requestTimeoutMs = 30_000) {
         this.port = port;
         this.requestTimeoutMs = requestTimeoutMs;
+        // Build the origin allowlist. Defaults cover the Web Store + staging
+        // extensions. Users loading an unpacked dev build with a different ID
+        // can add it via CUSTOMAISE_MCP_EXTRA_EXTENSION_IDS (comma-separated).
+        const extraIds = (process.env.CUSTOMAISE_MCP_EXTRA_EXTENSION_IDS || '')
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
+        const allIds = [...DEFAULT_EXTENSION_IDS, ...extraIds];
+        this.allowedOrigins = new Set(allIds.map((id) => `chrome-extension://${id}`));
+        // Escape hatch for tests and any non-browser MCP-bridge clients that
+        // need to connect without forging a chrome-extension:// origin. Must
+        // be set explicitly; logged loudly on startup so nobody enables it
+        // by accident in a deployed install.
+        this.allowInsecure = process.env.CUSTOMAISE_MCP_ALLOW_INSECURE === '1';
     }
@@ -31,4 +67,22 @@ /**
         return new Promise((resolve, reject) => {
-            this.wss = new WebSocketServer({ port: this.port }, () => {
+            this.wss = new WebSocketServer({
+                port: this.port,
+                verifyClient: (info, done) => {
+                    const origin = info.origin || info.req.headers.origin || '';
+                    if (this.allowInsecure) {
+                        done(true);
+                        return;
+                    }
+                    if (this.allowedOrigins.has(origin)) {
+                        done(true);
+                        return;
+                    }
+                    this._log(`Rejected WS handshake from origin="${origin}" (not in allowlist)`);
+                    done(false, 403, 'Forbidden: origin not allowed');
+                },
+            }, () => {
                 this._log(`WebSocket server listening on ws://localhost:${this.port}`);
+                if (this.allowInsecure) {
+                    this._log('WARNING: CUSTOMAISE_MCP_ALLOW_INSECURE=1 is set. Origin check DISABLED. Any local process can connect.');
+                }
                 resolve();
@@ -129,5 +183,26 @@ });
      * Handle an incoming response from the extension, matching it to a pending request.
+     *
+     * Recognises three frame shapes:
+     *  1. Final response — `{ id, success, result|error }` — resolves/rejects + clears.
+     *  2. Interim "pending" — `{ id, kind: 'pending', expectedTimeoutMs }` — resets
+     *     the request's timer to the larger value WITHOUT resolving. Used when the
+     *     extension is about to block on a HITL consent modal: we don't want to
+     *     surface a 30-s "timed out" error to the AI client while the user is
+     *     still deciding.
+     *  3. Unprompted push — `{ type, data }` with no matching id — forwarded to
+     *     the registered push handler (e.g. status broadcasts).
      */
     _handleResponse(message) {
-        const pending = this.pending.get(message.id);
+        const pending = message.id ? this.pending.get(message.id) : undefined;
+        // Interim "pending" frame — extend the deadline, do NOT resolve.
+        if (pending && message.kind === 'pending') {
+            const extendMs = Math.max(Number(message.expectedTimeoutMs) || 0, this.requestTimeoutMs);
+            clearTimeout(pending.timer);
+            pending.timer = setTimeout(() => {
+                this.pending.delete(message.id);
+                pending.reject(new Error(`Request to extension timed out after ${extendMs}ms (type=consent-pending, id=${message.id})`));
+            }, extendMs);
+            this._log(`Request ${message.id} extended to ${extendMs}ms (reason: ${message.reason || 'unspecified'})`);
+            return;
+        }
         if (!pending) {
@@ -145,7 +220,8 @@ // Check if this is a push message from the extension
         clearTimeout(pending.timer);
-        if (message.success) {
-            pending.resolve(message.result);
+        const finalMessage = message;
+        if (finalMessage.success) {
+            pending.resolve(finalMessage.result);
         }
         else {
-            pending.reject(new Error(message.error || 'Extension returned an error'));
+            pending.reject(new Error(finalMessage.error || 'Extension returned an error'));
         }
@@ -152,0 +228,0 @@ }

dist/extension-bridge.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"extension-bridge.js","sourceRoot":"","sources":["../src/extension-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuBzC,MAAM,OAAO,eAAe;IAClB,GAAG,GAA2B,IAAI,CAAC;IACnC,eAAe,GAAqB,IAAI,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,IAAI,CAAS;IACb,gBAAgB,CAAS;IACzB,WAAW,GAA+C,IAAI,CAAC;IAEvE,YAAY,IAAI,GAAG,IAAI,EAAE,gBAAgB,GAAG,MAAM;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;gBACvD,IAAI,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC/B,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAExC,6DAA6D;gBAC7D,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;oBACrD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;gBAE1B,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;oBACxB,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAmB,CAAC;wBAC9D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,IAAI,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;oBAC9B,IAAI,CAAC,IAAI,CAAC,uCAAuC,IAAI,YAAY,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBACvF,IAAI,IAAI,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;wBAChC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;oBAC9B,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgC,EAAE;QAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QAExB,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,gBAAgB,YAAY,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAChH,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAE1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjD,MAAM,OAAO,GAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,eAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAA0C;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;YAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBAClB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;oBAChB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAuB;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,qDAAqD;YACrD,IAAK,OAAe,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9C,IAAI,CAAC,WAAW,CAAE,OAAe,CAAC,IAAI,EAAG,OAAe,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,OAAe;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;IACxD,CAAC;CACF"}
+{"version":3,"file":"extension-bridge.js","sourceRoot":"","sources":["../src/extension-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,qBAAqB,GAAG;IAC5B,kCAAkC,EAAE,aAAa;IACjD,kCAAkC,EAAE,UAAU;CAC/C,CAAC;AAuBF,MAAM,OAAO,eAAe;IAClB,GAAG,GAA2B,IAAI,CAAC;IACnC,eAAe,GAAqB,IAAI,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,IAAI,CAAS;IACb,gBAAgB,CAAS;IACzB,WAAW,GAA+C,IAAI,CAAC;IAC/D,cAAc,CAAc;IAC5B,aAAa,CAAU;IAE/B,YAAY,IAAI,GAAG,IAAI,EAAE,gBAAgB,GAAG,MAAM;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAEzC,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,EAAE,CAAC;aACpE,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;QAE9E,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,qCAAqC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,GAAG,GAAG,IAAI,eAAe,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;oBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;oBAC5D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,IAAI,CAAC,CAAC;wBACX,OAAO;oBACT,CAAC;oBACD,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpC,IAAI,CAAC,IAAI,CAAC,CAAC;wBACX,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,sCAAsC,MAAM,sBAAsB,CAAC,CAAC;oBAC9E,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;gBACpD,CAAC;aACF,EAAE,GAAG,EAAE;gBACN,IAAI,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACvB,IAAI,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;gBACtH,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC/B,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAExC,6DAA6D;gBAC7D,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;oBACrD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;gBAE1B,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;oBACxB,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAmB,CAAC;wBAC9D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,IAAI,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;oBAC9B,IAAI,CAAC,IAAI,CAAC,uCAAuC,IAAI,YAAY,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBACvF,IAAI,IAAI,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;wBAChC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;oBAC9B,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgC,EAAE;QAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QAExB,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,gBAAgB,YAAY,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAChH,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAE1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjD,MAAM,OAAO,GAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,eAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAA0C;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;YAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBAClB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;oBAChB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,eAAe,CAAC,OAA+G;QACrI,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,iEAAiE;QACjE,IAAI,OAAO,IAAK,OAAe,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,MAAM,CAAE,OAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAC/C,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACF,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAG,CAAC,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CACtB,wCAAwC,QAAQ,gCAAgC,OAAO,CAAC,EAAE,GAAG,CAC9F,CAAC,CAAC;YACL,CAAC,EAAE,QAAQ,CAAC,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,EAAE,gBAAgB,QAAQ,eAAgB,OAAe,CAAC,MAAM,IAAI,aAAa,GAAG,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,qDAAqD;YACrD,IAAK,OAAe,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9C,IAAI,CAAC,WAAW,CAAE,OAAe,CAAC,IAAI,EAAG,OAAe,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAG,CAAC,CAAC;QACjC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE5B,MAAM,YAAY,GAAG,OAAyB,CAAC;QAC/C,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,OAAe;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;IACxD,CAAC;CACF"}

dist/index.js

@@ -17,2 +17,5 @@ #!/usr/bin/env node
  */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -23,2 +26,12 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { FileWatcher } from './file-watcher.js';
+// Single source of truth for the server version: the package.json this
+// file was shipped alongside. Compiled `dist/index.js` resolves
+// `../package.json` relative to itself, which always lands on the
+// package root (npm always ships package.json). Prevents the version
+// drift bug where index.ts hardcoded `1.0.3` while package.json was 1.2.0.
+const PKG_VERSION = (() => {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkgPath = join(here, '..', 'package.json');
+    return JSON.parse(readFileSync(pkgPath, 'utf-8')).version;
+})();
 // ─── Server Instructions ─────────────────────────────────────────────────────
@@ -30,90 +43,30 @@ // Sent to AI agents during the MCP initialize handshake.
 # Role
-- You are a Script Engineer working with Customaise, a Chrome extension that manages userscripts.
-- You create, edit, and debug userscripts that run on web pages matching specified URL patterns.
-- Customaise uses **symbol-level editing** (function-by-function), so script architecture matters more than in typical userscript managers.
+- You are a Script Engineer working with Customaise, a Chrome extension that manages userscripts and WebMCP agents.
+- You create, edit, and debug scripts that run securely within the user's browser sandbox.
 
-# Mission
-- Build resilient, maintainable userscripts that are fully compatible with Customaise's symbol-level editing engine.
-- Every script you produce must be immediately editable at the function level—no monolithic code, no anonymous closures, no inline logic.
+# Script Types
+Customaise supports two distinct paradigms. Your structural formatting depends entirely on what the user is asking for.
+**CRITICAL:** You must read the specific conventions handbook before building either type.
+1. **UserScripts** (Traditional DOM manipulation): Read \`customaise://userscript-conventions\`
+2. **AgentScripts** (WebMCP tool injection): Read \`customaise://agentscript-conventions\`
 
-# Foundations
-- **Symbol-Driven Architecture (CRITICAL):** Every userscript MUST be wrapped in an IIFE containing explicit, named top-level functions. Each distinct behavior must be its own named function. Customaise's editing engine indexes these symbols and allows users to modify them individually.
-- **Correct structure (complete example):**
-\`\`\`js
-// ==UserScript==
-// @name        My Script
-// @namespace   https://customaise.com
-// @description Enhances the page
-// @match       https://example.com/*
-// @version     1.0
-// @grant       GM_log
-// @grant       GM_addStyle
-// @run-at      document-idle
-// ==/UserScript==
+# General Workflow
+1. **Understand:** Use \`get_page_context\` to inspect the target page's DOM, visible elements, and \`dom_*\` IDs.
+2. **Write:** Create the script in the workspace directory (e.g., \`./customaise-scripts/\`). Never use \`/tmp\`.
+3. **Install:** Use \`export_script\` to push the script into Customaise. It validates through a strict sanitization pipeline.
+4. **Test:** Use \`reload_tab\` to re-inject the updated script on the target page.
+5. **Verify:** Use \`get_console_context\` to check for runtime errors, or use \`list_webmcp_tools\` to confirm agent availability.
+6. **Iterate:** If the pipeline returns validation errors or the console shows runtime errors, fix the file locally and re-export.
 
-(function() {
-  'use strict';
-  function init() { GM_log('Script loaded'); applyStyles(); }
-  function applyStyles() { GM_addStyle(\`body { background: #111; }\`); }
-  init();
-})();
-\`\`\`
-- **Incorrect structure (breaks symbol editing):**
-\`\`\`js
-(function() {
-  document.querySelector('.ad').remove();
-  document.body.style.background = '#000';
-})();
-\`\`\`
-- **Metadata:** Always include a complete metadata block with \`@name\`, \`@namespace\`, \`@match\`, \`@description\`, \`@version\`, and \`@grant\` directives. Use \`// @namespace https://customaise.com\` as the namespace.
-- **Runtime Environment:** Scripts execute inside the browser sandbox. Do not use Node.js globals (\`process\`, \`require\`, \`module.exports\`, \`__dirname\`). Use GM_* APIs for cross-origin requests, storage, and notifications.
-- **Deterministic Entry Point:** Declare an \`async function main()\` (or \`init()\`) and invoke it once at the bottom. Keep the entry point minimal—delegate to named helper functions.
-- **Observability:** Always emit \`GM_log\` breadcrumbs so the user can trace script behavior via Customaise's console. Use \`GM_info.script.name\` to namespace log messages.
-
-# Workflow
-1. **Understand the page:** Use \`get_page_context\` to inspect the target page's DOM structure, visible elements, and \`dom_*\` IDs.
-2. **Write the script:** Create a \`.user.js\` file in the workspace directory (e.g., \`./customaise-scripts/\`). Never use \`/tmp\` or temporary directories.
-3. **Install:** Use \`export_script\` to push the script into Customaise. It validates through a sanitization pipeline (syntax checking, AST validation, security analysis) and returns diagnostics if anything fails.
-4. **Test:** Use \`reload_tab\` to re-inject the updated script, then \`get_console_context\` to check for errors or \`GM_log\` output.
-5. **Iterate:** If there are issues, fix the file and re-export. The validation pipeline will catch structural problems.
-
-# Tooling
-- **VM_findElement (Bulletproof DOM Targeting):** Customaise provides \`VM_findElement\`—a multi-tier selector API that survives UI redesigns and dynamic class changes. Declare \`@grant VM_findElement\`, then call \`await VM_findElement('dom_xxx')\` with a \`dom_*\` ID from \`get_page_context\`. Never invent \`dom_*\` IDs. For cross-origin iframes, use \`VM_findExternalElement\` with \`@connect\` for the iframe domain.
-- **GM_* APIs:** Customaise supports 22 GM_* APIs (storage, networking, UI, clipboard, tabs). Use either \`GM_*\` (underscore) or \`GM.*\` (promise-based) syntax. Key APIs:
-  - \`GM_log(msg)\` — Log to Customaise console (visible via \`get_console_context\`)
-  - \`GM_addStyle(css)\` — Inject CSS into the page
-  - \`GM_xmlhttpRequest(details)\` — Cross-origin HTTP requests (requires \`@connect\` directive)
-  - \`GM_setValue/getValue\` — Persistent storage across page reloads
-  - \`GM_notification(details)\` — Desktop notifications
-  - \`GM_registerMenuCommand(name, fn)\` — Extension menu commands
-- **Grants:** Every GM_* or VM_* API requires a corresponding \`@grant\` directive in the metadata block. Check that grants match actual API usage.
-- **Cross-Origin Requests:** If the script fetches from \`api.github.com\`, include \`// @connect api.github.com\` or \`GM_xmlhttpRequest\` will fail silently.
-- **Dynamic Pages:** Most modern sites are SPAs. Elements may not exist immediately. Use \`VM_findElement\`, \`MutationObserver\`, or \`@run-at document-idle\` (the safest default).
-
-# Output
-- A complete \`.user.js\` file with proper metadata block and symbol-friendly IIFE structure.
-- The script should pass Customaise's sanitization pipeline without errors on first export.
-- Read the \`customaise://conventions\` resource for the full API reference, including all 22 GM_* APIs, metadata directives, and advanced patterns.
-
 # Shared / Subscribed Scripts
-- Some scripts in \`list_scripts\` have \`isShared: true\`. These are **read-only subscriptions** from other users via Customaise's Cloud Script Sharing.
-- You **cannot** import, export, edit, or delete shared scripts via MCP. Attempting to do so will return an error.
-- If the user wants to modify a shared script, instruct them to open the Customaise extension and use **"Unlock & Fork"** to create an independent, editable copy. Then work with the forked copy.
-- \`sync_scripts\` automatically excludes shared scripts from the export.
+- Some scripts in \`list_scripts\` have \`isShared: true\`. These are **read-only subscriptions** via Customaise Cloud.
+- You **cannot** import, edit, or overwrite these via MCP.
+- If the user wants to augment a shared script, instruct them to open the Customaise UI and click "Unlock & Fork" to create an editable clone.
 
-# User Selections & DOM Targeting
-When a user asks you to modify, hide, style, or interact with specific page elements:
-1. **Check for existing selections** by calling \`get_selected_elements\` — the user may have already selected targets.
-2. **Check the workspace** for \`.dom.md\` and \`.screenshot.png\` files in \`.customaise/dom-context/<script-name>/\` — these are auto-pushed in real-time when the user selects elements while MCP is connected.
-3. If selections exist, use the \`domId\` values with \`VM_findElement\` for bulletproof targeting.
-4. Read the user's comment on each selection — it describes exactly what they want done.
-5. If no selections exist, **guide the user step by step** to select elements:
-   a. Open Chrome and navigate to the target page
-   b. Click the Customaise extension icon in the toolbar (or press **Alt+Shift+C**) to open the UI
-   c. Go to **"MCP Tools"** and click on the script they're working with
-   d. Click the **"DOM Selections"** card — it has a **green crosshair icon**
-   e. Click **"Select Element"** (or the **+** button) — this activates the DOM selector overlay
-   f. Click on the element(s) they want to target — each click captures the element with a screenshot
-   g. When done, come back to the IDE — \`.dom.md\` and \`.screenshot.png\` files will already be in the workspace
-6. If no selections exist, fall back to \`get_page_context\` and standard CSS/\`dom_*\` selectors.
+# User Selections & Context
+When a user asks you to interact with specific page elements:
+1. **Check for manual selections:** Use \`get_selected_elements\`. The user may have explicitly clicked elements to target.
+2. **Check the workspace:** Look for \`.dom.md\` files in \`.customaise/dom-context/\` (auto-pushed when users select elements visually).
+3. If selections exist, use their \`domId\` values with Customaise's robust \`VM_findElement\` targeting API.
+4. If no selections exist, ask the user to select elements via the Customaise UI DOM Selector tool, or fall back to standard CSS selectors.
 `.trim();
@@ -128,8 +81,11 @@ const WS_PORT = Number(process.env.CUSTOMAISE_WS_PORT || process.env.VIBEMONKEY_WS_PORT) || 4050;
         name: 'customaise',
-        version: '1.0.3'
+        version: PKG_VERSION
     }, {
         instructions: SERVER_INSTRUCTIONS,
+        // Only advertise capabilities we actually register. The server
+        // exposes tools and resources; no prompts are registered today.
+        // Advertising `prompts: {}` caused clients to list an empty
+        // `prompts/list` and expose a misleading "no prompts" UI.
         capabilities: {
             tools: {},
-            prompts: {},
             resources: {}
@@ -136,0 +92,0 @@ }

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,gFAAgF;AAChF,yDAAyD;AACzD,iEAAiE;AACjE,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0F3B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;AAEjG,KAAK,UAAU,IAAI;IACjB,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,2BAA2B;IAC3B,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE,mBAAmB;QACjC,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;SACd;KACF,CACF,CAAC;IAEF,sDAAsD;IACtD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAE5C,4CAA4C;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAElF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC5D,WAAW,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,uEAAuE;AACvE,gEAAgE;AAChE,kEAAkE;AAClE,qEAAqE;AACrE,2EAA2E;AAC3E,MAAM,WAAW,GAAW,CAAC,GAAG,EAAE;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5D,CAAC,CAAC,EAAE,CAAC;AAEL,gFAAgF;AAChF,yDAAyD;AACzD,iEAAiE;AACjE,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8B3B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;AAEjG,KAAK,UAAU,IAAI;IACjB,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,2BAA2B;IAC3B,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,WAAW;KACrB,EACD;QACE,YAAY,EAAE,mBAAmB;QACjC,+DAA+D;QAC/D,gEAAgE;QAChE,4DAA4D;QAC5D,0DAA0D;QAC1D,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF,CACF,CAAC;IAEF,sDAAsD;IACtD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAE5C,4CAA4C;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAElF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC5D,WAAW,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

dist/server.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAyBtF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAsmBzG;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAyJ5F"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAyBtF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAusBzG;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAgG5F"}

dist/server.js

@@ -29,3 +29,3 @@ import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
     // ─── Script Lifecycle ───────────────────────────────────────────────
-    server.tool('list_scripts', 'List all userscripts installed in Customaise with their IDs, names, enabled status, match patterns, and whether they are shared (subscribed). Scripts marked isShared are read-only subscriptions — they cannot be imported, exported, edited, or deleted via MCP. To modify a shared script, the user must fork it from the extension UI.', {}, async () => {
+    server.tool('list_scripts', 'List all scripts (UserScripts & AgentScripts) installed in Customaise with their IDs, names, enabled status, match patterns, and whether they are shared (subscribed). Scripts marked isShared are read-only subscriptions — they cannot be imported, exported, edited, or deleted via MCP. To modify a shared script, the user must fork it from the extension UI.', {}, async () => {
         const result = await bridge.request('list_scripts', {});
@@ -39,5 +39,5 @@ return {
     });
-    server.tool('import_script', 'Import an existing userscript from Customaise to a local file for editing. The file will include the full source code with metadata block. After editing the file with your IDE tools, use export_script to push changes back to Customaise. NOTE: Shared/subscribed scripts cannot be imported — they are read-only. The user must fork them from the extension UI first. IMPORTANT: Save files inside your current workspace or project directory (e.g., ./customaise-scripts/), never in /tmp.', {
+    server.tool('import_script', 'Import an existing script (UserScript or AgentScript) from Customaise to a local file for editing. The file will include the full source code with metadata block. After editing the file with your IDE tools, use export_script to push changes back to Customaise. NOTE: Shared/subscribed scripts cannot be imported — they are read-only. The user must fork them from the extension UI first. IMPORTANT: Save files inside your current workspace or project directory (e.g., ./customaise-scripts/), never in /tmp.', {
         scriptId: z.string().describe('The ID of the script to import (get from list_scripts)'),
-        filePath: z.string().describe('Local file path inside your workspace to write the script to (e.g., ./customaise-scripts/my-script.user.js). Do NOT use /tmp.')
+        filePath: z.string().describe('Local file path inside your workspace to write the script to (e.g., ./customaise-scripts/my-script.agent.js). Do NOT use /tmp.')
     }, async ({ scriptId, filePath }) => {
@@ -61,5 +61,6 @@ const result = await bridge.request('import_script', { scriptId });
     });
-    server.tool('export_script', `Export a userscript from a local file into Customaise. The file will be validated through Customaise's sanitization pipeline (syntax checking, AST validation, security analysis). If valid, the script is installed and ready to execute on matching pages. If invalid, detailed diagnostics explain exactly what to fix. Pass scriptId to update an existing script instead of creating a new one. NOTE: You cannot overwrite a shared/subscribed script — they are read-only.
+    server.tool('export_script', `Export a script from a local file into Customaise. The file will be validated through Customaise's sanitization pipeline (syntax checking, AST validation, security analysis). If valid, the script is installed and ready to execute on matching pages. If invalid, detailed diagnostics explain exactly what to fix. Pass scriptId to update an existing script instead of creating a new one. NOTE: You cannot overwrite a shared/subscribed script — they are read-only.
 
-Reminder: Scripts must use an IIFE with named functions for symbol-level editing, \`// @namespace https://customaise.com\`, and include @name, @match, @description, @version, and @grant directives.`, {
+    Reminder for UserScripts: Must use an IIFE with named functions for symbol-level editing, \`// @namespace https://customaise.com\`, and standard directives (@name, @match, @grant).
+    Reminder for AgentScripts: MUST use \`// ==AgentScript==\` block, MUST explicitly declare tools via \`// @webmcp <toolName> <permission>\` (e.g. \`// @webmcp my_tool prompt\`). Permissions: allow (autonomous), prompt (interactive), deny (blocked). Must NOT use IIFEs. CAN use GM_* APIs for persistence, networking, and observability alongside \`navigator.modelContext.registerTool()\`.`, {
         filePath: z.string().describe('Local file path containing the userscript source code'),
@@ -77,3 +78,3 @@ scriptId: z.string().optional().describe('ID of an existing script to update. Omit to create a new script.')
     });
-    server.tool('delete_script', 'Permanently delete a userscript from Customaise. This action cannot be undone. NOTE: Shared/subscribed scripts cannot be deleted via MCP — the user must unsubscribe from the extension UI.', {
+    server.tool('delete_script', 'Permanently delete a script (UserScript or AgentScript) from Customaise. This action cannot be undone. NOTE: Shared/subscribed scripts cannot be deleted via MCP — the user must unsubscribe from the extension UI.', {
         scriptId: z.string().describe('The ID of the script to delete')
@@ -202,5 +203,42 @@ }, async ({ scriptId }) => {
     });
-    server.tool('reload_tab', 'Reload a browser tab to re-inject updated userscripts. Use after export_script to see the effect of your changes. Waits for the page to fully load before returning.', {
+    server.tool('open_tab', 'Open a new browser tab with the specified URL. Returns the new tab ID.', {
+        url: z.string().describe('The URL to open in the new tab'),
+        active: z.boolean().optional().describe('Whether the new tab should become the active tab. Defaults to true.')
+    }, async ({ url, active }) => {
+        const result = await bridge.request('open_tab', { url, active });
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2)
+                }]
+        };
+    });
+    server.tool('close_tab', 'Close a specific browser tab. Defaults to the active tab if no tabId is provided.', {
+        tabId: z.number().optional().describe('The ID of the tab to close')
+    }, async ({ tabId }) => {
+        const result = await bridge.request('close_tab', { tabId });
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2)
+                }]
+        };
+    });
+    server.tool('focus_tab', 'Bring a specific browser tab to the front and make it active.', {
+        tabId: z.number().describe('The ID of the tab to focus')
+    }, async ({ tabId }) => {
+        const result = await bridge.request('focus_tab', { tabId });
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2)
+                }]
+        };
+    });
+    server.tool('reload_tab', 'Reload a browser tab to re-inject updated userscripts. Use after export_script to see the effect of your changes. Waits for the page to fully load before returning. If the tab has AgentScript (WebMCP) tools registered, automatically waits for them to re-register before returning.', {
         tabId: z.number().optional().describe('Tab ID to reload. Defaults to the active tab.')
     }, async ({ tabId }) => {
+        // The bridge handler auto-detects WebMCP tabs and waits event-driven.
+        // No client-side polling needed — plain userscript tabs return immediately,
+        // AgentScript tabs auto-wait for tool re-registration.
         const result = await bridge.request('reload_tab', { tabId });
@@ -248,4 +286,28 @@ return {
     });
+    server.tool('list_webmcp_tools', 'List all WebMCP tools currently registered by AgentScripts for a specific browser tab. Use this to verify that an exported AgentScript is correctly registering its tools on the target page.', {
+        tabId: z.number().optional().describe('Tab ID to query. Defaults to the active tab.')
+    }, async ({ tabId }) => {
+        const result = await bridge.request('list_webmcp_tools', { tabId });
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2)
+                }]
+        };
+    });
+    server.tool('call_webmcp_tool', 'Execute a registered WebMCP tool directly on the target browser tab. If the tool is interactive (trust level), the user will be natively prompted by CustomAIse to approve the execution before it returns.', {
+        tabId: z.number().optional().describe('Tab ID to execute on. Defaults to active tab.'),
+        toolName: z.string().describe('The EXACT name of the WebMCP tool to invoke'),
+        toolArgs: z.record(z.any()).optional().describe('JSON object of arguments for the tool')
+    }, async ({ tabId, toolName, toolArgs }) => {
+        const result = await bridge.request('call_webmcp_tool', { tabId, toolName, toolArgs });
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2)
+                }]
+        };
+    });
     // ─── File Sync ──────────────────────────────────────────────────────
-    server.tool('sync_scripts', 'Bulk export all your own scripts from Customaise to a local directory as individual .user.js files. Creates a .customaise-manifest.json mapping filenames to script IDs. Shared/subscribed scripts are excluded (they are read-only). Use this to set up a local workspace for editing scripts with your IDE.', {
+    server.tool('sync_scripts', 'Bulk export all your own scripts from Customaise to a local directory as individual .user.js or .agent.js files. Creates a .customaise-manifest.json mapping filenames to script IDs. Shared/subscribed scripts are excluded (they are read-only). Use this to set up a local workspace for editing scripts with your IDE.', {
         directory: z.string().describe('Local directory to export scripts to (e.g., ./customaise-scripts/)')
@@ -260,2 +322,5 @@ }, async ({ directory }) => {
         for (const script of scripts) {
+            // Determine file extension based on content
+            const isAgentScript = typeof script.code === 'string' && script.code.includes('// ==AgentScript==');
+            const fileExt = isAgentScript ? '.agent.js' : '.user.js';
             // Generate a safe filename from the script name
@@ -268,6 +333,6 @@ let safeName = (script.name || 'untitled')
             // Handle filename collisions — append short ID suffix if name already used
-            let fileName = `${safeName}.user.js`;
+            let fileName = `${safeName}${fileExt}`;
             if (usedNames.has(fileName)) {
                 const idSuffix = script.id.slice(-6);
-                fileName = `${safeName}-${idSuffix}.user.js`;
+                fileName = `${safeName}-${idSuffix}${fileExt}`;
             }
@@ -409,3 +474,3 @@ usedNames.add(fileName);
                         '',
-                        sel.userComment ? `> ${sel.userComment.replace(/\n/g, '\n> ')}` : '> _No user comment provided._',
+                        sel.userComment ? `> ${sel.userComment.replace(/\\n/g, '\n> ')}` : '> _No user comment provided._',
                         '',
@@ -471,3 +536,3 @@ hasScreenshot ? `![Element screenshot](./${safeElName}.screenshot.png)` : '',
             // Write dom.md
-            const yq = (s) => `"${(s || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
+            const yq = (s) => `"${(s || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\\n/g, '\\n')}"`;
             const bp = selection.bulletproofSelectors || {};
@@ -518,81 +583,2 @@ const tierLines = [];
 export function registerPromptsAndResources(server, bridge) {
-    // ─── Prompts ────────────────────────────────────────────────────────
-    server.prompt('create-userscript', 'Guided workflow for creating a new userscript. Provides a step-by-step prompt that helps the AI agent understand what the user needs and produce a working script.', {
-        targetUrl: z.string().describe('The URL pattern the script should match (e.g., *://*.example.com/*)'),
-        goal: z.string().describe('What the script should accomplish')
-    }, async ({ targetUrl, goal }) => {
-        return {
-            messages: [
-                {
-                    role: 'user',
-                    content: {
-                        type: 'text',
-                        text: [
-                            `Create a userscript for Customaise that does the following:`,
-                            ``,
-                            `**Target URL:** ${targetUrl}`,
-                            `**Goal:** ${goal}`,
-                            ``,
-                            `## Requirements`,
-                            `1. Include a proper metadata block with @name, @namespace, @match, @description, @version, and @grant directives`,
-                            `2. Use \`// @namespace    https://customaise.com\``,
-                            `3. Use @match ${targetUrl}`,
-                            `4. CRITICAL: Wrap the script in an IIFE containing explicit, named top-level functions. Every distinct behavior MUST be a separate named function. Do NOT put logic inline. Customaise uses symbol-level editing (function-by-function) so this structure is mandatory.`,
-                            `5. If making cross-origin requests, include the @connect directive`,
-                            `6. Use GM_log for debug output (it appears in Customaise's console context)`,
-                            `7. Handle edge cases (element not found, page still loading, etc.)`,
-                            ``,
-                            `## Workflow`,
-                            `1. Use \`get_page_context\` to understand the page structure`,
-                            `2. Write the script code to a file in the workspace directory (e.g., ./customaise-scripts/), NEVER to /tmp`,
-                            `3. For targeting existing page elements, consider using \`VM_findElement\` with \`dom_*\` IDs from \`get_page_context\` for bulletproof selector resilience`,
-                            `4. Use \`export_script\` to install it in Customaise (it will be validated through the sanitization pipeline)`,
-                            `5. Use \`reload_tab\` to test it`,
-                            `6. Use \`get_console_context\` to check for errors or GM_log output`,
-                            `7. If there are issues, fix and re-export`,
-                            ``,
-                            `## Reference`,
-                            `Read the \`customaise://conventions\` resource for the full API reference (22 GM_* APIs, metadata directives, and advanced patterns).`,
-                        ].join('\n')
-                    }
-                }
-            ]
-        };
-    });
-    server.prompt('debug-userscript', 'Debugging workflow for an existing userscript that isn\'t working as expected. Guides the AI through systematic diagnosis using available tools.', {
-        scriptId: z.string().describe('The ID of the script to debug')
-    }, async ({ scriptId }) => {
-        return {
-            messages: [
-                {
-                    role: 'user',
-                    content: {
-                        type: 'text',
-                        text: [
-                            `Debug the userscript with ID \`${scriptId}\`.`,
-                            ``,
-                            `## Debugging Steps`,
-                            `1. Use \`import_script\` to pull the script to a local file for inspection`,
-                            `2. Check if the script is enabled with \`list_scripts\``,
-                            `3. Use \`list_tabs\` to find a tab matching the script's @match pattern`,
-                            `4. Use \`reload_tab\` on that tab to trigger script injection`,
-                            `5. Use \`get_console_context\` to capture errors and GM_log output`,
-                            `6. Use \`get_page_context\` to verify the DOM state`,
-                            `7. If needed, use \`take_screenshot\` to see the visual result`,
-                            ``,
-                            `## Common Issues`,
-                            `- @match pattern doesn't match the current URL`,
-                            `- @run-at timing: script runs before target elements exist`,
-                            `- Missing @grant for GM_* or VM_* APIs used in the script`,
-                            `- Missing @connect directive for cross-origin GM_xmlhttpRequest calls`,
-                            `- CSP blocking inline script injection`,
-                            `- Element selectors changed on the page`,
-                            ``,
-                            `Fix any issues found and use \`export_script\` to push updates.`,
-                        ].join('\n')
-                    }
-                }
-            ]
-        };
-    });
     // ─── Resources ──────────────────────────────────────────────────────
@@ -617,3 +603,2 @@ server.resource('scripts-list', 'customaise://scripts', {
         const scriptId = variables.scriptId;
-        // Reuse the import_script bridge command (same logic, avoids duplication)
         const result = await bridge.request('import_script', { scriptId });
@@ -629,3 +614,3 @@ return {
     server.resource('conventions', 'customaise://conventions', {
-        description: 'Userscript writing conventions and best practices for Customaise.',
+        description: 'Directory pointer for Customaise conventions.',
         mimeType: 'text/markdown'
@@ -637,11 +622,34 @@ }, async (uri) => {
                     mimeType: 'text/markdown',
-                    text: CONVENTIONS_GUIDE
+                    text: '> **Directory Redirect**\n> \n> Customaise supports two script paradigms with distinct architectures.\n> \n> - For traditional DOM manipulation, read `customaise://userscript-conventions`\n> - For WebMCP tool injection, read `customaise://agentscript-conventions`'
                 }]
         };
     });
+    server.resource('userscript-conventions', 'customaise://userscript-conventions', {
+        description: 'Complete conventions, workflow, and API guide for building Customaise UserScripts.',
+        mimeType: 'text/markdown'
+    }, async (uri) => {
+        return {
+            contents: [{
+                    uri: uri.href,
+                    mimeType: 'text/markdown',
+                    text: USERSCRIPT_CONVENTIONS
+                }]
+        };
+    });
+    server.resource('agentscript-conventions', 'customaise://agentscript-conventions', {
+        description: 'Complete conventions, workflow, and API guide for building Customaise AgentScripts.',
+        mimeType: 'text/markdown'
+    }, async (uri) => {
+        return {
+            contents: [{
+                    uri: uri.href,
+                    mimeType: 'text/markdown',
+                    text: AGENTSCRIPT_CONVENTIONS
+                }]
+        };
+    });
 }
-const CONVENTIONS_GUIDE = `# Customaise Userscript Conventions
+const USERSCRIPT_CONVENTIONS = `# Customaise UserScripts
 
 ## File Format & Structure
-
 Every userscript is a single \`.user.js\` file with a metadata block at the top. 
@@ -682,3 +690,2 @@ **CRITICAL**: Customaise supports symbol-level editing (function-by-function). To enable this, your script MUST be wrapped in an IIFE containing **named functions**, rather than flat inline code.
 ## Metadata Directives
-
 | Directive | Required | Description |
@@ -700,3 +707,2 @@ |-----------|----------|-------------|
 ## VM_findElement (Bulletproof DOM Targeting)
-
 Customaise provides a revolutionary multi-tier selector API that guarantees 100% element targeting reliability, surviving UI redesigns and dynamic class changes.
@@ -713,10 +719,9 @@
 ## Available GM_* APIs
+Customaise supports 22 \`GM_*\` APIs. You can use either the classic \`GM_*\` (underscore) or modern \`GM.*\` (promise-based) syntax.
 
-Customaise supports 22 \`GM_*\` APIs, making it highly compatible with existing Greasemonkey/Tampermonkey scripts. You can use either the classic \`GM_*\` (underscore) or modern \`GM.*\` (promise-based) syntax.
-
 ### Environment & Console
 | API | Description |
 |-----|-------------|
-| \`GM_log(msg)\` / \`GM.log(msg)\` | Log to Customaise console (visible via \`get_console_context\` tool) |
-| \`GM_info\` / \`GM.info\` | Object containing script metadata |
+| \`GM_log(msg)\` | Log to Customaise console (visible via \`get_console_context\` tool) |
+| \`GM_info\` | Object containing script metadata |
 
@@ -726,6 +731,6 @@ ### Storage (Extension-Scoped)
 |-----|-------------|
-| \`GM_setValue(k, v)\` / \`GM.setValue(k, v)\` | Persistent storage (survives page reloads) |
-| \`GM_getValue(k, def)\` / \`GM.getValue(k, def)\` | Read from persistent storage |
-| \`GM_deleteValue(k)\` / \`GM.deleteValue(k)\` | Delete from persistent storage |
-| \`GM_listValues()\` / \`GM.listValues()\` | List all stored keys |
+| \`GM_setValue(k, v)\` | Persistent storage (survives page reloads) |
+| \`GM_getValue(k, def)\` | Read from persistent storage |
+| \`GM_deleteValue(k)\` | Delete from persistent storage |
+| \`GM_listValues()\` | List all stored keys |
 | \`GM_addValueChangeListener(name, cb)\` | Listen for storage changes across tabs |
@@ -737,7 +742,7 @@ | \`GM_removeValueChangeListener(id)\` | Remove storage listener |
 |-----|-------------|
-| \`GM_addStyle(css)\` / \`GM.addStyle(css)\` | Inject CSS into the page |
-| \`GM_addElement(tag, attr)\` / \`GM.addElement(tag, attr)\` | Safely create and append DOM elements |
-| \`GM_registerMenuCommand(name, fn)\` | Add a command to the Customaise extension menu |
+| \`GM_addStyle(css)\` | Inject CSS into the page |
+| \`GM_addElement(tag, attr)\` | Safely create and append DOM elements |
+| \`GM_registerMenuCommand(name, fn)\` | Add a command to the extension menu |
 | \`GM_unregisterMenuCommand(id)\` | Remove a menu command |
-| \`GM_notification(details)\` / \`GM.notification(details)\` | Show a desktop OS notification |
+| \`GM_notification(details)\` | Show a desktop OS notification |
 
@@ -748,6 +753,5 @@ ### Network & Resources
 | \`GM_xmlhttpRequest(details)\` | Cross-origin HTTP requests. **Requires \`@connect\` directive.** |
-| \`GM.xmlHttpRequest(details)\` | Promise-based cross-origin HTTP requests |
 | \`GM_download(details)\` | Download a file to disk |
-| \`GM_getResourceText(name)\` / \`GM.getResourceText(name)\` | Read text content from a \`@resource\` |
-| \`GM_getResourceURL(name)\` / \`GM.getResourceUrl(name)\` | Get base64 data URI for a \`@resource\` |
+| \`GM_getResourceText(name)\` | Read text content from a \`@resource\` |
+| \`GM_getResourceURL(name)\` | Get base64 data URI for a \`@resource\` |
 
@@ -757,10 +761,9 @@ ### Tabs & System
 |-----|-------------|
-| \`GM_setClipboard(text)\` / \`GM.setClipboard(text)\` | Copy text to OS clipboard |
-| \`GM_openInTab(url, options)\` / \`GM.openInTab(url, options)\` | Open a new browser tab |
-| \`GM_getTab(cb)\` / \`GM.getTab()\` | Get persistent state for the current tab |
-| \`GM_saveTab(obj)\` / \`GM.saveTab(obj)\` | Save persistent state for the current tab |
-| \`GM_getTabs(cb)\` / \`GM.getTabs()\` | Get persistent state for all tabs running this script |
+| \`GM_setClipboard(text)\` | Copy text to OS clipboard |
+| \`GM_openInTab(url, options)\` | Open a new browser tab |
+| \`GM_getTab(cb)\` | Get persistent state for the current tab |
+| \`GM_saveTab(obj)\` | Save persistent state for the current tab |
+| \`GM_getTabs(cb)\` | Get persistent state for all tabs |
 
 ## Developer Workflow & Best Practices
-
 1. **Use \`GM_log\` over \`console.log\`:** \`GM_log\` output is explicitly tracked by Customaise and is visible when using the \`get_console_context\` MCP tool.
@@ -771,2 +774,230 @@ 2. **Cross-Origin Requests:** If your script needs to fetch data from \`api.github.com\`, you MUST include \`// @connect api.github.com\` in the metadata block, or \`GM_xmlhttpRequest\` will fail silently.
 `;
+const AGENTSCRIPT_CONVENTIONS = `# Customaise AgentScripts
+
+AgentScripts inject WebMCP tools onto any web page via \`navigator.modelContext\`.
+
+## Setup & environment
+
+**No Chrome flag required.** Customaise ships a polyfill of \`navigator.modelContext\` that runs on stable Chromium today. The Chrome \`#enable-webmcp-testing\` flag is OPTIONAL — it only matters if the user wants third-party WebMCP-spec inspector tools to introspect Customaise's tool registry. The Customaise stack itself (the in-extension AI, the IDE MCP bridge, every \`@webmcp\`-declared tool) works flag-off.
+
+**The "two browsers" mental model.** Customaise is intentionally split across two browsers:
+- **The user's daily Chrome** (or Edge / Brave / any Chromium) — where Customaise is installed, where the user is logged into the target sites (bank, CRM, internal Jira, etc.), where AgentScripts inject. This is where the "hands" live.
+- **The IDE running the agent** (Cursor, Claude Code, Windsurf, etc.) — where the agent's "brain" lives. The IDE's built-in browser is NOT where Customaise should run.
+
+The two communicate via a WebSocket on \`localhost:4050\` (the Customaise MCP server, spawned by the IDE's MCP client). The agent never sees the user's cookies or auth tokens — it just calls registered tools and the tools execute inside the user's authenticated session. This split is what unlocks "Bring Your Own Session" automation: any web app the user is already logged into becomes addressable, with no API keys, no OAuth dance, no scraping.
+
+**Prerequisites for the user (one-time).** They need:
+1. Customaise extension installed (Web Store or unpacked).
+2. If unpacked: \`chrome://extensions\` → Developer mode ON, plus the "Allow user scripts" toggle on Customaise's card.
+3. The global AgentScripts toggle in Customaise Settings → Script Management → ON. (Without this, every AgentScript is unregistered globally regardless of per-script enable state.)
+4. Whatever site they want to automate, opened and signed in normally.
+
+## Format Requirements
+1. MUST use the \`// ==AgentScript==\` metadata block (NOT UserScript).
+2. MUST declare each tool via \`// @webmcp <toolName> <permission>\` (permissions: allow, prompt, deny). Undeclared tools are denied by default.
+3. Top-level \`navigator.modelContext.registerTool()\` is **strongly recommended** (NOT enforced — IIFE-wrapped scripts also work). The reason: Customaise's in-browser AI editor performs **symbol-level edits** (function-by-function) only on functions that are addressable at the top level or inside a clearly-named IIFE structure with named functions. Flat anonymous code or deeply-nested anonymous arrows force the editor to fall back to **whole-script rewrite**, which is slower, more error-prone, and loses git-friendly diffs. If symbol-editability matters (it usually does for long-lived scripts), structure your code as named top-level functions referenced by your \`registerTool\` calls.
+
+\`\`\`javascript
+// ==AgentScript==
+// @name         GitHub Agent Actions
+// @namespace    https://customaise.com
+// @version      1.0.0
+// @match        https://github.com/*
+// @description  Exposes GitHub issues data to IDE agents via WebMCP tools
+// @webmcp       list_open_issues prompt
+// @grant        GM_log
+// @grant        GM_setValue
+// @grant        GM_getValue
+// ==/AgentScript==
+
+// AgentScripts execute in the MAIN world, but they CAN use GM_* APIs!
+// A built-in bridge automatically routes GM_* requests to the extension securely.
+const usageCount = await GM.getValue('usage_count', 0);
+await GM.setValue('usage_count', usageCount + 1);
+GM_log(\`AgentScript loaded. Usage count: \${usageCount + 1}\`);
+
+navigator.modelContext.registerTool({
+  name: "list_open_issues",
+  description: "Returns all open issues with titles and labels",
+  schema: { type: "object", properties: {} },
+  readOnlyHint: true, // Set to true if your tool does not mutate the page (defaults to false)
+  execute: async (args) => {
+    const issues = document.querySelectorAll('.js-issue-row');
+    return Array.from(issues).map(row => ({
+      title: row.querySelector('.Link--primary')?.textContent?.trim(),
+      labels: Array.from(row.querySelectorAll('.IssueLabel'))
+        .map(l => l.textContent?.trim())
+    }));
+  }
+});
+\`\`\`
+
+## Required Directives
+| Directive | Description |
+|-----------|-------------|
+| \`@webmcp\`  | **Mandatory.** Format: \`<toolName> <allow|prompt|deny>\`. Declares explicit permissions for each registered tool. |
+
+## Granular Tool Permissions
+- \`allow\` — Autonomous. Executes immediately without user confirmation.
+- \`prompt\` — Interactive. Triggers the Customaise UX asking for explicit user consent before execution.
+- \`deny\` — Blocked. Tool is suppressed and fails if called. All undeclared tools default to deny.
+
+### Consent gate timing (important when designing tools)
+Every \`navigator.modelContext.callTool(...)\` invocation — yours, the IDE MCP client's, the in-extension AI's, or any other in-page agent — round-trips to the extension service worker for permission evaluation **before** your \`execute\` body runs. Two practical consequences:
+- \`allow\` tools add ~50–100 ms latency per call. Fine for human-paced flows; avoid hot-loop calls.
+- \`prompt\` tools may **block for up to 5 minutes** while waiting on the user. Design tools so this is acceptable (no timing-sensitive logic between trigger and execute).
+
+The same gate enforces the same \`@webmcp\` policy across **every call path**, so a tool you mark \`prompt\` will reliably show the consent modal regardless of who invokes it. This is a guarantee you can rely on for security-sensitive operations.
+
+## Manual HITL Requests
+Even if your tool is granted the \`allow\` permission, you can dynamically invoke the Customaise consent modal inside an execute block:
+\`const consent = await navigator.modelContext.requestUserInteraction({ toolName: 'my_tool', reason: '...' });\`
+
+## GM_* API Support in MAIN World
+- AgentScripts execute in the browser's MAIN world so they can access \`navigator.modelContext\`.
+- **Customaise provides a secure, native MAIN world bridge for GM_* APIs.**
+- AgentScripts are executed contextually by Customaise, so **top-level await is fully supported**.
+- \`GM_setValue\`, \`GM_xmlhttpRequest\`, \`GM_log\`, etc., are fully supported.
+- You MUST explicitly include a \`@grant\` directive for each API you use, exactly like a UserScript.
+- \`unsafeWindow\` should NOT be used (it is redundant because you are already in the MAIN world).
+
+## Advanced Networking & Auth Interception
+You can use \`@run-at document-start\` to inject your AgentScript before the target page loads. 
+This allows you to patch \`window.fetch\` or \`XMLHttpRequest\` to capture bearer tokens or authentication headers. 
+You can then securely store them using \`GM_setValue\` and retrieve them using \`GM_getValue\` inside your WebMCP tool executions, enabling your AI agents to perform authenticated actions on behalf of the user.
+
+## AgentScript Workflow
+1. Use \`get_page_context\` to understand the page structure
+2. Identify areas of the page that would make good "read" tools (tables, lists, data)
+3. Identify forms/buttons that would make good "write" tools (interactive). For those, ensure \`readOnlyHint: false\`.
+4. Write the \`.agent.js\` code to a file in the workspace directory (e.g., ./customaise-scripts/), NEVER to /tmp.
+5. Use \`export_script\` to install it into Customaise. **Read the response \`warnings[]\` array** — silent issues like malformed \`@webmcp\` lines or tools registered without a matching \`@webmcp\` declaration are surfaced there. They will NOT be re-surfaced when the tool fails at call time.
+6. Use \`reload_tab\` on the target page so the AgentScript actually injects.
+7. Use \`list_webmcp_tools\` to verify your tools successfully registered on the page.
+8. Call them via \`call_webmcp_tool\`.
+
+## Patterns & Recipes — how to actually be productive
+
+The single biggest mental shift: **WebMCP turns the page into a REPL for you.** You aren't writing one big script that has to work first try. You build a small introspective tool, call it via \`call_webmcp_tool\`, observe the structured JSON, modify the script, re-export, call again. Tight loop. Throw the diagnostic tools away when done.
+
+### Recipe 1 — The "diagnostic tool" pattern (your single most important habit)
+Whenever you start work against a page you don't know well, your **first** AgentScript should be a no-op tool whose only job is to surface state.
+
+\`\`\`javascript
+// ==AgentScript==
+// @name        Page Inspector
+// @match       https://target.example.com/*
+// @webmcp      inspect_state allow
+// @grant       GM_log
+// @run-at      document-start
+// ==/AgentScript==
+
+const _captured = { posts: [], headers: {}, ready: false };
+
+const _origFetch = window.fetch;
+window.fetch = function (input, init) {
+  const url = typeof input === 'string' ? input : input?.url;
+  if (init?.method === 'POST' && url?.includes('/api/')) {
+    _captured.posts.push({ url, body: typeof init.body === 'string' ? init.body.slice(0, 300) : null });
+    if (init.headers) Object.assign(_captured.headers, init.headers);
+    _captured.ready = true;
+  }
+  return _origFetch.apply(this, arguments);
+};
+
+navigator.modelContext.registerTool({
+  name: 'inspect_state',
+  description: 'Returns intercepted POST endpoints and headers seen so far.',
+  schema: { type: 'object', properties: {} },
+  readOnlyHint: true,
+  execute: async () => ({ ..._captured, headerKeys: Object.keys(_captured.headers) }),
+});
+\`\`\`
+
+Now you can call \`inspect_state\` from your IDE after performing actions on the page — you'll see exactly what API endpoints exist, what headers carry auth, what payloads look like. **You couldn't do this without WebMCP**: a plain userscript could capture the same data but you'd have to dump it via \`GM_log\` and grep \`get_console_context\` for it. Round-trip too slow to iterate against.
+
+### Recipe 2 — Auth-interception → replay (the "BYO session" trick)
+When the target site has no public API but you want to drive it programmatically, the page's own authenticated requests are your API. Pattern:
+
+1. **Intercept at \`document-start\`** (so you catch the page's first requests):
+   \`\`\`javascript
+   // @run-at document-start
+   const captured = { headers: {} };
+   const origOpen = XMLHttpRequest.prototype.open;
+   const origSetHeader = XMLHttpRequest.prototype.setRequestHeader;
+   const origSend = XMLHttpRequest.prototype.send;
+   XMLHttpRequest.prototype.open = function (method, url) {
+     this._vmHeaders = {};
+     return origOpen.apply(this, arguments);
+   };
+   XMLHttpRequest.prototype.setRequestHeader = function (name, value) {
+     if (this._vmHeaders) this._vmHeaders[name.toLowerCase()] = value;
+     return origSetHeader.apply(this, arguments);
+   };
+   XMLHttpRequest.prototype.send = function (body) {
+     if (this._vmHeaders && Object.keys(this._vmHeaders).length > 2) {
+       Object.assign(captured.headers, this._vmHeaders);
+     }
+     return origSend.apply(this, arguments);
+   };
+   \`\`\`
+2. **Surface what you've captured via a \`check_auth\` tool** (Recipe 1 pattern).
+3. **In your action tool, replay the captured headers** on a fresh XHR with your payload:
+   \`\`\`javascript
+   const xhr = new XMLHttpRequest();
+   xhr.open('POST', '/api/the/endpoint', true);
+   xhr.withCredentials = true;
+   xhr.setRequestHeader('Content-Type', 'application/json');
+   for (const [k, v] of Object.entries(captured.headers)) {
+     if (!['content-type', 'content-length'].includes(k)) {
+       try { xhr.setRequestHeader(k, v); } catch (_) {}
+     }
+   }
+   xhr.send(JSON.stringify(payload));
+   \`\`\`
+
+This pattern unlocks **any** web app that the user is logged into. No API keys, no OAuth dance, no scraping. The agent operates as the user, with the user's permission.
+
+### Recipe 3 — Capture-at-execute (don't capture-at-registration)
+SPAs change pages without reload. If you read \`document.title\` or any DOM state inside \`registerTool\` (or in module scope at script load), you'll be holding stale data. **Always read live state inside the \`execute\` body.** Wrong:
+\`\`\`javascript
+const currentPrice = parseFloat(document.title.match(/[\\d.]+/)[0]); // captured ONCE at script load
+navigator.modelContext.registerTool({ name: 'foo', execute: async () => ({ currentPrice }) });
+\`\`\`
+Right:
+\`\`\`javascript
+navigator.modelContext.registerTool({
+  name: 'foo',
+  execute: async () => ({ currentPrice: parseFloat(document.title.match(/[\\d.]+/)[0]) }),
+});
+\`\`\`
+
+### Recipe 4 — Iterate fast, expand state on each cycle
+When something doesn't work, **don't rewrite the action tool**. Add fields to your inspection tool's return value. Find the missing piece. Then fix the action. The diagnostic tool grows; the action tool stays focused.
+
+\`\`\`
+1. inspect_state shows: 0 captured POSTs → page hasn't done anything yet → user needs to click something
+2. inspect_state shows: 12 captured POSTs but no /api/order/place → wrong action triggered, look at page UI
+3. inspect_state shows: the right endpoint, but body has fields you didn't expect → copy the format
+4. action tool now succeeds
+\`\`\`
+
+Each iteration takes seconds because the inspect_state response is structured JSON delivered to you, not a string in a console somewhere.
+
+### Recipe 5 — \`prompt\` for anything with side effects, \`allow\` for reads
+Default to \`allow\` for tools that just observe. Use \`prompt\` for anything that mutates state (orders, posts, deletes, transfers). The user's consent is your safety harness — don't bypass it just because \`allow\` is more convenient. The 5-minute consent budget is generous; design tools assuming the user might take 30 seconds to read what you're about to do.
+
+### Recipe 6 — Throw away your diagnostic tools when shipping
+Once your action tool works, \`delete_script\` the inspector. Or move its tools to \`@webmcp inspect_state deny\` so they're not callable. Diagnostics in production = attack surface.
+
+## Troubleshooting — \`list_webmcp_tools\` returns empty after reload
+Walk these in order. Most common cause first:
+1. **Global AgentScripts gate is OFF.** Customaise has a master toggle in Settings → Script Management. If off, every AgentScript is unregistered globally, regardless of per-script enable state. Ask the user to enable it once (per browser profile).
+2. **\`@match\` doesn't actually match the URL.** Verify with \`list_tabs\` then compare the URL against your \`@match\` patterns. \`https://demo.example.com/*\` doesn't match \`http://...\` or a different subdomain.
+3. **The script is per-script-disabled.** Even with the global gate on, the per-script toggle in Customaise's Script Management UI must be on. \`list_scripts\` shows the \`enabled\` boolean.
+4. **Tab wasn't reloaded after export.** Manifest content scripts re-inject only on navigation. Call \`reload_tab\` explicitly.
+5. **Script body threw before \`registerTool\` ran.** Use \`get_console_context\` on the tab to look for early errors. Nothing after the throw runs, so your tools never registered.
+6. **\`@webmcp\` declarations are malformed and were silently stripped at parse time.** Re-read the \`webmcp[]\` field in the \`export_script\` response — if it's empty but you intended grants, fix the directive syntax (\`<toolName> <allow|prompt|deny>\`, single space, no extra tokens).
+7. **You called \`registerTool\` for a tool that isn't declared in any \`@webmcp\` line.** It registers in the page registry but is filtered from \`list_webmcp_tools\` and rejected at call time. Add the \`@webmcp\` line.
+`;
 //# sourceMappingURL=server.js.map

dist/server.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,SAAS,eAAe;IACtB,8BAA8B;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACtD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAKD;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAuB,EAAE,WAAyB;IAEjG,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACT,cAAc,EACd,4UAA4U,EAC5U,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,meAAme,EACne;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;QACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+HAA+H,CAAC;KAC/J,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAIhE,CAAC;QAEF,yCAAyC;QACzC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,QAAQ;wBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;qBACxD,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf;;sMAEkM,EAClM;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACtF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;KAC7G,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAIF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,6LAA6L,EAC7L;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAChE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,uJAAuJ,EACvJ;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACvE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAClE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,mEAAmE;IACnE,2DAA2D;IAE3D,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,uUAAuU,EACvU;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;KACxF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAwB,CAAC;QAE1F,kEAAkE;QAClE,OAAO,MAAM,CAAC,cAAc,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC;QAE5B,6DAA6D;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;QAC1D,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE3C,2DAA2D;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY;eACxC,MAAM,CAAC,YAAY;eACnB,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAE5E,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,GAAG;wBACH,KAAK;wBACL,QAAQ;wBACR,UAAU,EAAE,GAAG,UAAU,KAAK;wBAC9B,YAAY;wBACZ,IAAI,EAAE,uKAAuK;qBAC9K,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,mSAAmS,EACnS;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAMnE,CAAC;QAEF,kEAAkE;QAClE,OAAO,MAAM,CAAC,cAAc,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC;QAE5B,+CAA+C;QAC/C,IAAI,UAAU,GAA4B,MAAM,CAAC;QACjD,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,OAAO,UAAU,CAAC,QAAQ,CAAC;gBAC3B,OAAO,UAAU,CAAC,cAAc,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC5B,OAAO,UAAU,CAAC,MAAM,CAAC;gBACzB,OAAO,UAAU,CAAC,cAAc,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACjD,OAAO,UAAU,CAAC,MAAM,CAAC;gBACzB,OAAO,UAAU,CAAC,QAAQ,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;QAC1D,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE3C,2DAA2D;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAE5E,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,QAAQ;wBACR,UAAU,EAAE,GAAG,UAAU,KAAK;wBAC9B,MAAM,EAAE;4BACN,MAAM,EAAE,UAAU;4BAClB,QAAQ,EAAE,SAAS;4BACnB,cAAc,EAAE,UAAU;4BAC1B,WAAW,EAAE,KAAK,IAAI,KAAK;yBAC5B;wBACD,IAAI,EAAE,0JAA0J;qBACjK,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,+JAA+J,EAC/J,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,sKAAsK,EACtK;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;KACvF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,mJAAmJ,EACnJ;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC1F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;KAC3H,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAI/D,CAAC;QAEF,gCAAgC;QAChC,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC1E,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE3D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,QAAQ,EAAE,QAAQ;wBAClB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;qBACtB,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,yNAAyN,EACzN;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACtF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAGF,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACT,cAAc,EACd,+SAA+S,EAC/S;QACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;KACrG,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACtB,4BAA4B;QAC5B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAK/D,CAAC;QAEH,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,gDAAgD;YAChD,IAAI,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;iBACvC,WAAW,EAAE;iBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;iBAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;iBACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEzB,2EAA2E;YAC3E,IAAI,QAAQ,GAAG,GAAG,QAAQ,UAAU,CAAC;YACrC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrC,QAAQ,GAAG,GAAG,QAAQ,IAAI,QAAQ,UAAU,CAAC;YAC/C,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YAE5C,0DAA0D;YAC1D,IAAI,WAAW;gBAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACpD,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;YAC/B,YAAY,EAAE,CAAC;QACjB,CAAC;QAED,gCAAgC;QAChC,MAAM,YAAY,GAAG,GAAG,SAAS,4BAA4B,CAAC;QAC9D,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAExE,6CAA6C;QAC7C,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,SAAS;wBACT,YAAY;wBACZ,YAAY;wBACZ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;qBACtE,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAGF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,uhBAAuhB,EACvhB;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;QAClH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;QAChI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;KACpH,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAQ,CAAC;QAElF,8CAA8C;QAC9C,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC/F,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAE3B,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEnE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;qBAC9C,WAAW,EAAE;qBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;qBAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;qBACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;gBACrC,kFAAkF;gBAClF,IAAI,OAAO,GAAG,SAAS,CAAC;gBACxB,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;oBACpE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;gBACxE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE1C,MAAM,QAAQ,GAAwB,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;gBAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACpC,sEAAsE;oBACtE,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;yBAC3D,WAAW,EAAE;yBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;yBAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;yBACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;oBAEtC,qDAAqD;oBACrD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;wBAChB,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;4BAAE,OAAO,EAAE,CAAC;wBAC5D,UAAU,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;oBAC1C,CAAC;oBACD,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAE1B,qCAAqC;oBACrC,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;oBAEjH,sEAAsE;oBACtE,gEAAgE;oBAChE,MAAM,EAAE,GAAG,GAAG,CAAC,oBAAoB,IAAI,EAAS,CAAC;oBACjD,MAAM,SAAS,GAAa,EAAE,CAAC;oBAC/B,SAAS,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC1F,MAAM,UAAU,GAAyB;wBACvC,CAAC,sBAAsB,EAAE,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC;wBACvD,CAAC,kBAAkB,EAAE,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;wBAC/C,CAAC,uBAAuB,EAAE,EAAE,CAAC,qBAAqB,IAAI,EAAE,CAAC;wBACzD,CAAC,6BAA6B,EAAE,EAAE,CAAC,2BAA2B,IAAI,EAAE,CAAC;wBACrE,CAAC,uBAAuB,EAAE,EAAE,CAAC,qBAAqB,IAAI,EAAE,CAAC;wBACzD,CAAC,kBAAkB,EAAE,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;qBAChD,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACnB,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;4BAC7B,KAAK,MAAM,IAAI,IAAI,GAAG;gCAAE,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC9D,CAAC;oBACH,CAAC;oBACD,IAAI,EAAE,CAAC,eAAe;wBAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;oBACvF,IAAI,EAAE,CAAC,qBAAqB;wBAAE,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBAEzG,4EAA4E;oBAC5E,yEAAyE;oBACzE,8EAA8E;oBAC9E,wEAAwE;oBACxE,gFAAgF;oBAChF,sEAAsE;oBACtE,IAAI,aAAa,GAAG,KAAK,CAAC;oBAC1B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;wBACnB,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;4BACxD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;4BAC1E,aAAa,GAAG,IAAI,CAAC;wBACvB,CAAC;wBAAC,MAAM,CAAC;4BACP,YAAY;wBACd,CAAC;oBACH,CAAC;oBAED,MAAM,KAAK,GAAG;wBACZ,KAAK;wBACL,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;wBACzB,gBAAgB,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE;wBAC3C,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;wBAC7B,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;wBACnC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;wBAC3D,SAAS,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,SAAS,CAAC,EAAE;wBAC/C,YAAY,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,IAAI,SAAS,CAAC,EAAE;wBACrD,kBAAkB,GAAG,CAAC,SAAS,EAAE,aAAa,IAAI,KAAK,EAAE;wBACzD,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;wBAC7B,cAAc,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;wBACvC,eAAe,GAAG,CAAC,UAAU,EAAE;wBAC/B,uBAAuB;wBACvB,GAAG,SAAS;wBACZ,KAAK;wBACL,EAAE;wBACF,KAAK,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,EAAE;wBACrC,EAAE;wBACF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B;wBACjG,EAAE;wBACF,aAAa,CAAC,CAAC,CAAC,2BAA2B,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAAE;wBAC5E,EAAE;wBACF,yBAAyB;wBACzB,OAAO;wBACP,yCAAyC,GAAG,CAAC,KAAK,KAAK;wBACvD,KAAK;wBACL,EAAE;qBACH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAE7B,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;oBAEvE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG;wBACpB,IAAI,EAAE,GAAG,UAAU,SAAS;wBAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,aAAa,CACX,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACzG,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAGF,uEAAuE;IAGvE,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,KAAK,oBAAoB;YAAE,OAAO;QAE1C,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;YACnE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,CAAC,UAAU,IAAI,QAAQ,IAAI,SAAS,CAAC;iBACnD,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;YACxE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1C,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC;iBACnE,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;YACpF,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;YAE1E,mBAAmB;YACnB,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACpD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;oBAC1E,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAED,eAAe;YACf,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;YAC7G,MAAM,EAAE,GAAG,SAAS,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAChD,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,cAAc;gBAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACpF,IAAI,EAAE,CAAC,oBAAoB,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/H,IAAI,EAAE,CAAC,gBAAgB,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnH,IAAI,EAAE,CAAC,qBAAqB,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClI,IAAI,EAAE,CAAC,2BAA2B,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpJ,IAAI,EAAE,CAAC,eAAe;gBAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,EAAE,CAAC,qBAAqB;gBAAE,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAEzG,MAAM,KAAK,GAAG;gBACZ,KAAK;gBACL,UAAU,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBAC/B,gBAAgB,EAAE,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE;gBACjD,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBACnC,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;gBACzC,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;gBACjE,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;gBACzC,cAAc,EAAE,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;gBAC7C,aAAa,CAAC,CAAC,CAAC,gBAAgB,UAAU,kBAAkB,CAAC,CAAC,CAAC,IAAI;gBACnE,uBAAuB;gBACvB,GAAG,SAAS;gBACZ,KAAK;gBACL,EAAE;gBACF,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC1E,EAAE;aACH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE7B,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAEvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,UAAU,wBAAwB,aAAa,KAAK,CAAC,CAAC;QAC7H,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAuB;IAEpF,uEAAuE;IAEvE,MAAM,CAAC,MAAM,CACX,mBAAmB,EACnB,oKAAoK,EACpK;QACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KAC/D,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;QAC5B,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE;wBACP,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE;4BACJ,6DAA6D;4BAC7D,EAAE;4BACF,mBAAmB,SAAS,EAAE;4BAC9B,aAAa,IAAI,EAAE;4BACnB,EAAE;4BACF,iBAAiB;4BACjB,kHAAkH;4BAClH,oDAAoD;4BACpD,iBAAiB,SAAS,EAAE;4BAC5B,yQAAyQ;4BACzQ,oEAAoE;4BACpE,6EAA6E;4BAC7E,oEAAoE;4BACpE,EAAE;4BACF,aAAa;4BACb,8DAA8D;4BAC9D,4GAA4G;4BAC5G,6JAA6J;4BAC7J,+GAA+G;4BAC/G,kCAAkC;4BAClC,qEAAqE;4BACrE,2CAA2C;4BAC3C,EAAE;4BACF,cAAc;4BACd,uIAAuI;yBACxI,CAAC,IAAI,CAAC,IAAI,CAAC;qBACb;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,kBAAkB,EAClB,kJAAkJ,EAClJ;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC/D,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE;wBACP,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE;4BACJ,kCAAkC,QAAQ,KAAK;4BAC/C,EAAE;4BACF,oBAAoB;4BACpB,4EAA4E;4BAC5E,yDAAyD;4BACzD,yEAAyE;4BACzE,+DAA+D;4BAC/D,oEAAoE;4BACpE,qDAAqD;4BACrD,gEAAgE;4BAChE,EAAE;4BACF,kBAAkB;4BAClB,gDAAgD;4BAChD,4DAA4D;4BAC5D,2DAA2D;4BAC3D,uEAAuE;4BACvE,wCAAwC;4BACxC,yCAAyC;4BACzC,EAAE;4BACF,iEAAiE;yBAClE,CAAC,IAAI,CAAC,IAAI,CAAC;qBACb;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,MAAM,CAAC,QAAQ,CACb,cAAc,EACd,sBAAsB,EACtB;QACE,WAAW,EAAE,qGAAqG;QAClH,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,QAAQ,CACb,eAAe,EACf,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC5E;QACE,WAAW,EAAE,kGAAkG;QAC/G,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAkB,CAAC;QAC9C,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,QAAQ,CACb,aAAa,EACb,0BAA0B,EAC1B;QACE,WAAW,EAAE,mEAAmE;QAChF,QAAQ,EAAE,eAAe;KAC1B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,eAAe;oBACzB,IAAI,EAAE,iBAAiB;iBACxB,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwHzB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,SAAS,eAAe;IACtB,8BAA8B;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACtD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAKD;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAuB,EAAE,WAAyB;IAEjG,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACT,cAAc,EACd,qWAAqW,EACrW,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,2fAA2f,EAC3f;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;QACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gIAAgI,CAAC;KAChK,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAIhE,CAAC;QAEF,yCAAyC;QACzC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,QAAQ;wBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;qBACxD,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf;;;sYAGkY,EAClY;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACtF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;KAC7G,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAIF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,qNAAqN,EACrN;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAChE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,uJAAuJ,EACvJ;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACvE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAClE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,mEAAmE;IACnE,2DAA2D;IAE3D,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,uUAAuU,EACvU;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;KACxF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAwB,CAAC;QAE1F,kEAAkE;QAClE,OAAO,MAAM,CAAC,cAAc,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC;QAE5B,6DAA6D;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;QAC1D,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE3C,2DAA2D;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY;eACxC,MAAM,CAAC,YAAY;eACnB,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAE5E,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,GAAG;wBACH,KAAK;wBACL,QAAQ;wBACR,UAAU,EAAE,GAAG,UAAU,KAAK;wBAC9B,YAAY;wBACZ,IAAI,EAAE,uKAAuK;qBAC9K,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,mSAAmS,EACnS;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAMnE,CAAC;QAEF,kEAAkE;QAClE,OAAO,MAAM,CAAC,cAAc,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC;QAE5B,+CAA+C;QAC/C,IAAI,UAAU,GAA4B,MAAM,CAAC;QACjD,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,OAAO,UAAU,CAAC,QAAQ,CAAC;gBAC3B,OAAO,UAAU,CAAC,cAAc,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC5B,OAAO,UAAU,CAAC,MAAM,CAAC;gBACzB,OAAO,UAAU,CAAC,cAAc,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACjD,OAAO,UAAU,CAAC,MAAM,CAAC;gBACzB,OAAO,UAAU,CAAC,QAAQ,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;QAC1D,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE3C,2DAA2D;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAE5E,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,QAAQ;wBACR,UAAU,EAAE,GAAG,UAAU,KAAK;wBAC9B,MAAM,EAAE;4BACN,MAAM,EAAE,UAAU;4BAClB,QAAQ,EAAE,SAAS;4BACnB,cAAc,EAAE,UAAU;4BAC1B,WAAW,EAAE,KAAK,IAAI,KAAK;yBAC5B;wBACD,IAAI,EAAE,0JAA0J;qBACjK,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,+JAA+J,EAC/J,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,UAAU,EACV,wEAAwE,EACxE;QACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC1D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;KAC/G,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,mFAAmF,EACnF;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACpE,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,+DAA+D,EAC/D;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACzD,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,0RAA0R,EAC1R;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;KACvF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,sEAAsE;QACtE,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,mJAAmJ,EACnJ;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC1F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;KAC3H,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAI/D,CAAC;QAEF,gCAAgC;QAChC,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC1E,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE3D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,QAAQ,EAAE,QAAQ;wBAClB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;qBACtB,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,yNAAyN,EACzN;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACtF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAGF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,+LAA+L,EAC/L;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACtF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,6MAA6M,EAC7M;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QACtF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAC5E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;KACzF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACT,cAAc,EACd,4TAA4T,EAC5T;QACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;KACrG,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACtB,4BAA4B;QAC5B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAK/D,CAAC;QAEH,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,4CAA4C;YAC5C,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;YAEzD,gDAAgD;YAChD,IAAI,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;iBACvC,WAAW,EAAE;iBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;iBAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;iBACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEzB,2EAA2E;YAC3E,IAAI,QAAQ,GAAG,GAAG,QAAQ,GAAG,OAAO,EAAE,CAAC;YACvC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrC,QAAQ,GAAG,GAAG,QAAQ,IAAI,QAAQ,GAAG,OAAO,EAAE,CAAC;YACjD,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YAE5C,0DAA0D;YAC1D,IAAI,WAAW;gBAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACpD,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;YAC/B,YAAY,EAAE,CAAC;QACjB,CAAC;QAED,gCAAgC;QAChC,MAAM,YAAY,GAAG,GAAG,SAAS,4BAA4B,CAAC;QAC9D,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAExE,6CAA6C;QAC7C,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,SAAS;wBACT,YAAY;wBACZ,YAAY;wBACZ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;qBACtE,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAGF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,uhBAAuhB,EACvhB;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;QAClH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;QAChI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;KACpH,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAQ,CAAC;QAElF,8CAA8C;QAC9C,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC/F,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAE3B,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEnE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;qBAC9C,WAAW,EAAE;qBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;qBAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;qBACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;gBACrC,kFAAkF;gBAClF,IAAI,OAAO,GAAG,SAAS,CAAC;gBACxB,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;oBACpE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;gBACxE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE1C,MAAM,QAAQ,GAAwB,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;gBAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACpC,sEAAsE;oBACtE,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;yBAC3D,WAAW,EAAE;yBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;yBAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;yBACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;oBAEtC,qDAAqD;oBACrD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;wBAChB,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;4BAAE,OAAO,EAAE,CAAC;wBAC5D,UAAU,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;oBAC1C,CAAC;oBACD,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAE1B,qCAAqC;oBACrC,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;oBAEjH,sEAAsE;oBACtE,gEAAgE;oBAChE,MAAM,EAAE,GAAG,GAAG,CAAC,oBAAoB,IAAI,EAAS,CAAC;oBACjD,MAAM,SAAS,GAAa,EAAE,CAAC;oBAC/B,SAAS,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC1F,MAAM,UAAU,GAAyB;wBACvC,CAAC,sBAAsB,EAAE,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC;wBACvD,CAAC,kBAAkB,EAAE,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;wBAC/C,CAAC,uBAAuB,EAAE,EAAE,CAAC,qBAAqB,IAAI,EAAE,CAAC;wBACzD,CAAC,6BAA6B,EAAE,EAAE,CAAC,2BAA2B,IAAI,EAAE,CAAC;wBACrE,CAAC,uBAAuB,EAAE,EAAE,CAAC,qBAAqB,IAAI,EAAE,CAAC;wBACzD,CAAC,kBAAkB,EAAE,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;qBAChD,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACnB,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;4BAC7B,KAAK,MAAM,IAAI,IAAI,GAAG;gCAAE,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC9D,CAAC;oBACH,CAAC;oBACD,IAAI,EAAE,CAAC,eAAe;wBAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;oBACvF,IAAI,EAAE,CAAC,qBAAqB;wBAAE,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBAEzG,4EAA4E;oBAC5E,yEAAyE;oBACzE,8EAA8E;oBAC9E,wEAAwE;oBACxE,gFAAgF;oBAChF,sEAAsE;oBACtE,IAAI,aAAa,GAAG,KAAK,CAAC;oBAC1B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;wBACnB,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;4BACxD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;4BAC1E,aAAa,GAAG,IAAI,CAAC;wBACvB,CAAC;wBAAC,MAAM,CAAC;4BACP,YAAY;wBACd,CAAC;oBACH,CAAC;oBAED,MAAM,KAAK,GAAG;wBACZ,KAAK;wBACL,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;wBACzB,gBAAgB,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE;wBAC3C,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;wBAC7B,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;wBACnC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;wBAC3D,SAAS,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,SAAS,CAAC,EAAE;wBAC/C,YAAY,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,IAAI,SAAS,CAAC,EAAE;wBACrD,kBAAkB,GAAG,CAAC,SAAS,EAAE,aAAa,IAAI,KAAK,EAAE;wBACzD,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;wBAC7B,cAAc,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;wBACvC,eAAe,GAAG,CAAC,UAAU,EAAE;wBAC/B,uBAAuB;wBACvB,GAAG,SAAS;wBACZ,KAAK;wBACL,EAAE;wBACF,KAAK,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,EAAE;wBACrC,EAAE;wBACF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B;wBAClG,EAAE;wBACF,aAAa,CAAC,CAAC,CAAC,2BAA2B,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAAE;wBAC5E,EAAE;wBACF,yBAAyB;wBACzB,OAAO;wBACP,yCAAyC,GAAG,CAAC,KAAK,KAAK;wBACvD,KAAK;wBACL,EAAE;qBACH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAE7B,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;oBAEvE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG;wBACpB,IAAI,EAAE,GAAG,UAAU,SAAS;wBAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,aAAa,CACX,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACzG,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAGF,uEAAuE;IAGvE,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,KAAK,oBAAoB;YAAE,OAAO;QAE1C,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;YACnE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,CAAC,UAAU,IAAI,QAAQ,IAAI,SAAS,CAAC;iBACnD,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;YACxE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1C,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC;iBACnE,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;YACpF,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;YAE1E,mBAAmB;YACnB,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACpD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;oBAC1E,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAED,eAAe;YACf,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC;YAC9G,MAAM,EAAE,GAAG,SAAS,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAChD,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,cAAc;gBAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACpF,IAAI,EAAE,CAAC,oBAAoB,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/H,IAAI,EAAE,CAAC,gBAAgB,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnH,IAAI,EAAE,CAAC,qBAAqB,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClI,IAAI,EAAE,CAAC,2BAA2B,EAAE,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpJ,IAAI,EAAE,CAAC,eAAe;gBAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,EAAE,CAAC,qBAAqB;gBAAE,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAEzG,MAAM,KAAK,GAAG;gBACZ,KAAK;gBACL,UAAU,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBAC/B,gBAAgB,EAAE,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE;gBACjD,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBACnC,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;gBACzC,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;gBACjE,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;gBACzC,cAAc,EAAE,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;gBAC7C,aAAa,CAAC,CAAC,CAAC,gBAAgB,UAAU,kBAAkB,CAAC,CAAC,CAAC,IAAI;gBACnE,uBAAuB;gBACvB,GAAG,SAAS;gBACZ,KAAK;gBACL,EAAE;gBACF,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC1E,EAAE;aACH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE7B,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAEvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,UAAU,wBAAwB,aAAa,KAAK,CAAC,CAAC;QAC7H,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAuB;IAEpF,uEAAuE;IAEvE,MAAM,CAAC,QAAQ,CACb,cAAc,EACd,sBAAsB,EACtB;QACE,WAAW,EAAE,qGAAqG;QAClH,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,QAAQ,CACb,eAAe,EACf,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC5E;QACE,WAAW,EAAE,kGAAkG;QAC/G,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAkB,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,QAAQ,CACb,aAAa,EACb,0BAA0B,EAC1B;QACE,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,eAAe;KAC1B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,eAAe;oBACzB,IAAI,EAAE,yQAAyQ;iBAChR,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,QAAQ,CACb,wBAAwB,EACxB,qCAAqC,EACrC;QACE,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,eAAe;KAC1B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,eAAe;oBACzB,IAAI,EAAE,sBAAsB;iBAC7B,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,QAAQ,CACb,yBAAyB,EACzB,sCAAsC,EACtC;QACE,WAAW,EAAE,qFAAqF;QAClG,QAAQ,EAAE,eAAe;KAC1B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,eAAe;oBACzB,IAAI,EAAE,uBAAuB;iBAC9B,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAGD,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkH9B,CAAC;AAEF,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmO/B,CAAC"}

package.json

 {
   "name": "@customaise/mcp",
-  "version": "1.1.1",
-  "description": "MCP server that connects AI coding agents (Cursor, Claude Code, Codex, Windsurf, Kiro, Antigravity) to the Customaise Chrome extension for userscript management and browser automation.",
+  "version": "1.2.0",
+  "description": "MCP server bridging AI coding agents (Cursor, Claude Code, Codex, Windsurf, Kiro, Antigravity) to the Customaise Chrome extension. 18 tools: UserScripts, AgentScripts, WebMCP calls with HITL consent, visual DOM targeting, tab control.",
   "type": "module",
@@ -12,3 +12,5 @@ "main": "dist/index.js",
     "dist/",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
   ],
@@ -26,2 +28,6 @@ "scripts": {
     "userscripts",
+    "agentscripts",
+    "webmcp",
+    "hitl",
+    "human-in-the-loop",
     "chrome-extension",
@@ -38,3 +44,3 @@ "browser-automation",
   ],
-  "author": "Customaise",
+  "author": "CNDLE Studio LTD",
   "license": "MIT",
@@ -41,0 +47,0 @@ "homepage": "https://customaise.com",

README.md

 # @customaise/mcp
 
-MCP server that connects AI coding agents to the [Customaise](https://customaise.com) Chrome extension for userscript management, visual DOM targeting, and browser automation.
+MCP server that connects AI coding agents to the [Customaise](https://customaise.com) Chrome extension. Manage UserScripts, build AgentScripts, call WebMCP tools inside the user's signed-in browser session, select DOM elements visually, and drive tabs directly from your IDE.
 
+**18 tools, 5 resources, WebSocket bridge** between your IDE and a real Chrome session.
+
 ```
@@ -83,6 +85,6 @@ AI Agent ←(stdio)→ MCP Server ←(WebSocket)→ Customaise Extension
 
-### 3. Done!
-Your AI agent can now manage userscripts, visually target DOM elements, inspect browser pages, and take screenshots — all through natural language.
+### 3. Done
+Your agent can now read and edit UserScripts, build AgentScripts that expose WebMCP tools to it, select DOM elements visually, inspect the console, and take screenshots of the live tab.
 
-## Available Tools (13)
+## Tools (18)
 
@@ -92,5 +94,5 @@ ### Script Lifecycle
 |------|-------------|
-| `list_scripts` | List all managed userscripts |
+| `list_scripts` | List every script (UserScripts and AgentScripts) managed by the extension |
 | `import_script` | Pull a script to a local file for editing |
-| `export_script` | Push a local file to Customaise (validates + installs) |
+| `export_script` | Push a local file to Customaise (validates and installs) |
 | `delete_script` | Permanently delete a script |
@@ -103,29 +105,66 @@ | `toggle_script` | Enable or disable a script |
 | `get_page_context` | DOM snapshot of the current page |
-| `get_console_context` | Console logs, errors, and GM_log output |
+| `get_console_context` | Console logs, errors, and `GM_log` output |
 | `list_tabs` | List all open browser tabs |
 
-### Visual DOM Targeting
+### Tab Control
 | Tool | Description |
 |------|-------------|
-| `get_selected_elements` | Get DOM elements the user has visually selected in the browser, with bulletproof selectors and screenshots |
+| `open_tab` | Open a new tab at a given URL |
+| `close_tab` | Close a tab by ID |
+| `focus_tab` | Switch focus to a tab by ID |
+| `reload_tab` | Reload a tab to re-inject scripts |
 
-### Testing & Verification
+### Visual DOM Targeting
 | Tool | Description |
 |------|-------------|
-| `reload_tab` | Reload a tab to re-inject scripts |
-| `take_screenshot` | Capture a screenshot of the visible tab with optional element highlighting |
+| `get_selected_elements` | Get the DOM elements the user has visually selected, with bulletproof selectors and screenshots |
+| `take_screenshot` | Capture the visible tab, optionally highlighting specific elements |
 
-### UI Control
+### WebMCP Agent Tools
 | Tool | Description |
 |------|-------------|
-| `toggle_ui` | Show or hide the Customaise UI overlay |
+| `list_webmcp_tools` | List the WebMCP tools currently registered on a tab by AgentScripts |
+| `call_webmcp_tool` | Call a WebMCP tool; prompt-gated tools block on user consent (see below) |
 
-### Batch Operations
+### UI Control & Batch
 | Tool | Description |
 |------|-------------|
+| `toggle_ui` | Show or hide the Customaise UI overlay |
 | `sync_scripts` | Bulk export all scripts to a local directory |
 
+## Resources (5)
+
+Five resources any connected agent can read via `resources/read`. The two conventions handbooks define exactly how Customaise expects UserScripts and AgentScripts to be written. Agents should read the relevant handbook before touching a script.
+
+| URI | Description |
+|-----|-------------|
+| `customaise://scripts` | Live JSON list of every script the extension manages (ID, name, enabled state, match patterns, shared flag) |
+| `customaise://scripts/{scriptId}` | Full source and metadata for a specific script |
+| `customaise://conventions` | Points at the right handbook for the script type you're working on |
+| `customaise://userscript-conventions` | Full UserScript reference: file structure, IIFE pattern, `GM_*` APIs, symbol-level editing, `@match` and `@namespace` rules |
+| `customaise://agentscript-conventions` | Full AgentScript reference: the `// ==AgentScript==` block, `// @webmcp <tool> <permission>` declarations, `navigator.modelContext.registerTool()`, consent model |
+
+## WebMCP Tool Calls & Consent (HITL)
+
+AgentScripts register tools on web pages via `navigator.modelContext.registerTool(...)`. Each tool is declared in the AgentScript's `// @webmcp <toolName> <permission>` header with one of three permissions:
+
+- **`allow`**: tool executes immediately. ~50 to 100ms round-trip per call (the extension still runs permission checks).
+- **`prompt`**: every call surfaces an in-browser consent modal and blocks until the user approves or denies. Up to **5 minutes**. Design for this. Don't chain prompt-gated calls in tight loops, and treat a long `call_webmcp_tool` as normal.
+- **`deny`**: tool is suppressed and calls fail immediately.
+
+"Always allow" and "Always deny" buttons on the consent modal persist the decision per-script per-tool until the user resets it in extension Settings. These overrides live in `chrome.storage.local` on the user's device; the MCP server has no visibility into them.
+
+### Remote approvals (optional)
+
+If the user has Power User and has enabled Remote HITL Approvals on their Customaise account page, prompt-gated calls are also mirrored there. They can approve or deny from any signed-in browser, including a phone. Either the extension modal or the remote surface can resolve; first signed decision wins. From the MCP client's perspective this is transparent: `call_webmcp_tool` simply returns the result when any authorised surface approves, or an error if denied or timed out.
+
+### What MCP clients see
+
+- A prompt-gated `call_webmcp_tool` response may take up to 5 minutes. Surface a pending state to the end user rather than timing out aggressively.
+- If the user denies, `call_webmcp_tool` returns an error. The MCP server does not retry.
+- Tool-call arguments transit HTTPS in plaintext to our backend and land **KMS-encrypted at rest** in Firestore. Metadata (toolName, scriptName, origin) stays plaintext. See the Customaise [Privacy Policy](https://customaise.com/privacy).
+
 ## Visual DOM Selection
 
-Users can visually select elements in the browser, and the extension automatically pushes context files to your workspace in real-time:
+Users can visually select elements in the browser, and the extension pushes context files to your workspace in real time:
 
@@ -139,7 +178,7 @@ ```
 
-> [!NOTE] 
+> [!NOTE]
 > **Where are the files saved?**
-> The MCP server writes the `.customaise` folder to its current working directory (usually your open project root in Cursor or Windsurf). 
-> If you are using a global IDE like Claude Desktop, it will default to your Home directory (`~/.customaise`). To force the files to save in a specific project folder, add the `CUSTOMAISE_WORKSPACE` environment variable to your MCP config:
-> 
+> The MCP server writes `.customaise/` to its current working directory (usually your project root in Cursor or Windsurf).
+> If you are using a global IDE like Claude Desktop, it defaults to your home directory (`~/.customaise/`). To force a specific project folder, set `CUSTOMAISE_WORKSPACE` in your MCP config:
+>
 > ```json
@@ -149,21 +188,35 @@ > "env": { "CUSTOMAISE_WORKSPACE": "/absolute/path/to/your/project" }
 
-Use `get_selected_elements` to retrieve selections programmatically, or read the auto-pushed `.dom.md` files directly from the workspace.
+Use `get_selected_elements` to retrieve selections programmatically, or read the pushed `.dom.md` files directly from the workspace.
 
-Each selection includes **bulletproof tiered selectors** (stable IDs → data attributes → ARIA → semantic classes → structural positioning) for resilient element targeting that survives page updates.
+Each selection includes **bulletproof tiered selectors** (stable IDs → data attributes → ARIA → semantic classes → structural positioning) so targeting survives page updates.
 
-## Typical Workflow
+## Workflows
 
+### UserScript
+
 ```
 1. get_page_context       → understand the target page
 2. User selects elements  → .dom.md files auto-pushed to workspace
-3. Write .user.js file    → AI creates the script using IDE tools
+3. Write .user.js file    → AI writes the script using IDE tools
 4. export_script          → Customaise validates and installs
 5. reload_tab             → re-inject the script
 6. get_console_context    → check for errors
-7. take_screenshot        → verify visual result (with element highlighting)
+7. take_screenshot        → verify the visual result
 ```
 
+### AgentScript
+
+```
+1. Read customaise://agentscript-conventions   → get the structure right before writing
+2. get_page_context                            → find stable selectors on the target page
+3. Write .agent.js file                        → declare tools via // @webmcp, register with navigator.modelContext.registerTool()
+4. export_script                               → Customaise validates and injects
+5. reload_tab                                  → the AgentScript registers its tools in the page
+6. list_webmcp_tools                           → confirm tools surfaced
+7. call_webmcp_tool                            → invoke one; prompt-gated calls wait for user consent
+```
+
 ## File Sync
 
-Use `sync_scripts` to bulk-export all scripts to a local directory:
+Use `sync_scripts` to bulk-export every script to a local directory:
 
@@ -175,4 +228,4 @@ ```
 This creates:
-- **One `.user.js` file per script** — filename is derived from the script name (lowercase, hyphens, e.g. `my-cool-script.user.js`)
-- **`.customaise-manifest.json`** — maps filenames to script IDs for round-trip editing
+- **One `.user.js` file per script.** Filename is derived from the script name (lowercase, hyphens, e.g. `my-cool-script.user.js`).
+- **`.customaise-manifest.json`**: maps filenames to script IDs for round-trip editing.
 
@@ -188,12 +241,12 @@ ### Manifest format
 
-### Round-trip workflow
+### Round-trip
 
-1. `sync_scripts` → exports all scripts to a directory
-2. Edit any `.user.js` file in your IDE
-3. `export_script` with the file path + `scriptId` from the manifest → updates the script
-4. Omit `scriptId` when calling `export_script` → creates a new script instead
+1. `sync_scripts` exports all scripts to a directory.
+2. Edit any `.user.js` file in your IDE.
+3. `export_script` with the file path and `scriptId` from the manifest updates that script.
+4. Omit `scriptId` when calling `export_script` to create a new script instead.
 
 ### File watcher (auto-export)
 
-When `sync_scripts` has been called, the MCP server watches the directory for `.user.js` changes. Saving a file in your IDE automatically pushes it to Customaise — no manual `export_script` call needed.
+Once `sync_scripts` has been called, the MCP server watches the directory for `.user.js` changes. Saving a file in your IDE pushes it to Customaise automatically, no manual `export_script` needed.
 
@@ -205,3 +258,21 @@ ## Configuration
 | `CUSTOMAISE_WS_PORT` | `4050` | WebSocket server port |
+| `CUSTOMAISE_MCP_EXTRA_EXTENSION_IDS` | _(empty)_ | Comma-separated list of extra extension IDs allowed to connect. Needed for unpacked dev builds with a non-standard extension ID |
+| `CUSTOMAISE_MCP_ALLOW_INSECURE` | _(unset)_ | Set to `1` to disable the origin allowlist. **Tests only.** Emits a loud warning at startup |
+| `CUSTOMAISE_WORKSPACE` | _(cwd)_ | Absolute path where `.customaise/` files should be written. Useful for IDEs that don't set cwd to the project root (Claude Desktop, Antigravity) |
 
+## Security Boundary
+
+The MCP server listens on `ws://localhost:4050` in plaintext on your loopback interface. The connection is authenticated by an **HTTP Origin header allowlist**:
+
+- **Allowed**: `chrome-extension://anmpijcpaobaabcdncjjmnhdeibipmko` (production) and `chrome-extension://ijjaffggglamocdapoihpkcpealflopp` (staging). Chrome stamps this header automatically on WebSocket handshakes from extension service workers; you don't configure anything.
+- **Rejected**: regular web pages (`https://...`), unknown extension IDs, and handshakes with no Origin header. Returns HTTP 403.
+
+**What this stops**: a malicious webpage opening `new WebSocket('ws://localhost:4050')` and calling WebMCP tools behind your back. This is the most likely abuse vector.
+
+**What this does NOT stop**: a malicious native process running as your user. Node's `ws` client (and most HTTP libraries) lets callers forge any Origin header. If you can't trust processes running as your OS user, the threat model is already broader than this bridge.
+
+**Defense in depth**: every `prompt`-permissioned tool still requires your explicit approval in the Customaise consent modal before running. Tools declared `allow` run without asking, so only install AgentScripts from sources you trust.
+
+**Dev builds**: if you load an unpacked extension with a custom key, set `CUSTOMAISE_MCP_EXTRA_EXTENSION_IDS=<your-extension-id>` in the MCP server's env.
+
 ## Requirements
@@ -216,15 +287,24 @@
 **"Customaise extension is not connected"**
-- Make sure Chrome is running with the Customaise extension
-- Check that MCP Bridge is enabled in extension Settings
-- The extension connects automatically within a few seconds
+- Make sure Chrome is running with the Customaise extension.
+- Check that MCP Bridge is enabled in extension Settings.
+- The extension connects automatically within a few seconds.
 
 **Port conflict on 4050**
-- Set a different port: `CUSTOMAISE_WS_PORT=4051 npx @customaise/mcp`
+- Set a different port: `CUSTOMAISE_WS_PORT=4051 npx @customaise/mcp`.
 
 **Scripts not running after export**
-- Call `reload_tab` to trigger script re-injection
-- Check `@match` pattern matches the current URL
+- Call `reload_tab` to trigger script re-injection.
+- Check the `@match` pattern covers the current URL.
 
+**`call_webmcp_tool` hangs for minutes**
+- The tool is `prompt`-gated. The user has to approve in the browser, or remotely if Remote HITL Approvals is on. 5-minute budget before auto-deny. Surface a pending state rather than timing out.
+
+**`call_webmcp_tool` returned an error like "consent denied"**
+- Expected when the user denied the modal, the 5-minute budget expired, or a previous "Always deny" override was set on that tool. The user can reset per-tool overrides in extension Settings.
+
+**`list_webmcp_tools` returns empty after a reload**
+- Walk the conventions handbook's troubleshooting checklist. Most common: the global AgentScripts toggle in Customaise Settings is off, or the `@match` pattern doesn't cover the URL. See `customaise://agentscript-conventions` for the full list.
+
 ## License
 
 MIT

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

144216

30.4%

Number of package files

20

11.11%

Lines of code

1528

20.13%

Number of lines in readme file

302

36.04%

Worsened metrics

Number of low supply chain risk alerts

10

66.67%

No dependency changes