@agent-vm/config-contracts 0.0.114 → 0.0.115

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-config.ts","../src/mcp-portal-approval-policy.ts","../src/schema-artifacts.ts","../src/tool-portal-config.ts"],"mappings":";;;iBAsBsB,kBAAA,CAAmB,QAAA,WAAmB,OAAA;;;KCpBhD,aAAA;AAAA,KACA,SAAA,GAAY,SAAA;AAAA,KACZ,UAAA;EAAA,CAAgB,GAAA,WAAc,SAAA;AAAA;AAAA,KAC9B,SAAA,GAAY,SAAA,GAAY,UAAA,GAAa,aAAA;AAAA,cAEpC,eAAA,EAAiB,CAAA,CAAE,OAAA,CAAQ,SAAA;AAAA,cAW3B,gBAAA,EAAkB,CAAA,CAAE,OAAA,CAAQ,UAAA;AAAA,iBAEzB,YAAA,CAAa,KAAA,YAAiB,KAAA,IAAS,UAAA;AAAA,iBAIvC,gBAAA,CAAiB,KAAA,WAAgB,KAAA,WAAgB,UAAA;;;cCtBpD,kBAAA,EAAkB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;cAmClB,iBAAA,EAAiB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;cAKjB,0BAAA,EAA0B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;KAS3B,YAAA,GAAe,CAAA,CAAE,KAAA,QAAa,kBAAA;AAAA,KAC9B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAC7B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,iBAElC,iBAAA,CAAkB,MAAA,EAAQ,oBAAA,EAAsB,QAAA;;;cCDnD,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;cAuBrB,iBAAA,EAAiB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcjB,eAAA,EAAe,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQhB,SAAA,GAAY,CAAA,CAAE,KAAA,QAAa,eAAA;AAAA,KAC3B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAE7B,mBAAA;EAAA,SAEA,mBAAA;EAAA,SACA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SACjC,SAAA;EAAA,SACA,SAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,mBAAA;EAAA,SACA,GAAA;EAAA,SACA,GAAA,EAAK,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SAC7B,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGU,aAAA,CAAc,UAAA,WAAqB,OAAA,CAAQ,SAAA;AAAA,iBAIjD,4BAAA,CAA6B,MAAA,EAAQ,SAAA,YAAqB,mBAAA;;;cCvH7D,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;KAOvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,cAEjC,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;KAOzB,kBAAA,GAAqB,CAAA,CAAE,KAAA,QAAa,wBAAA;AAAA,cAEnC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAmCrC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6BjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiB/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;;;;;;;KAM5B,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAS5C,oBAAA,EAAoB,CAAA,CAAA,SAAA;;;;;;;;;KAwBrB,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,oBAAA;AAAA,cAErC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;KAQ3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAoB7B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,qBAAA;AAAA,KAChC,eAAA,GAAkB,IAAA,CAAK,qBAAA;EAAA,SACzB,MAAA,EAAQ,QAAA,CAAS,MAAA,SAAe,oBAAA;AAAA;AAAA,cAG7B,mCAAA,EAAmC,CAAA,CAAA,SAAA;;;;KAOpC,6BAAA,GAAgC,CAAA,CAAE,KAAA,QAAa,mCAAA;AAAA,iBAcrC,mBAAA,CAAoB,UAAA,WAAqB,OAAA,CAAQ,eAAA;AAAA,iBA2FvD,uBAAA,CACf,MAAA,EAAQ,eAAA,EACR,WAAA,WACE,wBAAA;AAAA,iBAQa,iCAAA,CAAkC,MAAA,EAAQ,WAAA;;;UCxUzC,gCAAA;EAAA,SACP,eAAA;EAAA,SACA,YAAA;AAAA;AAAA,UAGO,yBAAA;EAAA,SACP,WAAA,GAAc,gCAAA;EAAA,SACd,SAAA;EAAA,SACA,QAAA;AAAA;AAAA,KAyCE,2BAAA;EAAA,SACE,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;AAAA,iBAEE,2BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA,GACJ,2BAAA;AAAA,iBAqBa,6BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA;;;cC5EM,6BAAA;EAAA;;;;cAMA,wBAAA;EAAA;;;;cAMA,0BAAA;EAAA;;;;UAMI,6BAAA;EAAA,SACP,GAAA,EAAK,MAAA;EAAA,SACL,SAAA,EAAW,MAAA;EAAA,SACX,UAAA,EAAY,MAAA;AAAA;AAAA,iBAUN,mCAAA,CAAA,GAAuC,6BAAA;;;cCjC1C,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;KAO7B,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAAa,4BAAA;AAAA,cAEvC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;KAgB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,8BAAA,EAA8B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;KAM/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;KAQjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,iCAAA,EAAiC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAMlC,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,iCAAA;AAAA,cAE5C,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;KAM5B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAEtC,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,iBAExB,oBAAA,CAAqB,UAAA,WAAqB,OAAA,CAAQ,gBAAA;AAAA,cAI3D,sCAAA,EAAsC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;KAOvC,gCAAA,GAAmC,CAAA,CAAE,KAAA,QACzC,sCAAA;AAAA,cAGK,6BAAA,EAA6B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;KAQ9B,uBAAA,GAA0B,CAAA,CAAE,KAAA,QAAa,6BAAA;AAAA,cAExC,uDAAA,EAAuD,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;KAGxD,iDAAA,GAAoD,CAAA,CAAE,KAAA,QAC1D,uDAAA;AAAA,cAGK,8CAAA,EAA8C,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;KAW/C,wCAAA,GAA2C,CAAA,CAAE,KAAA,QACjD,8CAAA;AAAA,UAGS,kCAAA;EAAA,SACP,OAAA;EAAA,SACA,MAAA,EAAQ,gBAAA;AAAA;AAAA,iBAGF,6BAAA,CACf,KAAA,EAAO,kCAAA,GACL,uBAAA;AAAA,UAgCc,mDAAA;EAAA,SACP,OAAA;EAAA,SACA,MAAA,EAAQ,gBAAA;AAAA;AAAA,iBAGF,8CAAA,CACf,KAAA,EAAO,mDAAA,GACL,wCAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-config.ts","../src/mcp-portal-approval-policy.ts","../src/schema-artifacts.ts","../src/tool-portal-config.ts"],"mappings":";;;iBAsBsB,kBAAA,CAAmB,QAAA,WAAmB,OAAA;;;KCpBhD,aAAA;AAAA,KACA,SAAA,GAAY,SAAA;AAAA,KACZ,UAAA;EAAA,CAAgB,GAAA,WAAc,SAAA;AAAA;AAAA,KAC9B,SAAA,GAAY,SAAA,GAAY,UAAA,GAAa,aAAA;AAAA,cAEpC,eAAA,EAAiB,CAAA,CAAE,OAAA,CAAQ,SAAA;AAAA,cAW3B,gBAAA,EAAkB,CAAA,CAAE,OAAA,CAAQ,UAAA;AAAA,iBAEzB,YAAA,CAAa,KAAA,YAAiB,KAAA,IAAS,UAAA;AAAA,iBAIvC,gBAAA,CAAiB,KAAA,WAAgB,KAAA,WAAgB,UAAA;;;cCtBpD,kBAAA,EAAkB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;cAmClB,iBAAA,EAAiB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;cAKjB,0BAAA,EAA0B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;KAS3B,YAAA,GAAe,CAAA,CAAE,KAAA,QAAa,kBAAA;AAAA,KAC9B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAC7B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,iBAElC,iBAAA,CAAkB,MAAA,EAAQ,oBAAA,EAAsB,QAAA;;;cCDnD,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;cAuBrB,iBAAA,EAAiB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcjB,eAAA,EAAe,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQhB,SAAA,GAAY,CAAA,CAAE,KAAA,QAAa,eAAA;AAAA,KAC3B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAE7B,mBAAA;EAAA,SAEA,mBAAA;EAAA,SACA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SACjC,SAAA;EAAA,SACA,SAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,mBAAA;EAAA,SACA,GAAA;EAAA,SACA,GAAA,EAAK,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SAC7B,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGU,aAAA,CAAc,UAAA,WAAqB,OAAA,CAAQ,SAAA;AAAA,iBAIjD,4BAAA,CAA6B,MAAA,EAAQ,SAAA,YAAqB,mBAAA;;;cCvH7D,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;KAOvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,cAEjC,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;KAOzB,kBAAA,GAAqB,CAAA,CAAE,KAAA,QAAa,wBAAA;AAAA,cAEnC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAmCrC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6BjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiB/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;;;;;;;KAM5B,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAS5C,oBAAA,EAAoB,CAAA,CAAA,SAAA;;;;;;;;;KAwBrB,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,oBAAA;AAAA,cAErC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;KAQ3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAoB7B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,qBAAA;AAAA,KAChC,eAAA,GAAkB,IAAA,CAAK,qBAAA;EAAA,SACzB,MAAA,EAAQ,QAAA,CAAS,MAAA,SAAe,oBAAA;AAAA;AAAA,cAG7B,mCAAA,EAAmC,CAAA,CAAA,SAAA;;;;KAOpC,6BAAA,GAAgC,CAAA,CAAE,KAAA,QAAa,mCAAA;AAAA,iBAcrC,mBAAA,CAAoB,UAAA,WAAqB,OAAA,CAAQ,eAAA;AAAA,iBA2FvD,uBAAA,CACf,MAAA,EAAQ,eAAA,EACR,WAAA,WACE,wBAAA;AAAA,iBAQa,iCAAA,CAAkC,MAAA,EAAQ,WAAA;;;UCxUzC,gCAAA;EAAA,SACP,eAAA;EAAA,SACA,YAAA;AAAA;AAAA,UAGO,yBAAA;EAAA,SACP,WAAA,GAAc,gCAAA;EAAA,SACd,SAAA;EAAA,SACA,QAAA;AAAA;AAAA,KAyCE,2BAAA;EAAA,SACE,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;AAAA,iBAEE,2BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA,GACJ,2BAAA;AAAA,iBAqBa,6BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA;;;cC5EM,6BAAA;EAAA;;;;cAMA,wBAAA;EAAA;;;;cAMA,0BAAA;EAAA;;;;UAMI,6BAAA;EAAA,SACP,GAAA,EAAK,MAAA;EAAA,SACL,SAAA,EAAW,MAAA;EAAA,SACX,UAAA,EAAY,MAAA;AAAA;AAAA,iBAUN,mCAAA,CAAA,GAAuC,6BAAA;;;cChC1C,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;KAO7B,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAAa,4BAAA;AAAA,cAEvC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;KAgB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,2BAAA,EAA2B,CAAA,CAAA,OAAA;;;;;cAiC3B,6CAAA,EAA6C,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4D9C,uCAAA,GAA0C,CAAA,CAAE,KAAA,QAChD,6CAAA;AAAA,cAGK,wCAAA,EAAwC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAYzC,kCAAA,GAAqC,CAAA,CAAE,KAAA,QAC3C,wCAAA;AAAA,cAGK,8BAAA,EAA8B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAM/B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,KACvC,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,+BAAA,EAA+B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQhC,yBAAA,GAA4B,CAAA,CAAE,KAAA,QAAa,+BAAA;AAAA,cAE1C,iCAAA,EAAiC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAMlC,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,iCAAA;AAAA,cAE5C,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;KAM5B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAEtC,6CAAA,EAA6C,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;KAQ9C,uCAAA,GAA0C,CAAA,CAAE,KAAA,QAChD,6CAAA;AAAA,cAGK,wCAAA,EAAwC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;KAMzC,kCAAA,GAAqC,CAAA,CAAE,KAAA,QAC3C,wCAAA;AAAA,cAGK,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;KAO/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAezC,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;;;;;;;;;;KAW/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,6BAAA,EAA6B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;KAY9B,uBAAA,GAA0B,CAAA,CAAE,KAAA,QAAa,6BAAA;AAAA,cAExC,+BAAA,EAA+B,CAAA,CAAA,SAAA;;;;;;;KAYhC,yBAAA,GAA4B,CAAA,CAAE,KAAA,QAAa,+BAAA;AAAA,cAE1C,qCAAA,EAAqC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQtC,+BAAA,GAAkC,CAAA,CAAE,KAAA,QAAa,qCAAA;AAAA,cAShD,6BAAA,EAA6B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAO9B,uBAAA,GAA0B,CAAA,CAAE,KAAA,QAAa,6BAAA;AAAA,cAExC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,sBAAA,EAAsB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiHvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,iBAExB,oBAAA,CAAqB,UAAA,WAAqB,OAAA,CAAQ,gBAAA;AAAA,cAI3D,sCAAA,EAAsC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;KAOvC,gCAAA,GAAmC,CAAA,CAAE,KAAA,QACzC,sCAAA;AAAA,cAGK,6BAAA,EAA6B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;KAQ9B,uBAAA,GAA0B,CAAA,CAAE,KAAA,QAAa,6BAAA;AAAA,cAExC,uDAAA,EAAuD,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;KAGxD,iDAAA,GAAoD,CAAA,CAAE,KAAA,QAC1D,uDAAA;AAAA,cAGK,8CAAA,EAA8C,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;KAW/C,wCAAA,GAA2C,CAAA,CAAE,KAAA,QACjD,8CAAA;AAAA,UAGS,kCAAA;EAAA,SACP,OAAA;EAAA,SACA,MAAA,EAAQ,gBAAA;AAAA;AAAA,iBAGF,6BAAA,CACf,KAAA,EAAO,kCAAA,GACL,uBAAA;AAAA,UAgCc,mDAAA;EAAA,SACP,OAAA;EAAA,SACA,MAAA,EAAQ,gBAAA;AAAA;AAAA,iBAGF,8CAAA,CACf,KAAA,EAAO,mDAAA,GACL,wCAAA"}

package/dist/index.js

@@ -365,24 +365,134 @@ const toolPortalCallPolicySchema = z.object({
 		path: ["withoutApproval"]
 	});
 });
+const toolPortalBackendKindSchema = z.enum([
+	"mcp_provider",
+	"controller_host_action",
+	"tool_vm_runner"
+]);
+const sandboxOperationDescriptionSchema = z.string().min(1);
+const sandboxExecutableSchema = z.string().min(1).refine((value) => value.startsWith("/") && !value.includes("\0"), { message: "Sandbox command executables must be absolute and contain no NUL bytes." });
+const sandboxMandatoryArgvPrefixSchema = z.array(z.string().max(4096).refine((value) => !value.includes("\0"), { message: "Sandbox command arguments must contain no NUL bytes." })).max(64);
+const sandboxWorkingDirectorySchema = z.string().min(1).refine((value) => !value.includes("\0") && !value.startsWith("/") && !value.split("/").includes(".."), { message: "Sandbox command working directories must stay relative to the Tool VM work root." });
+const toolPortalSandboxSshOperationDefinitionSchema = z.discriminatedUnion("kind", [
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		executable: sandboxExecutableSchema,
+		kind: z.literal("command.fixed"),
+		mandatoryArgvPrefix: sandboxMandatoryArgvPrefixSchema,
+		workingDirectory: sandboxWorkingDirectorySchema
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		kind: z.literal("filesystem.read")
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		kind: z.literal("filesystem.write")
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		kind: z.literal("process.cancel")
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		kind: z.literal("process.logs")
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		executable: sandboxExecutableSchema,
+		kind: z.literal("process.start"),
+		mandatoryArgvPrefix: sandboxMandatoryArgvPrefixSchema,
+		maxRuntimeMs: z.number().int().positive().max(36e5),
+		retainOutputBytes: z.number().int().positive().max(16777216),
+		workingDirectory: sandboxWorkingDirectorySchema
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		kind: z.literal("process.status")
+	}).strict(),
+	z.object({
+		description: sandboxOperationDescriptionSchema,
+		kind: z.literal("process.wait"),
+		timeoutMs: z.number().int().positive().max(36e5)
+	}).strict()
+]);
+const toolPortalSandboxSshBackendBindingSchema = z.object({
+	kind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	operations: z.record(z.string().min(1), toolPortalSandboxSshOperationDefinitionSchema).refine((operations) => Object.keys(operations).length > 0, { message: "Tool VM runner bindings must configure at least one operation." }),
+	profile: z.literal("sandbox_ssh")
+}).strict();
 const toolPortalBackendBindingSchema = z.discriminatedUnion("kind", [
-	z.object({ kind: z.literal("mcp_provider") }).strict(),
-	z.object({ kind: z.literal("controller_host_action") }).strict(),
-	z.object({ kind: z.literal("tool_vm_runner") }).strict()
+	z.object({ kind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider) }).strict(),
+	z.object({ kind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action) }).strict(),
+	toolPortalSandboxSshBackendBindingSchema
 ]);
-const toolPortalCapabilityPolicySchema = z.object({
+const toolPortalNamespacePolicySchema = z.object({
 	backend: toolPortalBackendBindingSchema,
 	calls: toolPortalCallPolicySchema,
 	tools: toolPortalToolSelectorSchema
 }).strict();
-const toolPortalProfileDefinitionSchema = z.object({ capabilities: z.record(z.string().min(1), toolPortalCapabilityPolicySchema).default({}) }).strict();
+const toolPortalProfileDefinitionSchema = z.object({ namespaces: z.record(z.string().min(1), toolPortalNamespacePolicySchema).default({}) }).strict();
 const toolPortalAgentConfigSchema = z.object({ profile: z.string().min(1) }).strict();
-const toolPortalConfigSchema = z.object({
+const toolPortalStandaloneAgentAuthenticationSchema = z.object({
+	approvalHmacKey: secretValueSchema,
+	bearerKey: secretValueSchema,
+	credentialVersion: z.number().int().positive()
+}).strict();
+const toolPortalStandaloneAuthenticationSchema = z.object({ agents: z.record(z.string().min(1), toolPortalStandaloneAgentAuthenticationSchema) }).strict();
+const toolPortalNetworkAddressSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535)
+}).strict();
+const toolPortalBearerEntrypointAuthenticationSchema = z.object({ kind: z.literal("bearer") }).strict();
+const toolPortalEntrypointRouteSchema = z.string().min(1).refine((route) => route.startsWith("/"), { message: "Tool Portal entrypoint routes must start with \"/\"." });
+const toolPortalHttpEntrypointSchema = z.object({
+	address: toolPortalNetworkAddressSchema,
+	allowedHosts: z.array(z.string().min(1)).min(1),
+	allowedOrigins: z.array(z.string().url()),
+	authentication: toolPortalBearerEntrypointAuthenticationSchema,
+	enabled: z.literal(true),
+	route: toolPortalEntrypointRouteSchema
+}).strict();
+const toolPortalMcpEntrypointSchema = z.object({
+	address: toolPortalNetworkAddressSchema,
+	allowedHosts: z.array(z.string().min(1)).min(1),
+	allowedOrigins: z.array(z.string().url()),
+	authentication: toolPortalBearerEntrypointAuthenticationSchema,
+	enabled: z.literal(true),
+	route: toolPortalEntrypointRouteSchema,
+	transport: z.literal("streamable-http")
+}).strict();
+const toolPortalStdioEntrypointSchema = z.object({
+	authentication: z.object({
+		agentId: z.string().min(1),
+		kind: z.literal("scoped-principal")
+	}).strict(),
+	enabled: z.literal(true)
+}).strict();
+const toolPortalStandaloneEntrypointsSchema = z.object({
+	http: toolPortalHttpEntrypointSchema.optional(),
+	mcp: toolPortalMcpEntrypointSchema.optional(),
+	stdio: toolPortalStdioEntrypointSchema.optional()
+}).strict();
+const toolPortalCommonConfigShape = {
 	$schema: z.string().min(1).optional(),
-	schemaVersion: z.literal(1),
 	agents: z.record(z.string().min(1), toolPortalAgentConfigSchema).default({}),
-	profiles: z.record(z.string().min(1), toolPortalProfileDefinitionSchema)
-}).strict().superRefine((config, context) => {
+	profiles: z.record(z.string().min(1), toolPortalProfileDefinitionSchema),
+	schemaVersion: z.literal(1)
+};
+const managedToolPortalConfigSchema = z.object({
+	...toolPortalCommonConfigShape,
+	mode: z.literal("managed")
+}).strict();
+const standaloneToolPortalConfigSchema = z.object({
+	...toolPortalCommonConfigShape,
+	authentication: toolPortalStandaloneAuthenticationSchema,
+	drain: z.object({ timeoutMs: z.number().int().positive() }).strict(),
+	entrypoints: toolPortalStandaloneEntrypointsSchema,
+	mode: z.literal("standalone")
+}).strict();
+const toolPortalConfigSchema = z.discriminatedUnion("mode", [managedToolPortalConfigSchema, standaloneToolPortalConfigSchema]).superRefine((config, context) => {
 	if (Object.keys(config.profiles).length === 0) context.addIssue({
 		code: z.ZodIssueCode.custom,
 		message: "tool-portal.config.jsonc must define at least one profile.",
@@ -397,6 +507,84 @@ const toolPortalConfigSchema = z.object({
 			"profile"
 		]
 	});
+	for (const [profileId, profile] of Object.entries(config.profiles)) for (const [namespaceId, namespacePolicy] of Object.entries(profile.namespaces)) {
+		if (namespacePolicy.backend.kind !== "tool_vm_runner") continue;
+		const operationNames = new Set(Object.keys(namespacePolicy.backend.operations));
+		for (const [selectorPath, selector] of [
+			[["tools"], namespacePolicy.tools],
+			[["calls", "requiresApproval"], namespacePolicy.calls.requiresApproval],
+			[["calls", "withoutApproval"], namespacePolicy.calls.withoutApproval]
+		]) {
+			const explicitNames = [...selector.allow === "*" ? [] : selector.allow, ...selector.deny];
+			for (const operationName of explicitNames) if (!operationNames.has(operationName)) context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: `Tool VM runner selector references missing operation "${operationName}".`,
+				path: [
+					"profiles",
+					profileId,
+					"namespaces",
+					namespaceId,
+					...selectorPath
+				]
+			});
+		}
+	}
+	if (config.mode !== "standalone") return;
+	for (const [profileId, profile] of Object.entries(config.profiles)) for (const [namespaceId, namespacePolicy] of Object.entries(profile.namespaces)) {
+		if (namespacePolicy.backend.kind === "mcp_provider") continue;
+		context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: `Standalone Tool Portal version 1 does not admit the privileged "${namespacePolicy.backend.kind}" backend.`,
+			path: [
+				"profiles",
+				profileId,
+				"namespaces",
+				namespaceId,
+				"backend",
+				"kind"
+			]
+		});
+	}
+	const configuredAgentIds = Object.keys(config.agents);
+	if (configuredAgentIds.length === 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "Standalone Tool Portal must define at least one agent.",
+		path: ["agents"]
+	});
+	for (const configuredAgentId of configuredAgentIds) if (config.authentication.agents[configuredAgentId] === void 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Standalone Tool Portal agent "${configuredAgentId}" is missing authentication material.`,
+		path: [
+			"authentication",
+			"agents",
+			configuredAgentId
+		]
+	});
+	for (const authenticatedAgentId of Object.keys(config.authentication.agents)) if (config.agents[authenticatedAgentId] === void 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Standalone Tool Portal authentication references unknown agent "${authenticatedAgentId}".`,
+		path: [
+			"authentication",
+			"agents",
+			authenticatedAgentId
+		]
+	});
+	if (Object.values(config.entrypoints).every((entrypoint) => entrypoint === void 0)) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "Standalone Tool Portal must explicitly enable at least one entrypoint.",
+		path: ["entrypoints"]
+	});
+	const stdioAgentId = config.entrypoints.stdio?.authentication.agentId;
+	if (stdioAgentId !== void 0 && config.agents[stdioAgentId] === void 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Standalone Tool Portal stdio principal references unknown agent "${stdioAgentId}".`,
+		path: [
+			"entrypoints",
+			"stdio",
+			"authentication",
+			"agentId"
+		]
+	});
 });
 async function loadToolPortalConfig(configPath) {
 	return toolPortalConfigSchema.parse(await loadJsonConfigFile(configPath));
@@ -421,9 +609,9 @@ function createToolPortalMcpProjection(props) {
 	if (agentConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" is not configured.`);
 	const profileConfig = props.config.profiles[agentConfig.profile];
 	if (profileConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" references missing profile "${agentConfig.profile}".`);
-	const namespaces = Object.fromEntries(Object.entries(profileConfig.capabilities).filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === "mcp_provider").map(([namespace, capabilityPolicy]) => [namespace, {
-		calls: capabilityPolicy.calls,
-		tools: capabilityPolicy.tools
+	const namespaces = Object.fromEntries(Object.entries(profileConfig.namespaces).filter(([, namespacePolicy]) => namespacePolicy.backend.kind === "mcp_provider").map(([namespace, namespacePolicy]) => [namespace, {
+		calls: namespacePolicy.calls,
+		tools: namespacePolicy.tools
 	}]));
 	return ToolPortalMcpProjectionSchema.parse({
 		agentId: props.agentId,
@@ -436,9 +624,9 @@ function createToolPortalControllerHostActionProjection(props) {
 	if (agentConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" is not configured.`);
 	const profileConfig = props.config.profiles[agentConfig.profile];
 	if (profileConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" references missing profile "${agentConfig.profile}".`);
-	const namespaces = Object.fromEntries(Object.entries(profileConfig.capabilities).filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === "controller_host_action").map(([namespace, capabilityPolicy]) => [namespace, {
-		calls: capabilityPolicy.calls,
-		tools: capabilityPolicy.tools
+	const namespaces = Object.fromEntries(Object.entries(profileConfig.namespaces).filter(([, namespacePolicy]) => namespacePolicy.backend.kind === "controller_host_action").map(([namespace, namespacePolicy]) => [namespace, {
+		calls: namespacePolicy.calls,
+		tools: namespacePolicy.tools
 	}]));
 	return ToolPortalControllerHostActionProjectionSchema.parse({
 		agentId: props.agentId,
@@ -488,6 +676,6 @@ function createConfigContractSchemaArtifacts() {
 	};
 }
 //#endregion
-export { ToolPortalControllerHostActionProjectionNamespaceSchema, ToolPortalControllerHostActionProjectionSchema, ToolPortalMcpProjectionNamespaceSchema, ToolPortalMcpProjectionSchema, assertJsonObject, createConfigContractSchemaArtifacts, createToolPortalControllerHostActionProjection, createToolPortalMcpProjection, formatSecretValue, formattedSecretValueSchema, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, loadToolPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallPolicyDecision, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalExternalAuthSchema, mcpPortalProfileDefinitionSchema, mcpPortalProxySchema, mcpProviderSchema, mcpSecretPolicySchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, portalToolSelectorSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretFormatSchema, secretValueSchema, secretValueToEnvironmentReference, toolPortalAgentConfigSchema, toolPortalBackendBindingSchema, toolPortalCallPolicySchema, toolPortalCapabilityPolicySchema, toolPortalConfigSchema, toolPortalProfileDefinitionSchema, toolPortalToolSelectorSchema };
+export { ToolPortalControllerHostActionProjectionNamespaceSchema, ToolPortalControllerHostActionProjectionSchema, ToolPortalMcpProjectionNamespaceSchema, ToolPortalMcpProjectionSchema, assertJsonObject, createConfigContractSchemaArtifacts, createToolPortalControllerHostActionProjection, createToolPortalMcpProjection, formatSecretValue, formattedSecretValueSchema, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, loadToolPortalConfig, managedToolPortalConfigSchema, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallPolicyDecision, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalExternalAuthSchema, mcpPortalProfileDefinitionSchema, mcpPortalProxySchema, mcpProviderSchema, mcpSecretPolicySchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, portalToolSelectorSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretFormatSchema, secretValueSchema, secretValueToEnvironmentReference, standaloneToolPortalConfigSchema, toolPortalAgentConfigSchema, toolPortalBackendBindingSchema, toolPortalBackendKindSchema, toolPortalCallPolicySchema, toolPortalConfigSchema, toolPortalHttpEntrypointSchema, toolPortalMcpEntrypointSchema, toolPortalNamespacePolicySchema, toolPortalNetworkAddressSchema, toolPortalProfileDefinitionSchema, toolPortalSandboxSshBackendBindingSchema, toolPortalSandboxSshOperationDefinitionSchema, toolPortalStandaloneAgentAuthenticationSchema, toolPortalStandaloneAuthenticationSchema, toolPortalStandaloneEntrypointsSchema, toolPortalStdioEntrypointSchema, toolPortalToolSelectorSchema };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-approval-policy.ts","../src/mcp-portal-config.ts","../src/tool-portal-config.ts","../src/schema-artifacts.ts"],"sourcesContent":["import { readFile } from 'node:fs/promises';\n\nimport { parse, type ParseError, type ParseOptions, printParseErrorCode } from 'jsonc-parser';\n\nconst parseJsoncToUnknown: (text: string, errors: ParseError[], options: ParseOptions) => unknown =\n\tparse;\n\nfunction formatLineColumn(text: string, offset: number): string {\n\tconst prefix = text.slice(0, offset);\n\tconst line = prefix.split('\\n').length;\n\tconst lastLineBreakIndex = prefix.lastIndexOf('\\n');\n\tconst column = offset - lastLineBreakIndex;\n\treturn `line ${line}, column ${column}`;\n}\n\nfunction formatParseError(filePath: string, text: string, error: ParseError): string {\n\treturn [\n\t\t`Invalid JSONC in ${filePath}: ${formatLineColumn(text, error.offset)}:`,\n\t\tprintParseErrorCode(error.error),\n\t].join(' ');\n}\n\nexport async function loadJsonConfigFile(filePath: string): Promise<unknown> {\n\tconst rawConfig = await readFile(filePath, 'utf8');\n\tconst parseErrors: ParseError[] = [];\n\tconst parsedConfig = parseJsoncToUnknown(rawConfig, parseErrors, {\n\t\tallowTrailingComma: true,\n\t\tdisallowComments: false,\n\t});\n\n\tif (parseErrors.length > 0) {\n\t\tconst firstParseError = parseErrors[0];\n\t\tif (firstParseError !== undefined) {\n\t\t\tthrow new Error(formatParseError(filePath, rawConfig, firstParseError));\n\t\t}\n\t}\n\n\treturn parsedConfig;\n}\n","import { z } from 'zod';\n\nexport type JsonPrimitive = boolean | null | number | string;\nexport type JsonArray = JsonValue[];\nexport type JsonObject = { [key: string]: JsonValue };\nexport type JsonValue = JsonArray | JsonObject | JsonPrimitive;\n\nexport const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n\tz.union([\n\t\tz.string(),\n\t\tz.number().finite(),\n\t\tz.boolean(),\n\t\tz.null(),\n\t\tz.array(jsonValueSchema),\n\t\tjsonObjectSchema,\n\t]),\n);\n\nexport const jsonObjectSchema: z.ZodType<JsonObject> = z.record(z.string(), jsonValueSchema);\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function assertJsonObject(value: unknown, label: string): JsonObject {\n\tif (!isJsonObject(value)) {\n\t\tthrow new Error(`${label} must be a JSON object.`);\n\t}\n\n\treturn jsonObjectSchema.parse(value);\n}\n","import { z } from 'zod';\n\nexport const secretFormatSchema = z.discriminatedUnion('kind', [\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('bearer'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('prefix'),\n\t\t\tprefix: z\n\t\t\t\t.string()\n\t\t\t\t.min(1, 'secret format prefix must not be empty.')\n\t\t\t\t.max(64, 'secret format prefix must be 64 characters or fewer.')\n\t\t\t\t.refine(\n\t\t\t\t\t(value) => !/\\s/u.test(value),\n\t\t\t\t\t'secret format prefix must not contain whitespace; agent-vm inserts one space.',\n\t\t\t\t),\n\t\t})\n\t\t.strict(),\n]);\n\nconst environmentSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('environment'),\n\t\tname: z.string().min(1),\n\t})\n\t.strict();\n\nconst onePasswordSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('1password'),\n\t\tref: z.string().regex(/^op:\\/\\//u, '1Password refs must start with op://'),\n\t})\n\t.strict();\n\nexport const secretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema,\n\tonePasswordSecretValueSchema,\n]);\n\nexport const formattedSecretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n\tonePasswordSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n]);\n\nexport type SecretFormat = z.infer<typeof secretFormatSchema>;\nexport type SecretValue = z.infer<typeof secretValueSchema>;\nexport type FormattedSecretValue = z.infer<typeof formattedSecretValueSchema>;\n\nexport function formatSecretValue(secret: FormattedSecretValue, rawValue: string): string {\n\tif (secret.format === undefined) {\n\t\treturn rawValue;\n\t}\n\tswitch (secret.format.kind) {\n\t\tcase 'bearer':\n\t\t\treturn `Bearer ${rawValue}`;\n\t\tcase 'prefix':\n\t\t\treturn `${secret.format.prefix} ${rawValue}`;\n\t\tdefault: {\n\t\t\tconst exhaustiveFormat: never = secret.format;\n\t\t\treturn exhaustiveFormat;\n\t\t}\n\t}\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { formattedSecretValueSchema, type FormattedSecretValue } from './secret-value.js';\n\nconst mcpProviderDiscoverySchema = z\n\t.object({\n\t\tsummary: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nconst remoteTransportUrlSchema = z.url().refine(\n\t(value) => {\n\t\tconst protocol = new URL(value).protocol;\n\t\treturn protocol === 'http:' || protocol === 'https:';\n\t},\n\t{ message: 'Remote MCP transport URLs must use http or https.' },\n);\n\nconst connectionTimeoutMsSchema = z.number().int().min(1).max(300_000);\n\nconst streamableHttpTransportSchema = z\n\t.object({\n\t\tkind: z.literal('streamable-http'),\n\t\turl: remoteTransportUrlSchema,\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst sseTransportSchema = z\n\t.object({\n\t\tkind: z.literal('sse'),\n\t\turl: remoteTransportUrlSchema,\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst stdioTransportSchema = z\n\t.object({\n\t\tkind: z.literal('stdio'),\n\t\tcommand: z.string().min(1),\n\t\targs: z.array(z.string()).default([]),\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\tcwd: z.string().min(1).optional(),\n\t\tenv: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\tnetworkAccess: z.enum(['declared', 'none']).optional(),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport const mcpSecretPolicySchema = z\n\t.object({\n\t\thosts: z.array(z.string()).default([]),\n\t\tinjection: z.enum(['env', 'http-mediation']),\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (policy.injection === 'http-mediation' && policy.hosts.length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'http-mediation secret policies must declare at least one host.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t\tif (policy.injection === 'env' && policy.hosts.length > 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'env secret policies must not declare hosts.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t});\n\nexport const mcpProviderSchema = z\n\t.object({\n\t\tkind: z.literal('mcp'),\n\t\tnamespace: z.string().min(1),\n\t\tdiscovery: mcpProviderDiscoverySchema.default({}),\n\t\tsecretPolicies: z.record(z.string().min(1), mcpSecretPolicySchema).default({}),\n\t\ttransport: z.discriminatedUnion('kind', [\n\t\t\tstreamableHttpTransportSchema,\n\t\t\tsseTransportSchema,\n\t\t\tstdioTransportSchema,\n\t\t]),\n\t})\n\t.strict();\n\nexport const mcpConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tproviders: z.record(z.string().min(1), mcpProviderSchema).default({}),\n\t})\n\t.strict();\n\nexport type McpConfig = z.infer<typeof mcpConfigSchema>;\nexport type McpProvider = z.infer<typeof mcpProviderSchema>;\n\nexport type ResolvedMcpProvider =\n\t| {\n\t\t\treadonly connectionTimeoutMs?: number;\n\t\t\treadonly headers: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'streamable-http' | 'sse';\n\t\t\treadonly url: string;\n\t  }\n\t| {\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly command: string;\n\t\t\treadonly connectionTimeoutMs?: number;\n\t\t\treadonly cwd?: string;\n\t\t\treadonly env: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'stdio';\n\t  };\n\nexport async function loadMcpConfig(configPath: string): Promise<McpConfig> {\n\treturn mcpConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport function mcpConfigToResolvedProviders(config: McpConfig): readonly ResolvedMcpProvider[] {\n\treturn Object.values(config.providers).map((provider) => {\n\t\tconst transport = provider.transport;\n\t\tif (transport.kind === 'stdio') {\n\t\t\tconst resolvedProvider: {\n\t\t\t\targs: readonly string[];\n\t\t\t\tcommand: string;\n\t\t\t\tconnectionTimeoutMs?: number;\n\t\t\t\tcwd?: string;\n\t\t\t\tenv: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\t\tnamespace: string;\n\t\t\t\ttransport: 'stdio';\n\t\t\t} = {\n\t\t\t\targs: transport.args,\n\t\t\t\tcommand: transport.command,\n\t\t\t\tenv: transport.env,\n\t\t\t\tnamespace: provider.namespace,\n\t\t\t\ttransport: transport.kind,\n\t\t\t};\n\t\t\tif (transport.connectionTimeoutMs !== undefined) {\n\t\t\t\tresolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;\n\t\t\t}\n\t\t\tif (transport.cwd !== undefined) {\n\t\t\t\tresolvedProvider.cwd = transport.cwd;\n\t\t\t}\n\t\t\treturn resolvedProvider;\n\t\t}\n\n\t\tconst resolvedProvider: {\n\t\t\tconnectionTimeoutMs?: number;\n\t\t\theaders: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\tnamespace: string;\n\t\t\ttransport: 'streamable-http' | 'sse';\n\t\t\turl: string;\n\t\t} = {\n\t\t\theaders: transport.headers,\n\t\t\tnamespace: provider.namespace,\n\t\t\ttransport: transport.kind,\n\t\t\turl: transport.url,\n\t\t};\n\t\tif (transport.connectionTimeoutMs !== undefined) {\n\t\t\tresolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;\n\t\t}\n\t\treturn resolvedProvider;\n\t});\n}\n","import type { NamespaceToolRef, ResolvedMcpPortalProfile } from './mcp-portal-config.js';\n\nexport interface McpPortalApprovalToolAnnotations {\n\treadonly destructiveHint?: boolean | undefined;\n\treadonly readOnlyHint?: boolean | undefined;\n}\n\nexport interface McpPortalApprovalToolCall {\n\treadonly annotations?: McpPortalApprovalToolAnnotations;\n\treadonly namespace: string;\n\treadonly toolName: string;\n}\n\nfunction selectorMatches(\n\tselectors: readonly NamespaceToolRef[],\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\treturn selectors.some(\n\t\t(selector) => selector.namespace === namespace && selector.toolName === toolName,\n\t);\n}\n\nfunction namespaceSelectorMatches(\n\tprofile: ResolvedMcpPortalProfile,\n\tselectorKind: 'requiresApproval' | 'withoutApproval',\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\tconst selector = (profile.approval.callPoliciesByNamespace ?? {})[namespace]?.[selectorKind];\n\tif (selector === undefined) {\n\t\treturn false;\n\t}\n\tif ((selector.deny ?? []).includes(toolName)) {\n\t\treturn false;\n\t}\n\treturn selector.allow === '*' || selector.allow.includes(toolName);\n}\n\nfunction hasTrustedReadOnlyAnnotation(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn (\n\t\tprofile.approval.annotationPolicy === 'destructive-requires-approval' &&\n\t\tprofile.approval.trustedAnnotationNamespaces.includes(call.namespace) &&\n\t\tcall.annotations?.readOnlyHint === true &&\n\t\tcall.annotations.destructiveHint !== true\n\t);\n}\n\nexport type McpPortalCallPolicyDecision =\n\t| { readonly kind: 'allow_without_approval' }\n\t| { readonly kind: 'blocked' }\n\t| { readonly kind: 'requires_approval' };\n\nexport function mcpPortalCallPolicyDecision(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): McpPortalCallPolicyDecision {\n\tif (\n\t\tselectorMatches(profile.approval.allowWithoutApprovalTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'withoutApproval', call.namespace, call.toolName) ||\n\t\thasTrustedReadOnlyAnnotation(profile, call)\n\t) {\n\t\treturn { kind: 'allow_without_approval' };\n\t}\n\tif (profile.approval.annotationPolicy === 'always-require-approval') {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\tif (\n\t\tselectorMatches(profile.approval.alwaysAskTools, call.namespace, call.toolName) ||\n\t\tselectorMatches(profile.approval.writeTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'requiresApproval', call.namespace, call.toolName)\n\t) {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\treturn { kind: 'blocked' };\n}\n\nexport function mcpPortalCallRequiresApproval(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn mcpPortalCallPolicyDecision(profile, call).kind === 'requires_approval';\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema, type SecretValue } from './secret-value.js';\n\nexport const namespaceToolRefSchema = z\n\t.object({\n\t\tnamespace: z.string().min(1),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\n\nexport type NamespaceToolRef = z.infer<typeof namespaceToolRefSchema>;\n\nexport const portalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type PortalToolSelector = z.infer<typeof portalToolSelectorSchema>;\n\nexport const portalApprovalConfigSchema = z\n\t.object({\n\t\tallowWithoutApprovalTools: z.array(namespaceToolRefSchema).default([]),\n\t\talwaysAskTools: z.array(namespaceToolRefSchema).default([]),\n\t\tannotationPolicy: z\n\t\t\t.enum(['destructive-requires-approval', 'always-require-approval'])\n\t\t\t.default('destructive-requires-approval'),\n\t\tcallPoliciesByNamespace: z\n\t\t\t.record(\n\t\t\t\tz.string().min(1),\n\t\t\t\tz\n\t\t\t\t\t.object({\n\t\t\t\t\t\trequiresApproval: portalToolSelectorSchema,\n\t\t\t\t\t\twithoutApproval: portalToolSelectorSchema,\n\t\t\t\t\t})\n\t\t\t\t\t.strict(),\n\t\t\t)\n\t\t\t.default({}),\n\t\ttrustedAnnotationNamespaces: z.array(z.string().min(1)).default([]),\n\t\twriteTools: z.array(namespaceToolRefSchema).default([]),\n\t})\n\t.strict();\n\nexport type PortalApprovalConfig = z.infer<typeof portalApprovalConfigSchema>;\n\nconst portalNamespaceCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: portalToolSelectorSchema,\n\t\twithoutApproval: portalToolSelectorSchema,\n\t})\n\t.strict();\n\nconst portalNamespaceApprovalSchema = z\n\t.object({\n\t\tallowWithoutApproval: z.array(z.string().min(1)).default([]),\n\t\talwaysAsk: z.array(z.string().min(1)).default([]),\n\t\ttrustedAnnotations: z.boolean().default(false),\n\t\twrite: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst defaultPortalNamespaceApproval = {\n\tallowWithoutApproval: [],\n\talwaysAsk: [],\n\ttrustedAnnotations: false,\n\twrite: [],\n} satisfies z.infer<typeof portalNamespaceApprovalSchema>;\n\nconst portalNamespacePolicySchema = z\n\t.object({\n\t\tapproval: portalNamespaceApprovalSchema.default(defaultPortalNamespaceApproval).optional(),\n\t\tcalls: portalNamespaceCallPolicySchema,\n\t\ttools: portalToolSelectorSchema,\n\t})\n\t.strict();\n\ntype PortalNamespacePolicy = z.infer<typeof portalNamespacePolicySchema>;\n\nexport const mcpPortalProfileDefinitionSchema = z\n\t.object({\n\t\tapproval: z\n\t\t\t.object({\n\t\t\t\tannotationPolicy: portalApprovalConfigSchema.shape.annotationPolicy.optional(),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tnamespaces: z.record(z.string().min(1), portalNamespacePolicySchema).default({}),\n\t\tlogging: z\n\t\t\t.object({ enabled: z.boolean().default(false) })\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean().default(true),\n\t\t\t\tmaxNamespaces: z.number().int().positive().default(12),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tcache: z\n\t\t\t.object({\n\t\t\t\tcatalogTtlMs: z.number().int().positive().default(60_000),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalProfileDefinition = z.infer<typeof mcpPortalProfileDefinitionSchema>;\n\nexport const resolvedMcpPortalProfileSchema = z\n\t.object({\n\t\tenabledNamespaces: z.array(z.string().min(1)),\n\t\tenabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\thiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\tlogging: z.object({ enabled: z.boolean() }).strict(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean(),\n\t\t\t\tmaxNamespaces: z.number().int().positive(),\n\t\t\t})\n\t\t\t.strict(),\n\t\tcache: z.object({ catalogTtlMs: z.number().int().positive() }).strict(),\n\t\tapproval: portalApprovalConfigSchema,\n\t})\n\t.strict();\n\nexport type ResolvedMcpPortalProfile = z.infer<typeof resolvedMcpPortalProfileSchema>;\n\nexport const mcpPortalExternalAuthSchema = z\n\t.object({\n\t\tmasterKey: secretValueSchema,\n\t})\n\t.strict();\n\nexport type McpPortalExternalAuthConfig = z.infer<typeof mcpPortalExternalAuthSchema>;\n\nfunction isLoopbackProxyHost(host: string): boolean {\n\tconst normalizedHost = host.toLowerCase();\n\treturn (\n\t\tnormalizedHost === 'localhost' || normalizedHost === '127.0.0.1' || normalizedHost === '::1'\n\t);\n}\n\nexport const mcpPortalProxySchema = z\n\t.object({\n\t\tserver: z\n\t\t\t.object({\n\t\t\t\thost: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.min(1)\n\t\t\t\t\t.refine(isLoopbackProxyHost, {\n\t\t\t\t\t\tmessage: 'mcpProxy.server.host must be loopback-only for HTTP bearer auth.',\n\t\t\t\t\t})\n\t\t\t\t\t.default('127.0.0.1'),\n\t\t\t\tport: z.number().int().min(1).max(65_535).default(18_791),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ host: '127.0.0.1', port: 18_791 }),\n\t\tauth: z\n\t\t\t.object({\n\t\t\t\theaderName: z.string().min(1).default('authorization'),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ headerName: 'authorization' }),\n\t})\n\t.strict();\n\nexport type McpPortalProxyConfig = z.infer<typeof mcpPortalProxySchema>;\n\nexport const mcpPortalAgentConfigSchema = z\n\t.object({\n\t\tcredentialVersion: z.number().int().positive().default(1),\n\t\tprofile: z.string().min(1),\n\t\thmacKey: secretValueSchema.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalAgentConfig = z.infer<typeof mcpPortalAgentConfigSchema>;\n\nexport const mcpPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\texternalAuth: mcpPortalExternalAuthSchema.optional(),\n\t\tmcpProxy: mcpPortalProxySchema.optional(),\n\t\tagents: z.record(z.string().min(1), mcpPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), mcpPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'mcp-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\t});\n\ntype ParsedMcpPortalConfig = z.infer<typeof mcpPortalConfigSchema>;\nexport type McpPortalConfig = Omit<ParsedMcpPortalConfig, 'agents'> & {\n\treadonly agents: Readonly<Record<string, McpPortalAgentConfig>>;\n};\n\nexport const openClawMcpPortalPluginConfigSchema = z\n\t.object({\n\t\tconfigDir: z.string().min(1),\n\t\tbinPath: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nexport type OpenClawMcpPortalPluginConfig = z.infer<typeof openClawMcpPortalPluginConfigSchema>;\n\nconst defaultProfile: ResolvedMcpPortalProfile = {\n\tapproval: portalApprovalConfigSchema.parse({}),\n\tcache: { catalogTtlMs: 60_000 },\n\tenabledNamespaces: [],\n\tenabledToolsByNamespace: {},\n\thiddenToolsByNamespace: {},\n\tlogging: { enabled: false },\n\tpromptContext: { enabled: true, maxNamespaces: 12 },\n};\n\ntype AuthoredPortalNamespaces = McpPortalProfileDefinition['namespaces'];\n\nexport async function loadMcpPortalConfig(configPath: string): Promise<McpPortalConfig> {\n\treturn mcpPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nfunction namespaceToolRefs(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tselector: (policy: PortalNamespacePolicy) => readonly string[],\n): readonly NamespaceToolRef[] {\n\treturn Object.entries(namespaces).flatMap(([namespace, policy]) =>\n\t\tselector(policy).map((toolName) => ({ namespace, toolName })),\n\t);\n}\n\nfunction selectorAllowList(selector: PortalToolSelector): readonly string[] {\n\treturn selector.allow === '*' ? [] : selector.allow;\n}\n\nfunction selectorHasVisibleTools(selector: PortalToolSelector): boolean {\n\treturn selector.allow === '*' || selector.allow.length > 0;\n}\n\nfunction activeNamespaces(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Readonly<Record<string, PortalNamespacePolicy>> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces).filter(([, policy]) => selectorHasVisibleTools(policy.tools)),\n\t);\n}\n\nfunction compileNamespaceApproval(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tannotationPolicy: PortalApprovalConfig['annotationPolicy'],\n): PortalApprovalConfig {\n\treturn portalApprovalConfigSchema.parse({\n\t\tallowWithoutApprovalTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.withoutApproval),\n\t\t\t...(policy.approval?.allowWithoutApproval ?? []),\n\t\t]),\n\t\tannotationPolicy,\n\t\talwaysAskTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.requiresApproval),\n\t\t\t...(policy.approval?.alwaysAsk ?? []),\n\t\t]),\n\t\tcallPoliciesByNamespace: Object.fromEntries(\n\t\t\tObject.entries(namespaces).map(([namespace, policy]) => [namespace, policy.calls]),\n\t\t),\n\t\ttrustedAnnotationNamespaces: Object.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.approval?.trustedAnnotations)\n\t\t\t.map(([namespace]) => namespace),\n\t\twriteTools: namespaceToolRefs(namespaces, (policy) => policy.approval?.write ?? []),\n\t});\n}\n\nfunction compileEnabledToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.tools.allow !== '*')\n\t\t\t.map(([namespace, policy]) => [namespace, selectorAllowList(policy.tools)]),\n\t);\n}\n\nfunction compileHiddenToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => (policy.tools.deny ?? []).length > 0)\n\t\t\t.map(([namespace, policy]) => [namespace, policy.tools.deny ?? []]),\n\t);\n}\n\nfunction compileProfileFromNamespaces(\n\tnamespaces: AuthoredPortalNamespaces,\n\tprofile: McpPortalProfileDefinition,\n): ResolvedMcpPortalProfile {\n\tconst annotationPolicy =\n\t\tprofile.approval?.annotationPolicy ?? defaultProfile.approval.annotationPolicy;\n\tconst activeNamespacePolicies = activeNamespaces(namespaces);\n\treturn resolvedMcpPortalProfileSchema.parse({\n\t\tapproval: compileNamespaceApproval(activeNamespacePolicies, annotationPolicy),\n\t\tcache: profile.cache ?? defaultProfile.cache,\n\t\tenabledNamespaces: Object.keys(activeNamespacePolicies),\n\t\tenabledToolsByNamespace: compileEnabledToolsByNamespace(activeNamespacePolicies),\n\t\thiddenToolsByNamespace: compileHiddenToolsByNamespace(activeNamespacePolicies),\n\t\tlogging: profile.logging ?? defaultProfile.logging,\n\t\tpromptContext: profile.promptContext ?? defaultProfile.promptContext,\n\t});\n}\n\nexport function resolveMcpPortalProfile(\n\tconfig: McpPortalConfig,\n\tprofileName: string,\n): ResolvedMcpPortalProfile {\n\tconst profile = config.profiles[profileName];\n\tif (profile === undefined) {\n\t\tthrow new Error(`unknown MCP profile '${profileName}'`);\n\t}\n\treturn compileProfileFromNamespaces(profile.namespaces, profile);\n}\n\nexport function secretValueToEnvironmentReference(secret: SecretValue): string {\n\tif (secret.source === 'environment') {\n\t\treturn `\\${${secret.name}}`;\n\t}\n\treturn secret.ref;\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\n\nexport const toolPortalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type ToolPortalToolSelector = z.infer<typeof toolPortalToolSelectorSchema>;\n\nexport const toolPortalCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: toolPortalToolSelectorSchema,\n\t\twithoutApproval: toolPortalToolSelectorSchema,\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (toolSelectorsOverlap(policy.requiresApproval, policy.withoutApproval)) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'Tool Portal call policy cannot list one tool in both approval selectors.',\n\t\t\t\tpath: ['withoutApproval'],\n\t\t\t});\n\t\t}\n\t});\n\nexport type ToolPortalCallPolicy = z.infer<typeof toolPortalCallPolicySchema>;\n\nexport const toolPortalBackendBindingSchema = z.discriminatedUnion('kind', [\n\tz.object({ kind: z.literal('mcp_provider') }).strict(),\n\tz.object({ kind: z.literal('controller_host_action') }).strict(),\n\tz.object({ kind: z.literal('tool_vm_runner') }).strict(),\n]);\n\nexport type ToolPortalBackendBinding = z.infer<typeof toolPortalBackendBindingSchema>;\n\nexport const toolPortalCapabilityPolicySchema = z\n\t.object({\n\t\tbackend: toolPortalBackendBindingSchema,\n\t\tcalls: toolPortalCallPolicySchema,\n\t\ttools: toolPortalToolSelectorSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalCapabilityPolicy = z.infer<typeof toolPortalCapabilityPolicySchema>;\n\nexport const toolPortalProfileDefinitionSchema = z\n\t.object({\n\t\tcapabilities: z.record(z.string().min(1), toolPortalCapabilityPolicySchema).default({}),\n\t})\n\t.strict();\n\nexport type ToolPortalProfileDefinition = z.infer<typeof toolPortalProfileDefinitionSchema>;\n\nexport const toolPortalAgentConfigSchema = z\n\t.object({\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalAgentConfig = z.infer<typeof toolPortalAgentConfigSchema>;\n\nexport const toolPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tagents: z.record(z.string().min(1), toolPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), toolPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'tool-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\n\t\tfor (const [agentId, agentConfig] of Object.entries(config.agents)) {\n\t\t\tif (config.profiles[agentConfig.profile] === undefined) {\n\t\t\t\tcontext.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `Tool Portal agent \"${agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t\t\t\tpath: ['agents', agentId, 'profile'],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t});\n\nexport type ToolPortalConfig = z.infer<typeof toolPortalConfigSchema>;\n\nexport async function loadToolPortalConfig(configPath: string): Promise<ToolPortalConfig> {\n\treturn toolPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport const ToolPortalMcpProjectionNamespaceSchema = z\n\t.object({\n\t\tcalls: toolPortalCallPolicySchema,\n\t\ttools: toolPortalToolSelectorSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalMcpProjectionNamespace = z.infer<\n\ttypeof ToolPortalMcpProjectionNamespaceSchema\n>;\n\nexport const ToolPortalMcpProjectionSchema = z\n\t.object({\n\t\tagentId: z.string().min(1),\n\t\tnamespaces: z.record(z.string().min(1), ToolPortalMcpProjectionNamespaceSchema),\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalMcpProjection = z.infer<typeof ToolPortalMcpProjectionSchema>;\n\nexport const ToolPortalControllerHostActionProjectionNamespaceSchema =\n\tToolPortalMcpProjectionNamespaceSchema;\n\nexport type ToolPortalControllerHostActionProjectionNamespace = z.infer<\n\ttypeof ToolPortalControllerHostActionProjectionNamespaceSchema\n>;\n\nexport const ToolPortalControllerHostActionProjectionSchema = z\n\t.object({\n\t\tagentId: z.string().min(1),\n\t\tnamespaces: z.record(\n\t\t\tz.string().min(1),\n\t\t\tToolPortalControllerHostActionProjectionNamespaceSchema,\n\t\t),\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalControllerHostActionProjection = z.infer<\n\ttypeof ToolPortalControllerHostActionProjectionSchema\n>;\n\nexport interface CreateToolPortalMcpProjectionProps {\n\treadonly agentId: string;\n\treadonly config: ToolPortalConfig;\n}\n\nexport function createToolPortalMcpProjection(\n\tprops: CreateToolPortalMcpProjectionProps,\n): ToolPortalMcpProjection {\n\tconst agentConfig = props.config.agents[props.agentId];\n\tif (agentConfig === undefined) {\n\t\tthrow new Error(`Tool Portal agent \"${props.agentId}\" is not configured.`);\n\t}\n\n\tconst profileConfig = props.config.profiles[agentConfig.profile];\n\tif (profileConfig === undefined) {\n\t\tthrow new Error(\n\t\t\t`Tool Portal agent \"${props.agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t);\n\t}\n\n\tconst namespaces = Object.fromEntries(\n\t\tObject.entries(profileConfig.capabilities)\n\t\t\t.filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === 'mcp_provider')\n\t\t\t.map(([namespace, capabilityPolicy]) => [\n\t\t\t\tnamespace,\n\t\t\t\t{\n\t\t\t\t\tcalls: capabilityPolicy.calls,\n\t\t\t\t\ttools: capabilityPolicy.tools,\n\t\t\t\t},\n\t\t\t]),\n\t);\n\n\treturn ToolPortalMcpProjectionSchema.parse({\n\t\tagentId: props.agentId,\n\t\tnamespaces,\n\t\tprofile: agentConfig.profile,\n\t});\n}\n\nexport interface CreateToolPortalControllerHostActionProjectionProps {\n\treadonly agentId: string;\n\treadonly config: ToolPortalConfig;\n}\n\nexport function createToolPortalControllerHostActionProjection(\n\tprops: CreateToolPortalControllerHostActionProjectionProps,\n): ToolPortalControllerHostActionProjection {\n\tconst agentConfig = props.config.agents[props.agentId];\n\tif (agentConfig === undefined) {\n\t\tthrow new Error(`Tool Portal agent \"${props.agentId}\" is not configured.`);\n\t}\n\n\tconst profileConfig = props.config.profiles[agentConfig.profile];\n\tif (profileConfig === undefined) {\n\t\tthrow new Error(\n\t\t\t`Tool Portal agent \"${props.agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t);\n\t}\n\n\tconst namespaces = Object.fromEntries(\n\t\tObject.entries(profileConfig.capabilities)\n\t\t\t.filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === 'controller_host_action')\n\t\t\t.map(([namespace, capabilityPolicy]) => [\n\t\t\t\tnamespace,\n\t\t\t\t{\n\t\t\t\t\tcalls: capabilityPolicy.calls,\n\t\t\t\t\ttools: capabilityPolicy.tools,\n\t\t\t\t},\n\t\t\t]),\n\t);\n\n\treturn ToolPortalControllerHostActionProjectionSchema.parse({\n\t\tagentId: props.agentId,\n\t\tnamespaces,\n\t\tprofile: agentConfig.profile,\n\t});\n}\n\nfunction toolSelectorsOverlap(\n\tleft: ToolPortalToolSelector,\n\tright: ToolPortalToolSelector,\n): boolean {\n\tconst leftAllow = left.allow;\n\tconst rightAllow = right.allow;\n\tif (leftAllow === '*' && rightAllow === '*') {\n\t\treturn true;\n\t}\n\tif (leftAllow === '*') {\n\t\tif (rightAllow === '*') {\n\t\t\treturn true;\n\t\t}\n\t\treturn rightAllow.some((toolName) => !left.deny.includes(toolName));\n\t}\n\tif (rightAllow === '*') {\n\t\treturn leftAllow.some((toolName) => !right.deny.includes(toolName));\n\t}\n\treturn leftAllow.some(\n\t\t(toolName) =>\n\t\t\trightAllow.includes(toolName) &&\n\t\t\t!left.deny.includes(toolName) &&\n\t\t\t!right.deny.includes(toolName),\n\t);\n}\n","import * as zod from 'zod';\n\nimport { mcpConfigSchema } from './mcp-config.js';\nimport { mcpPortalConfigSchema } from './mcp-portal-config.js';\nimport { toolPortalConfigSchema } from './tool-portal-config.js';\n\nexport const mcpPortalConfigSchemaVersions = {\n\tmcp: 1,\n\tmcpPortal: 1,\n\ttoolPortal: 1,\n} as const;\n\nexport const mcpPortalConfigSchemaIds = {\n\tmcp: 'agent-vm:mcp:1',\n\tmcpPortal: 'agent-vm:mcp-portal:1',\n\ttoolPortal: 'agent-vm:tool-portal:1',\n} as const;\n\nexport const mcpPortalConfigSchemaPaths = {\n\tmcpFromGatewayConfig: '../../schemas/mcp.schema.json',\n\tmcpPortalFromGatewayConfig: '../../schemas/mcp-portal.schema.json',\n\ttoolPortalFromGatewayConfig: '../../schemas/tool-portal.schema.json',\n} as const;\n\nexport interface ConfigContractSchemaArtifacts {\n\treadonly mcp: Record<string, unknown>;\n\treadonly mcpPortal: Record<string, unknown>;\n\treadonly toolPortal: Record<string, unknown>;\n}\n\nfunction withSchemaId(schema: Record<string, unknown>, schemaId: string): Record<string, unknown> {\n\treturn {\n\t\t$id: schemaId,\n\t\t...schema,\n\t};\n}\n\nexport function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts {\n\treturn {\n\t\tmcp: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcp,\n\t\t),\n\t\tmcpPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcpPortal,\n\t\t),\n\t\ttoolPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(toolPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.toolPortal,\n\t\t),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,sBACL;AAED,SAAS,iBAAiB,MAAc,QAAwB;CAC/D,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO;CAIpC,OAAO,QAHM,OAAO,MAAM,KAAK,CAAC,OAGZ,WADL,SADY,OAAO,YAAY,KACJ;;AAI3C,SAAS,iBAAiB,UAAkB,MAAc,OAA2B;CACpF,OAAO,CACN,oBAAoB,SAAS,IAAI,iBAAiB,MAAM,MAAM,OAAO,CAAC,IACtE,oBAAoB,MAAM,MAAM,CAChC,CAAC,KAAK,IAAI;;AAGZ,eAAsB,mBAAmB,UAAoC;CAC5E,MAAM,YAAY,MAAM,SAAS,UAAU,OAAO;CAClD,MAAM,cAA4B,EAAE;CACpC,MAAM,eAAe,oBAAoB,WAAW,aAAa;EAChE,oBAAoB;EACpB,kBAAkB;EAClB,CAAC;CAEF,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,kBAAkB,YAAY;EACpC,IAAI,oBAAoB,KAAA,GACvB,MAAM,IAAI,MAAM,iBAAiB,UAAU,WAAW,gBAAgB,CAAC;;CAIzE,OAAO;;;;AC9BR,MAAa,kBAAwC,EAAE,WACtD,EAAE,MAAM;CACP,EAAE,QAAQ;CACV,EAAE,QAAQ,CAAC,QAAQ;CACnB,EAAE,SAAS;CACX,EAAE,MAAM;CACR,EAAE,MAAM,gBAAgB;CACxB;CACA,CAAC,CACF;AAED,MAAa,mBAA0C,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB;AAE5F,SAAgB,aAAa,OAAqC;CACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,iBAAiB,OAAgB,OAA2B;CAC3E,IAAI,CAAC,aAAa,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAGnD,OAAO,iBAAiB,MAAM,MAAM;;;;AC3BrC,MAAa,qBAAqB,EAAE,mBAAmB,QAAQ,CAC9D,EACE,OAAO,EACP,MAAM,EAAE,QAAQ,SAAS,EACzB,CAAC,CACD,QAAQ,EACV,EACE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,QAAQ,EACN,QAAQ,CACR,IAAI,GAAG,0CAA0C,CACjD,IAAI,IAAI,uDAAuD,CAC/D,QACC,UAAU,CAAC,MAAM,KAAK,MAAM,EAC7B,gFACA;CACF,CAAC,CACD,QAAQ,CACV,CAAC;AAEF,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,cAAc;CAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,CAAC,CACD,QAAQ;AAEV,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,YAAY;CAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM,aAAa,uCAAuC;CAC1E,CAAC,CACD,QAAQ;AAEV,MAAa,oBAAoB,EAAE,mBAAmB,UAAU,CAC/D,8BACA,6BACA,CAAC;AAEF,MAAa,6BAA6B,EAAE,mBAAmB,UAAU,CACxE,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,EACF,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,CACF,CAAC;AAMF,SAAgB,kBAAkB,QAA8B,UAA0B;CACzF,IAAI,OAAO,WAAW,KAAA,GACrB,OAAO;CAER,QAAQ,OAAO,OAAO,MAAtB;EACC,KAAK,UACJ,OAAO,UAAU;EAClB,KAAK,UACJ,OAAO,GAAG,OAAO,OAAO,OAAO,GAAG;EACnC,SAEC,OADgC,OAAO;;;;;AC5D1C,MAAM,6BAA6B,EACjC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACrC,CAAC,CACD,QAAQ;AAEV,MAAM,2BAA2B,EAAE,KAAK,CAAC,QACvC,UAAU;CACV,MAAM,WAAW,IAAI,IAAI,MAAM,CAAC;CAChC,OAAO,aAAa,WAAW,aAAa;GAE7C,EAAE,SAAS,qDAAqD,CAChE;AAED,MAAM,4BAA4B,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ;AAEtE,MAAM,gCAAgC,EACpC,OAAO;CACP,MAAM,EAAE,QAAQ,kBAAkB;CAClC,KAAK;CACL,qBAAqB,0BAA0B,UAAU;CACzD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,qBAAqB,EACzB,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK;CACL,qBAAqB,0BAA0B,UAAU;CACzD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,uBAAuB,EAC3B,OAAO;CACP,MAAM,EAAE,QAAQ,QAAQ;CACxB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACrC,qBAAqB,0BAA0B,UAAU;CACzD,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACjC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACjE,eAAe,EAAE,KAAK,CAAC,YAAY,OAAO,CAAC,CAAC,UAAU;CACtD,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAa,wBAAwB,EACnC,OAAO;CACP,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACtC,WAAW,EAAE,KAAK,CAAC,OAAO,iBAAiB,CAAC;CAC5C,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,cAAc,oBAAoB,OAAO,MAAM,WAAW,GACpE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;CAEH,IAAI,OAAO,cAAc,SAAS,OAAO,MAAM,SAAS,GACvD,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;EAEF;AAEH,MAAa,oBAAoB,EAC/B,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,WAAW,2BAA2B,QAAQ,EAAE,CAAC;CACjD,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;CAC9E,WAAW,EAAE,mBAAmB,QAAQ;EACvC;EACA;EACA;EACA,CAAC;CACF,CAAC,CACD,QAAQ;AAEV,MAAa,kBAAkB,EAC7B,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CACrE,CAAC,CACD,QAAQ;AAuBV,eAAsB,cAAc,YAAwC;CAC3E,OAAO,gBAAgB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGnE,SAAgB,6BAA6B,QAAmD;CAC/F,OAAO,OAAO,OAAO,OAAO,UAAU,CAAC,KAAK,aAAa;EACxD,MAAM,YAAY,SAAS;EAC3B,IAAI,UAAU,SAAS,SAAS;GAC/B,MAAM,mBAQF;IACH,MAAM,UAAU;IAChB,SAAS,UAAU;IACnB,KAAK,UAAU;IACf,WAAW,SAAS;IACpB,WAAW,UAAU;IACrB;GACD,IAAI,UAAU,wBAAwB,KAAA,GACrC,iBAAiB,sBAAsB,UAAU;GAElD,IAAI,UAAU,QAAQ,KAAA,GACrB,iBAAiB,MAAM,UAAU;GAElC,OAAO;;EAGR,MAAM,mBAMF;GACH,SAAS,UAAU;GACnB,WAAW,SAAS;GACpB,WAAW,UAAU;GACrB,KAAK,UAAU;GACf;EACD,IAAI,UAAU,wBAAwB,KAAA,GACrC,iBAAiB,sBAAsB,UAAU;EAElD,OAAO;GACN;;;;AC3JH,SAAS,gBACR,WACA,WACA,UACU;CACV,OAAO,UAAU,MACf,aAAa,SAAS,cAAc,aAAa,SAAS,aAAa,SACxE;;AAGF,SAAS,yBACR,SACA,cACA,WACA,UACU;CACV,MAAM,YAAY,QAAQ,SAAS,2BAA2B,EAAE,EAAE,aAAa;CAC/E,IAAI,aAAa,KAAA,GAChB,OAAO;CAER,KAAK,SAAS,QAAQ,EAAE,EAAE,SAAS,SAAS,EAC3C,OAAO;CAER,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS,SAAS;;AAGnE,SAAS,6BACR,SACA,MACU;CACV,OACC,QAAQ,SAAS,qBAAqB,mCACtC,QAAQ,SAAS,4BAA4B,SAAS,KAAK,UAAU,IACrE,KAAK,aAAa,iBAAiB,QACnC,KAAK,YAAY,oBAAoB;;AASvC,SAAgB,4BACf,SACA,MAC8B;CAC9B,IACC,gBAAgB,QAAQ,SAAS,2BAA2B,KAAK,WAAW,KAAK,SAAS,IAC1F,yBAAyB,SAAS,mBAAmB,KAAK,WAAW,KAAK,SAAS,IACnF,6BAA6B,SAAS,KAAK,EAE3C,OAAO,EAAE,MAAM,0BAA0B;CAE1C,IAAI,QAAQ,SAAS,qBAAqB,2BACzC,OAAO,EAAE,MAAM,qBAAqB;CAErC,IACC,gBAAgB,QAAQ,SAAS,gBAAgB,KAAK,WAAW,KAAK,SAAS,IAC/E,gBAAgB,QAAQ,SAAS,YAAY,KAAK,WAAW,KAAK,SAAS,IAC3E,yBAAyB,SAAS,oBAAoB,KAAK,WAAW,KAAK,SAAS,EAEpF,OAAO,EAAE,MAAM,qBAAqB;CAErC,OAAO,EAAE,MAAM,WAAW;;AAG3B,SAAgB,8BACf,SACA,MACU;CACV,OAAO,4BAA4B,SAAS,KAAK,CAAC,SAAS;;;;AC/E5D,MAAa,yBAAyB,EACpC,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;AAIV,MAAa,2BAA2B,EACtC,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,2BAA2B,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACtE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CAC3D,kBAAkB,EAChB,KAAK,CAAC,iCAAiC,0BAA0B,CAAC,CAClE,QAAQ,gCAAgC;CAC1C,yBAAyB,EACvB,OACA,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,EACE,OAAO;EACP,kBAAkB;EAClB,iBAAiB;EACjB,CAAC,CACD,QAAQ,CACV,CACA,QAAQ,EAAE,CAAC;CACb,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACnE,YAAY,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACvD,CAAC,CACD,QAAQ;AAIV,MAAM,kCAAkC,EACtC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ;AAEV,MAAM,gCAAgC,EACpC,OAAO;CACP,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5D,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACjD,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;CAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC7C,CAAC,CACD,QAAQ;AASV,MAAM,8BAA8B,EAClC,OAAO;CACP,UAAU,8BAA8B,QAAQ;EARjD,sBAAsB,EAAE;EACxB,WAAW,EAAE;EACb,oBAAoB;EACpB,OAAO,EAAE;EAKsE,CAAC,CAAC,UAAU;CAC1F,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,mCAAmC,EAC9C,OAAO;CACP,UAAU,EACR,OAAO,EACP,kBAAkB,2BAA2B,MAAM,iBAAiB,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAChF,SAAS,EACP,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAC/C,QAAQ,CACR,UAAU;CACZ,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG;EACtD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,OAAO,EACL,OAAO,EACP,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAO,EACzD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,CAAC,CACD,QAAQ;AAIV,MAAa,iCAAiC,EAC5C,OAAO;CACP,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;CAC7C,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAChF,wBAAwB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ;CACpD,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS;EACpB,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;CACV,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ;CACvE,UAAU;CACV,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,WAAW,mBACX,CAAC,CACD,QAAQ;AAIV,SAAS,oBAAoB,MAAuB;CACnD,MAAM,iBAAiB,KAAK,aAAa;CACzC,OACC,mBAAmB,eAAe,mBAAmB,eAAe,mBAAmB;;AAIzF,MAAa,uBAAuB,EAClC,OAAO;CACP,QAAQ,EACN,OAAO;EACP,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,OAAO,qBAAqB,EAC5B,SAAS,oEACT,CAAC,CACD,QAAQ,YAAY;EACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAO,CAAC,QAAQ,MAAO;EACzD,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,MAAM;EAAa,MAAM;EAAQ,CAAC;CAC9C,MAAM,EACJ,OAAO,EACP,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,gBAAgB,EACtD,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,YAAY,iBAAiB,CAAC;CAC1C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;CACzD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,SAAS,kBAAkB,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAa,wBAAwB,EACnC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,cAAc,4BAA4B,UAAU;CACpD,UAAU,qBAAqB,UAAU;CACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CAC3E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;EAEF;AAOH,MAAa,sCAAsC,EACjD,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAM,iBAA2C;CAChD,UAAU,2BAA2B,MAAM,EAAE,CAAC;CAC9C,OAAO,EAAE,cAAc,KAAQ;CAC/B,mBAAmB,EAAE;CACrB,yBAAyB,EAAE;CAC3B,wBAAwB,EAAE;CAC1B,SAAS,EAAE,SAAS,OAAO;CAC3B,eAAe;EAAE,SAAS;EAAM,eAAe;EAAI;CACnD;AAID,eAAsB,oBAAoB,YAA8C;CACvF,OAAO,sBAAsB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGzE,SAAS,kBACR,YACA,UAC8B;CAC9B,OAAO,OAAO,QAAQ,WAAW,CAAC,SAAS,CAAC,WAAW,YACtD,SAAS,OAAO,CAAC,KAAK,cAAc;EAAE;EAAW;EAAU,EAAE,CAC7D;;AAGF,SAAS,kBAAkB,UAAiD;CAC3E,OAAO,SAAS,UAAU,MAAM,EAAE,GAAG,SAAS;;AAG/C,SAAS,wBAAwB,UAAuC;CACvE,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS;;AAG1D,SAAS,iBACR,YACkD;CAClD,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CAAC,QAAQ,GAAG,YAAY,wBAAwB,OAAO,MAAM,CAAC,CACxF;;AAGF,SAAS,yBACR,YACA,kBACuB;CACvB,OAAO,2BAA2B,MAAM;EACvC,2BAA2B,kBAAkB,aAAa,WAAW,CACpE,GAAG,kBAAkB,OAAO,MAAM,gBAAgB,EAClD,GAAI,OAAO,UAAU,wBAAwB,EAAE,CAC/C,CAAC;EACF;EACA,gBAAgB,kBAAkB,aAAa,WAAW,CACzD,GAAG,kBAAkB,OAAO,MAAM,iBAAiB,EACnD,GAAI,OAAO,UAAU,aAAa,EAAE,CACpC,CAAC;EACF,yBAAyB,OAAO,YAC/B,OAAO,QAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,CAAC,CAClF;EACD,6BAA6B,OAAO,QAAQ,WAAW,CACrD,QAAQ,GAAG,YAAY,OAAO,UAAU,mBAAmB,CAC3D,KAAK,CAAC,eAAe,UAAU;EACjC,YAAY,kBAAkB,aAAa,WAAW,OAAO,UAAU,SAAS,EAAE,CAAC;EACnF,CAAC;;AAGH,SAAS,+BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,YAAY,OAAO,MAAM,UAAU,IAAI,CAClD,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,kBAAkB,OAAO,MAAM,CAAC,CAAC,CAC5E;;AAGF,SAAS,8BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,aAAa,OAAO,MAAM,QAAQ,EAAE,EAAE,SAAS,EAAE,CAC5D,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,QAAQ,EAAE,CAAC,CAAC,CACpE;;AAGF,SAAS,6BACR,YACA,SAC2B;CAC3B,MAAM,mBACL,QAAQ,UAAU,oBAAoB,eAAe,SAAS;CAC/D,MAAM,0BAA0B,iBAAiB,WAAW;CAC5D,OAAO,+BAA+B,MAAM;EAC3C,UAAU,yBAAyB,yBAAyB,iBAAiB;EAC7E,OAAO,QAAQ,SAAS,eAAe;EACvC,mBAAmB,OAAO,KAAK,wBAAwB;EACvD,yBAAyB,+BAA+B,wBAAwB;EAChF,wBAAwB,8BAA8B,wBAAwB;EAC9E,SAAS,QAAQ,WAAW,eAAe;EAC3C,eAAe,QAAQ,iBAAiB,eAAe;EACvD,CAAC;;AAGH,SAAgB,wBACf,QACA,aAC2B;CAC3B,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,MAAM,wBAAwB,YAAY,GAAG;CAExD,OAAO,6BAA6B,QAAQ,YAAY,QAAQ;;AAGjE,SAAgB,kCAAkC,QAA6B;CAC9E,IAAI,OAAO,WAAW,eACrB,OAAO,MAAM,OAAO,KAAK;CAE1B,OAAO,OAAO;;;;AC1Uf,MAAa,+BAA+B,EAC1C,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,qBAAqB,OAAO,kBAAkB,OAAO,gBAAgB,EACxE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,kBAAkB;EACzB,CAAC;EAEF;AAIH,MAAa,iCAAiC,EAAE,mBAAmB,QAAQ;CAC1E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,eAAe,EAAE,CAAC,CAAC,QAAQ;CACtD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,yBAAyB,EAAE,CAAC,CAAC,QAAQ;CAChE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,EAAE,CAAC,CAAC,QAAQ;CACxD,CAAC;AAIF,MAAa,mCAAmC,EAC9C,OAAO;CACP,SAAS;CACT,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,oCAAoC,EAC/C,OAAO,EACP,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC,EACvF,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,yBAAyB,EACpC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAC5E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;CAGH,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAAQ,OAAO,OAAO,EACjE,IAAI,OAAO,SAAS,YAAY,aAAa,KAAA,GAC5C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS,sBAAsB,QAAQ,gCAAgC,YAAY,QAAQ;EAC3F,MAAM;GAAC;GAAU;GAAS;GAAU;EACpC,CAAC;EAGH;AAIH,eAAsB,qBAAqB,YAA+C;CACzF,OAAO,uBAAuB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAG1E,MAAa,yCAAyC,EACpD,OAAO;CACP,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAMV,MAAa,gCAAgC,EAC3C,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,uCAAuC;CAC/E,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,0DACZ;AAMD,MAAa,iDAAiD,EAC5D,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,YAAY,EAAE,OACb,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,wDACA;CACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC,CACD,QAAQ;AAWV,SAAgB,8BACf,OAC0B;CAC1B,MAAM,cAAc,MAAM,OAAO,OAAO,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,sBAAsB,MAAM,QAAQ,sBAAsB;CAG3E,MAAM,gBAAgB,MAAM,OAAO,SAAS,YAAY;CACxD,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MACT,sBAAsB,MAAM,QAAQ,gCAAgC,YAAY,QAAQ,IACxF;CAGF,MAAM,aAAa,OAAO,YACzB,OAAO,QAAQ,cAAc,aAAa,CACxC,QAAQ,GAAG,sBAAsB,iBAAiB,QAAQ,SAAS,eAAe,CAClF,KAAK,CAAC,WAAW,sBAAsB,CACvC,WACA;EACC,OAAO,iBAAiB;EACxB,OAAO,iBAAiB;EACxB,CACD,CAAC,CACH;CAED,OAAO,8BAA8B,MAAM;EAC1C,SAAS,MAAM;EACf;EACA,SAAS,YAAY;EACrB,CAAC;;AAQH,SAAgB,+CACf,OAC2C;CAC3C,MAAM,cAAc,MAAM,OAAO,OAAO,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,sBAAsB,MAAM,QAAQ,sBAAsB;CAG3E,MAAM,gBAAgB,MAAM,OAAO,SAAS,YAAY;CACxD,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MACT,sBAAsB,MAAM,QAAQ,gCAAgC,YAAY,QAAQ,IACxF;CAGF,MAAM,aAAa,OAAO,YACzB,OAAO,QAAQ,cAAc,aAAa,CACxC,QAAQ,GAAG,sBAAsB,iBAAiB,QAAQ,SAAS,yBAAyB,CAC5F,KAAK,CAAC,WAAW,sBAAsB,CACvC,WACA;EACC,OAAO,iBAAiB;EACxB,OAAO,iBAAiB;EACxB,CACD,CAAC,CACH;CAED,OAAO,+CAA+C,MAAM;EAC3D,SAAS,MAAM;EACf;EACA,SAAS,YAAY;EACrB,CAAC;;AAGH,SAAS,qBACR,MACA,OACU;CACV,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,MAAM;CACzB,IAAI,cAAc,OAAO,eAAe,KACvC,OAAO;CAER,IAAI,cAAc,KAAK;EACtB,IAAI,eAAe,KAClB,OAAO;EAER,OAAO,WAAW,MAAM,aAAa,CAAC,KAAK,KAAK,SAAS,SAAS,CAAC;;CAEpE,IAAI,eAAe,KAClB,OAAO,UAAU,MAAM,aAAa,CAAC,MAAM,KAAK,SAAS,SAAS,CAAC;CAEpE,OAAO,UAAU,MACf,aACA,WAAW,SAAS,SAAS,IAC7B,CAAC,KAAK,KAAK,SAAS,SAAS,IAC7B,CAAC,MAAM,KAAK,SAAS,SAAS,CAC/B;;;;AC7OF,MAAa,gCAAgC;CAC5C,KAAK;CACL,WAAW;CACX,YAAY;CACZ;AAED,MAAa,2BAA2B;CACvC,KAAK;CACL,WAAW;CACX,YAAY;CACZ;AAED,MAAa,6BAA6B;CACzC,sBAAsB;CACtB,4BAA4B;CAC5B,6BAA6B;CAC7B;AAQD,SAAS,aAAa,QAAiC,UAA2C;CACjG,OAAO;EACN,KAAK;EACL,GAAG;EACH;;AAGF,SAAgB,sCAAqE;CACpF,OAAO;EACN,KAAK,aACJ,IAAI,aAAa,iBAAiB,EAAE,QAAQ,YAAY,CAAC,EACzD,yBAAyB,IACzB;EACD,WAAW,aACV,IAAI,aAAa,uBAAuB,EAAE,QAAQ,YAAY,CAAC,EAC/D,yBAAyB,UACzB;EACD,YAAY,aACX,IAAI,aAAa,wBAAwB,EAAE,QAAQ,YAAY,CAAC,EAChE,yBAAyB,WACzB;EACD"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-approval-policy.ts","../src/mcp-portal-config.ts","../src/tool-portal-config.ts","../src/schema-artifacts.ts"],"sourcesContent":["import { readFile } from 'node:fs/promises';\n\nimport { parse, type ParseError, type ParseOptions, printParseErrorCode } from 'jsonc-parser';\n\nconst parseJsoncToUnknown: (text: string, errors: ParseError[], options: ParseOptions) => unknown =\n\tparse;\n\nfunction formatLineColumn(text: string, offset: number): string {\n\tconst prefix = text.slice(0, offset);\n\tconst line = prefix.split('\\n').length;\n\tconst lastLineBreakIndex = prefix.lastIndexOf('\\n');\n\tconst column = offset - lastLineBreakIndex;\n\treturn `line ${line}, column ${column}`;\n}\n\nfunction formatParseError(filePath: string, text: string, error: ParseError): string {\n\treturn [\n\t\t`Invalid JSONC in ${filePath}: ${formatLineColumn(text, error.offset)}:`,\n\t\tprintParseErrorCode(error.error),\n\t].join(' ');\n}\n\nexport async function loadJsonConfigFile(filePath: string): Promise<unknown> {\n\tconst rawConfig = await readFile(filePath, 'utf8');\n\tconst parseErrors: ParseError[] = [];\n\tconst parsedConfig = parseJsoncToUnknown(rawConfig, parseErrors, {\n\t\tallowTrailingComma: true,\n\t\tdisallowComments: false,\n\t});\n\n\tif (parseErrors.length > 0) {\n\t\tconst firstParseError = parseErrors[0];\n\t\tif (firstParseError !== undefined) {\n\t\t\tthrow new Error(formatParseError(filePath, rawConfig, firstParseError));\n\t\t}\n\t}\n\n\treturn parsedConfig;\n}\n","import { z } from 'zod';\n\nexport type JsonPrimitive = boolean | null | number | string;\nexport type JsonArray = JsonValue[];\nexport type JsonObject = { [key: string]: JsonValue };\nexport type JsonValue = JsonArray | JsonObject | JsonPrimitive;\n\nexport const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n\tz.union([\n\t\tz.string(),\n\t\tz.number().finite(),\n\t\tz.boolean(),\n\t\tz.null(),\n\t\tz.array(jsonValueSchema),\n\t\tjsonObjectSchema,\n\t]),\n);\n\nexport const jsonObjectSchema: z.ZodType<JsonObject> = z.record(z.string(), jsonValueSchema);\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function assertJsonObject(value: unknown, label: string): JsonObject {\n\tif (!isJsonObject(value)) {\n\t\tthrow new Error(`${label} must be a JSON object.`);\n\t}\n\n\treturn jsonObjectSchema.parse(value);\n}\n","import { z } from 'zod';\n\nexport const secretFormatSchema = z.discriminatedUnion('kind', [\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('bearer'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('prefix'),\n\t\t\tprefix: z\n\t\t\t\t.string()\n\t\t\t\t.min(1, 'secret format prefix must not be empty.')\n\t\t\t\t.max(64, 'secret format prefix must be 64 characters or fewer.')\n\t\t\t\t.refine(\n\t\t\t\t\t(value) => !/\\s/u.test(value),\n\t\t\t\t\t'secret format prefix must not contain whitespace; agent-vm inserts one space.',\n\t\t\t\t),\n\t\t})\n\t\t.strict(),\n]);\n\nconst environmentSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('environment'),\n\t\tname: z.string().min(1),\n\t})\n\t.strict();\n\nconst onePasswordSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('1password'),\n\t\tref: z.string().regex(/^op:\\/\\//u, '1Password refs must start with op://'),\n\t})\n\t.strict();\n\nexport const secretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema,\n\tonePasswordSecretValueSchema,\n]);\n\nexport const formattedSecretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n\tonePasswordSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n]);\n\nexport type SecretFormat = z.infer<typeof secretFormatSchema>;\nexport type SecretValue = z.infer<typeof secretValueSchema>;\nexport type FormattedSecretValue = z.infer<typeof formattedSecretValueSchema>;\n\nexport function formatSecretValue(secret: FormattedSecretValue, rawValue: string): string {\n\tif (secret.format === undefined) {\n\t\treturn rawValue;\n\t}\n\tswitch (secret.format.kind) {\n\t\tcase 'bearer':\n\t\t\treturn `Bearer ${rawValue}`;\n\t\tcase 'prefix':\n\t\t\treturn `${secret.format.prefix} ${rawValue}`;\n\t\tdefault: {\n\t\t\tconst exhaustiveFormat: never = secret.format;\n\t\t\treturn exhaustiveFormat;\n\t\t}\n\t}\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { formattedSecretValueSchema, type FormattedSecretValue } from './secret-value.js';\n\nconst mcpProviderDiscoverySchema = z\n\t.object({\n\t\tsummary: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nconst remoteTransportUrlSchema = z.url().refine(\n\t(value) => {\n\t\tconst protocol = new URL(value).protocol;\n\t\treturn protocol === 'http:' || protocol === 'https:';\n\t},\n\t{ message: 'Remote MCP transport URLs must use http or https.' },\n);\n\nconst connectionTimeoutMsSchema = z.number().int().min(1).max(300_000);\n\nconst streamableHttpTransportSchema = z\n\t.object({\n\t\tkind: z.literal('streamable-http'),\n\t\turl: remoteTransportUrlSchema,\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst sseTransportSchema = z\n\t.object({\n\t\tkind: z.literal('sse'),\n\t\turl: remoteTransportUrlSchema,\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst stdioTransportSchema = z\n\t.object({\n\t\tkind: z.literal('stdio'),\n\t\tcommand: z.string().min(1),\n\t\targs: z.array(z.string()).default([]),\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\tcwd: z.string().min(1).optional(),\n\t\tenv: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\tnetworkAccess: z.enum(['declared', 'none']).optional(),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport const mcpSecretPolicySchema = z\n\t.object({\n\t\thosts: z.array(z.string()).default([]),\n\t\tinjection: z.enum(['env', 'http-mediation']),\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (policy.injection === 'http-mediation' && policy.hosts.length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'http-mediation secret policies must declare at least one host.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t\tif (policy.injection === 'env' && policy.hosts.length > 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'env secret policies must not declare hosts.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t});\n\nexport const mcpProviderSchema = z\n\t.object({\n\t\tkind: z.literal('mcp'),\n\t\tnamespace: z.string().min(1),\n\t\tdiscovery: mcpProviderDiscoverySchema.default({}),\n\t\tsecretPolicies: z.record(z.string().min(1), mcpSecretPolicySchema).default({}),\n\t\ttransport: z.discriminatedUnion('kind', [\n\t\t\tstreamableHttpTransportSchema,\n\t\t\tsseTransportSchema,\n\t\t\tstdioTransportSchema,\n\t\t]),\n\t})\n\t.strict();\n\nexport const mcpConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tproviders: z.record(z.string().min(1), mcpProviderSchema).default({}),\n\t})\n\t.strict();\n\nexport type McpConfig = z.infer<typeof mcpConfigSchema>;\nexport type McpProvider = z.infer<typeof mcpProviderSchema>;\n\nexport type ResolvedMcpProvider =\n\t| {\n\t\t\treadonly connectionTimeoutMs?: number;\n\t\t\treadonly headers: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'streamable-http' | 'sse';\n\t\t\treadonly url: string;\n\t  }\n\t| {\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly command: string;\n\t\t\treadonly connectionTimeoutMs?: number;\n\t\t\treadonly cwd?: string;\n\t\t\treadonly env: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'stdio';\n\t  };\n\nexport async function loadMcpConfig(configPath: string): Promise<McpConfig> {\n\treturn mcpConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport function mcpConfigToResolvedProviders(config: McpConfig): readonly ResolvedMcpProvider[] {\n\treturn Object.values(config.providers).map((provider) => {\n\t\tconst transport = provider.transport;\n\t\tif (transport.kind === 'stdio') {\n\t\t\tconst resolvedProvider: {\n\t\t\t\targs: readonly string[];\n\t\t\t\tcommand: string;\n\t\t\t\tconnectionTimeoutMs?: number;\n\t\t\t\tcwd?: string;\n\t\t\t\tenv: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\t\tnamespace: string;\n\t\t\t\ttransport: 'stdio';\n\t\t\t} = {\n\t\t\t\targs: transport.args,\n\t\t\t\tcommand: transport.command,\n\t\t\t\tenv: transport.env,\n\t\t\t\tnamespace: provider.namespace,\n\t\t\t\ttransport: transport.kind,\n\t\t\t};\n\t\t\tif (transport.connectionTimeoutMs !== undefined) {\n\t\t\t\tresolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;\n\t\t\t}\n\t\t\tif (transport.cwd !== undefined) {\n\t\t\t\tresolvedProvider.cwd = transport.cwd;\n\t\t\t}\n\t\t\treturn resolvedProvider;\n\t\t}\n\n\t\tconst resolvedProvider: {\n\t\t\tconnectionTimeoutMs?: number;\n\t\t\theaders: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\tnamespace: string;\n\t\t\ttransport: 'streamable-http' | 'sse';\n\t\t\turl: string;\n\t\t} = {\n\t\t\theaders: transport.headers,\n\t\t\tnamespace: provider.namespace,\n\t\t\ttransport: transport.kind,\n\t\t\turl: transport.url,\n\t\t};\n\t\tif (transport.connectionTimeoutMs !== undefined) {\n\t\t\tresolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;\n\t\t}\n\t\treturn resolvedProvider;\n\t});\n}\n","import type { NamespaceToolRef, ResolvedMcpPortalProfile } from './mcp-portal-config.js';\n\nexport interface McpPortalApprovalToolAnnotations {\n\treadonly destructiveHint?: boolean | undefined;\n\treadonly readOnlyHint?: boolean | undefined;\n}\n\nexport interface McpPortalApprovalToolCall {\n\treadonly annotations?: McpPortalApprovalToolAnnotations;\n\treadonly namespace: string;\n\treadonly toolName: string;\n}\n\nfunction selectorMatches(\n\tselectors: readonly NamespaceToolRef[],\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\treturn selectors.some(\n\t\t(selector) => selector.namespace === namespace && selector.toolName === toolName,\n\t);\n}\n\nfunction namespaceSelectorMatches(\n\tprofile: ResolvedMcpPortalProfile,\n\tselectorKind: 'requiresApproval' | 'withoutApproval',\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\tconst selector = (profile.approval.callPoliciesByNamespace ?? {})[namespace]?.[selectorKind];\n\tif (selector === undefined) {\n\t\treturn false;\n\t}\n\tif ((selector.deny ?? []).includes(toolName)) {\n\t\treturn false;\n\t}\n\treturn selector.allow === '*' || selector.allow.includes(toolName);\n}\n\nfunction hasTrustedReadOnlyAnnotation(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn (\n\t\tprofile.approval.annotationPolicy === 'destructive-requires-approval' &&\n\t\tprofile.approval.trustedAnnotationNamespaces.includes(call.namespace) &&\n\t\tcall.annotations?.readOnlyHint === true &&\n\t\tcall.annotations.destructiveHint !== true\n\t);\n}\n\nexport type McpPortalCallPolicyDecision =\n\t| { readonly kind: 'allow_without_approval' }\n\t| { readonly kind: 'blocked' }\n\t| { readonly kind: 'requires_approval' };\n\nexport function mcpPortalCallPolicyDecision(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): McpPortalCallPolicyDecision {\n\tif (\n\t\tselectorMatches(profile.approval.allowWithoutApprovalTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'withoutApproval', call.namespace, call.toolName) ||\n\t\thasTrustedReadOnlyAnnotation(profile, call)\n\t) {\n\t\treturn { kind: 'allow_without_approval' };\n\t}\n\tif (profile.approval.annotationPolicy === 'always-require-approval') {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\tif (\n\t\tselectorMatches(profile.approval.alwaysAskTools, call.namespace, call.toolName) ||\n\t\tselectorMatches(profile.approval.writeTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'requiresApproval', call.namespace, call.toolName)\n\t) {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\treturn { kind: 'blocked' };\n}\n\nexport function mcpPortalCallRequiresApproval(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn mcpPortalCallPolicyDecision(profile, call).kind === 'requires_approval';\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema, type SecretValue } from './secret-value.js';\n\nexport const namespaceToolRefSchema = z\n\t.object({\n\t\tnamespace: z.string().min(1),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\n\nexport type NamespaceToolRef = z.infer<typeof namespaceToolRefSchema>;\n\nexport const portalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type PortalToolSelector = z.infer<typeof portalToolSelectorSchema>;\n\nexport const portalApprovalConfigSchema = z\n\t.object({\n\t\tallowWithoutApprovalTools: z.array(namespaceToolRefSchema).default([]),\n\t\talwaysAskTools: z.array(namespaceToolRefSchema).default([]),\n\t\tannotationPolicy: z\n\t\t\t.enum(['destructive-requires-approval', 'always-require-approval'])\n\t\t\t.default('destructive-requires-approval'),\n\t\tcallPoliciesByNamespace: z\n\t\t\t.record(\n\t\t\t\tz.string().min(1),\n\t\t\t\tz\n\t\t\t\t\t.object({\n\t\t\t\t\t\trequiresApproval: portalToolSelectorSchema,\n\t\t\t\t\t\twithoutApproval: portalToolSelectorSchema,\n\t\t\t\t\t})\n\t\t\t\t\t.strict(),\n\t\t\t)\n\t\t\t.default({}),\n\t\ttrustedAnnotationNamespaces: z.array(z.string().min(1)).default([]),\n\t\twriteTools: z.array(namespaceToolRefSchema).default([]),\n\t})\n\t.strict();\n\nexport type PortalApprovalConfig = z.infer<typeof portalApprovalConfigSchema>;\n\nconst portalNamespaceCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: portalToolSelectorSchema,\n\t\twithoutApproval: portalToolSelectorSchema,\n\t})\n\t.strict();\n\nconst portalNamespaceApprovalSchema = z\n\t.object({\n\t\tallowWithoutApproval: z.array(z.string().min(1)).default([]),\n\t\talwaysAsk: z.array(z.string().min(1)).default([]),\n\t\ttrustedAnnotations: z.boolean().default(false),\n\t\twrite: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst defaultPortalNamespaceApproval = {\n\tallowWithoutApproval: [],\n\talwaysAsk: [],\n\ttrustedAnnotations: false,\n\twrite: [],\n} satisfies z.infer<typeof portalNamespaceApprovalSchema>;\n\nconst portalNamespacePolicySchema = z\n\t.object({\n\t\tapproval: portalNamespaceApprovalSchema.default(defaultPortalNamespaceApproval).optional(),\n\t\tcalls: portalNamespaceCallPolicySchema,\n\t\ttools: portalToolSelectorSchema,\n\t})\n\t.strict();\n\ntype PortalNamespacePolicy = z.infer<typeof portalNamespacePolicySchema>;\n\nexport const mcpPortalProfileDefinitionSchema = z\n\t.object({\n\t\tapproval: z\n\t\t\t.object({\n\t\t\t\tannotationPolicy: portalApprovalConfigSchema.shape.annotationPolicy.optional(),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tnamespaces: z.record(z.string().min(1), portalNamespacePolicySchema).default({}),\n\t\tlogging: z\n\t\t\t.object({ enabled: z.boolean().default(false) })\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean().default(true),\n\t\t\t\tmaxNamespaces: z.number().int().positive().default(12),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tcache: z\n\t\t\t.object({\n\t\t\t\tcatalogTtlMs: z.number().int().positive().default(60_000),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalProfileDefinition = z.infer<typeof mcpPortalProfileDefinitionSchema>;\n\nexport const resolvedMcpPortalProfileSchema = z\n\t.object({\n\t\tenabledNamespaces: z.array(z.string().min(1)),\n\t\tenabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\thiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\tlogging: z.object({ enabled: z.boolean() }).strict(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean(),\n\t\t\t\tmaxNamespaces: z.number().int().positive(),\n\t\t\t})\n\t\t\t.strict(),\n\t\tcache: z.object({ catalogTtlMs: z.number().int().positive() }).strict(),\n\t\tapproval: portalApprovalConfigSchema,\n\t})\n\t.strict();\n\nexport type ResolvedMcpPortalProfile = z.infer<typeof resolvedMcpPortalProfileSchema>;\n\nexport const mcpPortalExternalAuthSchema = z\n\t.object({\n\t\tmasterKey: secretValueSchema,\n\t})\n\t.strict();\n\nexport type McpPortalExternalAuthConfig = z.infer<typeof mcpPortalExternalAuthSchema>;\n\nfunction isLoopbackProxyHost(host: string): boolean {\n\tconst normalizedHost = host.toLowerCase();\n\treturn (\n\t\tnormalizedHost === 'localhost' || normalizedHost === '127.0.0.1' || normalizedHost === '::1'\n\t);\n}\n\nexport const mcpPortalProxySchema = z\n\t.object({\n\t\tserver: z\n\t\t\t.object({\n\t\t\t\thost: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.min(1)\n\t\t\t\t\t.refine(isLoopbackProxyHost, {\n\t\t\t\t\t\tmessage: 'mcpProxy.server.host must be loopback-only for HTTP bearer auth.',\n\t\t\t\t\t})\n\t\t\t\t\t.default('127.0.0.1'),\n\t\t\t\tport: z.number().int().min(1).max(65_535).default(18_791),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ host: '127.0.0.1', port: 18_791 }),\n\t\tauth: z\n\t\t\t.object({\n\t\t\t\theaderName: z.string().min(1).default('authorization'),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ headerName: 'authorization' }),\n\t})\n\t.strict();\n\nexport type McpPortalProxyConfig = z.infer<typeof mcpPortalProxySchema>;\n\nexport const mcpPortalAgentConfigSchema = z\n\t.object({\n\t\tcredentialVersion: z.number().int().positive().default(1),\n\t\tprofile: z.string().min(1),\n\t\thmacKey: secretValueSchema.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalAgentConfig = z.infer<typeof mcpPortalAgentConfigSchema>;\n\nexport const mcpPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\texternalAuth: mcpPortalExternalAuthSchema.optional(),\n\t\tmcpProxy: mcpPortalProxySchema.optional(),\n\t\tagents: z.record(z.string().min(1), mcpPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), mcpPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'mcp-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\t});\n\ntype ParsedMcpPortalConfig = z.infer<typeof mcpPortalConfigSchema>;\nexport type McpPortalConfig = Omit<ParsedMcpPortalConfig, 'agents'> & {\n\treadonly agents: Readonly<Record<string, McpPortalAgentConfig>>;\n};\n\nexport const openClawMcpPortalPluginConfigSchema = z\n\t.object({\n\t\tconfigDir: z.string().min(1),\n\t\tbinPath: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nexport type OpenClawMcpPortalPluginConfig = z.infer<typeof openClawMcpPortalPluginConfigSchema>;\n\nconst defaultProfile: ResolvedMcpPortalProfile = {\n\tapproval: portalApprovalConfigSchema.parse({}),\n\tcache: { catalogTtlMs: 60_000 },\n\tenabledNamespaces: [],\n\tenabledToolsByNamespace: {},\n\thiddenToolsByNamespace: {},\n\tlogging: { enabled: false },\n\tpromptContext: { enabled: true, maxNamespaces: 12 },\n};\n\ntype AuthoredPortalNamespaces = McpPortalProfileDefinition['namespaces'];\n\nexport async function loadMcpPortalConfig(configPath: string): Promise<McpPortalConfig> {\n\treturn mcpPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nfunction namespaceToolRefs(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tselector: (policy: PortalNamespacePolicy) => readonly string[],\n): readonly NamespaceToolRef[] {\n\treturn Object.entries(namespaces).flatMap(([namespace, policy]) =>\n\t\tselector(policy).map((toolName) => ({ namespace, toolName })),\n\t);\n}\n\nfunction selectorAllowList(selector: PortalToolSelector): readonly string[] {\n\treturn selector.allow === '*' ? [] : selector.allow;\n}\n\nfunction selectorHasVisibleTools(selector: PortalToolSelector): boolean {\n\treturn selector.allow === '*' || selector.allow.length > 0;\n}\n\nfunction activeNamespaces(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Readonly<Record<string, PortalNamespacePolicy>> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces).filter(([, policy]) => selectorHasVisibleTools(policy.tools)),\n\t);\n}\n\nfunction compileNamespaceApproval(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tannotationPolicy: PortalApprovalConfig['annotationPolicy'],\n): PortalApprovalConfig {\n\treturn portalApprovalConfigSchema.parse({\n\t\tallowWithoutApprovalTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.withoutApproval),\n\t\t\t...(policy.approval?.allowWithoutApproval ?? []),\n\t\t]),\n\t\tannotationPolicy,\n\t\talwaysAskTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.requiresApproval),\n\t\t\t...(policy.approval?.alwaysAsk ?? []),\n\t\t]),\n\t\tcallPoliciesByNamespace: Object.fromEntries(\n\t\t\tObject.entries(namespaces).map(([namespace, policy]) => [namespace, policy.calls]),\n\t\t),\n\t\ttrustedAnnotationNamespaces: Object.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.approval?.trustedAnnotations)\n\t\t\t.map(([namespace]) => namespace),\n\t\twriteTools: namespaceToolRefs(namespaces, (policy) => policy.approval?.write ?? []),\n\t});\n}\n\nfunction compileEnabledToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.tools.allow !== '*')\n\t\t\t.map(([namespace, policy]) => [namespace, selectorAllowList(policy.tools)]),\n\t);\n}\n\nfunction compileHiddenToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => (policy.tools.deny ?? []).length > 0)\n\t\t\t.map(([namespace, policy]) => [namespace, policy.tools.deny ?? []]),\n\t);\n}\n\nfunction compileProfileFromNamespaces(\n\tnamespaces: AuthoredPortalNamespaces,\n\tprofile: McpPortalProfileDefinition,\n): ResolvedMcpPortalProfile {\n\tconst annotationPolicy =\n\t\tprofile.approval?.annotationPolicy ?? defaultProfile.approval.annotationPolicy;\n\tconst activeNamespacePolicies = activeNamespaces(namespaces);\n\treturn resolvedMcpPortalProfileSchema.parse({\n\t\tapproval: compileNamespaceApproval(activeNamespacePolicies, annotationPolicy),\n\t\tcache: profile.cache ?? defaultProfile.cache,\n\t\tenabledNamespaces: Object.keys(activeNamespacePolicies),\n\t\tenabledToolsByNamespace: compileEnabledToolsByNamespace(activeNamespacePolicies),\n\t\thiddenToolsByNamespace: compileHiddenToolsByNamespace(activeNamespacePolicies),\n\t\tlogging: profile.logging ?? defaultProfile.logging,\n\t\tpromptContext: profile.promptContext ?? defaultProfile.promptContext,\n\t});\n}\n\nexport function resolveMcpPortalProfile(\n\tconfig: McpPortalConfig,\n\tprofileName: string,\n): ResolvedMcpPortalProfile {\n\tconst profile = config.profiles[profileName];\n\tif (profile === undefined) {\n\t\tthrow new Error(`unknown MCP profile '${profileName}'`);\n\t}\n\treturn compileProfileFromNamespaces(profile.namespaces, profile);\n}\n\nexport function secretValueToEnvironmentReference(secret: SecretValue): string {\n\tif (secret.source === 'environment') {\n\t\treturn `\\${${secret.name}}`;\n\t}\n\treturn secret.ref;\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema } from './secret-value.js';\n\nexport const toolPortalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type ToolPortalToolSelector = z.infer<typeof toolPortalToolSelectorSchema>;\n\nexport const toolPortalCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: toolPortalToolSelectorSchema,\n\t\twithoutApproval: toolPortalToolSelectorSchema,\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (toolSelectorsOverlap(policy.requiresApproval, policy.withoutApproval)) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'Tool Portal call policy cannot list one tool in both approval selectors.',\n\t\t\t\tpath: ['withoutApproval'],\n\t\t\t});\n\t\t}\n\t});\n\nexport type ToolPortalCallPolicy = z.infer<typeof toolPortalCallPolicySchema>;\n\nexport const toolPortalBackendKindSchema = z.enum([\n\t'mcp_provider',\n\t'controller_host_action',\n\t'tool_vm_runner',\n]);\n\nconst sandboxOperationDescriptionSchema = z.string().min(1);\nconst sandboxExecutableSchema = z\n\t.string()\n\t.min(1)\n\t.refine((value) => value.startsWith('/') && !value.includes('\\0'), {\n\t\tmessage: 'Sandbox command executables must be absolute and contain no NUL bytes.',\n\t});\nconst sandboxMandatoryArgvPrefixSchema = z\n\t.array(\n\t\tz\n\t\t\t.string()\n\t\t\t.max(4_096)\n\t\t\t.refine((value) => !value.includes('\\0'), {\n\t\t\t\tmessage: 'Sandbox command arguments must contain no NUL bytes.',\n\t\t\t}),\n\t)\n\t.max(64);\nconst sandboxWorkingDirectorySchema = z\n\t.string()\n\t.min(1)\n\t.refine(\n\t\t(value) => !value.includes('\\0') && !value.startsWith('/') && !value.split('/').includes('..'),\n\t\t{\n\t\t\tmessage: 'Sandbox command working directories must stay relative to the Tool VM work root.',\n\t\t},\n\t);\n\nexport const toolPortalSandboxSshOperationDefinitionSchema = z.discriminatedUnion('kind', [\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\texecutable: sandboxExecutableSchema,\n\t\t\tkind: z.literal('command.fixed'),\n\t\t\tmandatoryArgvPrefix: sandboxMandatoryArgvPrefixSchema,\n\t\t\tworkingDirectory: sandboxWorkingDirectorySchema,\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\tkind: z.literal('filesystem.read'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\tkind: z.literal('filesystem.write'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\tkind: z.literal('process.cancel'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\tkind: z.literal('process.logs'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\texecutable: sandboxExecutableSchema,\n\t\t\tkind: z.literal('process.start'),\n\t\t\tmandatoryArgvPrefix: sandboxMandatoryArgvPrefixSchema,\n\t\t\tmaxRuntimeMs: z.number().int().positive().max(3_600_000),\n\t\t\tretainOutputBytes: z.number().int().positive().max(16_777_216),\n\t\t\tworkingDirectory: sandboxWorkingDirectorySchema,\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\tkind: z.literal('process.status'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tdescription: sandboxOperationDescriptionSchema,\n\t\t\tkind: z.literal('process.wait'),\n\t\t\ttimeoutMs: z.number().int().positive().max(3_600_000),\n\t\t})\n\t\t.strict(),\n]);\n\nexport type ToolPortalSandboxSshOperationDefinition = z.infer<\n\ttypeof toolPortalSandboxSshOperationDefinitionSchema\n>;\n\nexport const toolPortalSandboxSshBackendBindingSchema = z\n\t.object({\n\t\tkind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),\n\t\toperations: z\n\t\t\t.record(z.string().min(1), toolPortalSandboxSshOperationDefinitionSchema)\n\t\t\t.refine((operations) => Object.keys(operations).length > 0, {\n\t\t\t\tmessage: 'Tool VM runner bindings must configure at least one operation.',\n\t\t\t}),\n\t\tprofile: z.literal('sandbox_ssh'),\n\t})\n\t.strict();\n\nexport type ToolPortalSandboxSshBackendBinding = z.infer<\n\ttypeof toolPortalSandboxSshBackendBindingSchema\n>;\n\nexport const toolPortalBackendBindingSchema = z.discriminatedUnion('kind', [\n\tz.object({ kind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider) }).strict(),\n\tz.object({ kind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action) }).strict(),\n\ttoolPortalSandboxSshBackendBindingSchema,\n]);\n\nexport type ToolPortalBackendKind = z.infer<typeof toolPortalBackendKindSchema>;\nexport type ToolPortalBackendBinding = z.infer<typeof toolPortalBackendBindingSchema>;\n\nexport const toolPortalNamespacePolicySchema = z\n\t.object({\n\t\tbackend: toolPortalBackendBindingSchema,\n\t\tcalls: toolPortalCallPolicySchema,\n\t\ttools: toolPortalToolSelectorSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalNamespacePolicy = z.infer<typeof toolPortalNamespacePolicySchema>;\n\nexport const toolPortalProfileDefinitionSchema = z\n\t.object({\n\t\tnamespaces: z.record(z.string().min(1), toolPortalNamespacePolicySchema).default({}),\n\t})\n\t.strict();\n\nexport type ToolPortalProfileDefinition = z.infer<typeof toolPortalProfileDefinitionSchema>;\n\nexport const toolPortalAgentConfigSchema = z\n\t.object({\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalAgentConfig = z.infer<typeof toolPortalAgentConfigSchema>;\n\nexport const toolPortalStandaloneAgentAuthenticationSchema = z\n\t.object({\n\t\tapprovalHmacKey: secretValueSchema,\n\t\tbearerKey: secretValueSchema,\n\t\tcredentialVersion: z.number().int().positive(),\n\t})\n\t.strict();\n\nexport type ToolPortalStandaloneAgentAuthentication = z.infer<\n\ttypeof toolPortalStandaloneAgentAuthenticationSchema\n>;\n\nexport const toolPortalStandaloneAuthenticationSchema = z\n\t.object({\n\t\tagents: z.record(z.string().min(1), toolPortalStandaloneAgentAuthenticationSchema),\n\t})\n\t.strict();\n\nexport type ToolPortalStandaloneAuthentication = z.infer<\n\ttypeof toolPortalStandaloneAuthenticationSchema\n>;\n\nexport const toolPortalNetworkAddressSchema = z\n\t.object({\n\t\thost: z.string().min(1),\n\t\tport: z.number().int().min(1).max(65_535),\n\t})\n\t.strict();\n\nexport type ToolPortalNetworkAddress = z.infer<typeof toolPortalNetworkAddressSchema>;\n\nconst toolPortalBearerEntrypointAuthenticationSchema = z\n\t.object({\n\t\tkind: z.literal('bearer'),\n\t})\n\t.strict();\n\nconst toolPortalEntrypointRouteSchema = z\n\t.string()\n\t.min(1)\n\t.refine((route) => route.startsWith('/'), {\n\t\tmessage: 'Tool Portal entrypoint routes must start with \"/\".',\n\t});\n\nexport const toolPortalHttpEntrypointSchema = z\n\t.object({\n\t\taddress: toolPortalNetworkAddressSchema,\n\t\tallowedHosts: z.array(z.string().min(1)).min(1),\n\t\tallowedOrigins: z.array(z.string().url()),\n\t\tauthentication: toolPortalBearerEntrypointAuthenticationSchema,\n\t\tenabled: z.literal(true),\n\t\troute: toolPortalEntrypointRouteSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalHttpEntrypoint = z.infer<typeof toolPortalHttpEntrypointSchema>;\n\nexport const toolPortalMcpEntrypointSchema = z\n\t.object({\n\t\taddress: toolPortalNetworkAddressSchema,\n\t\tallowedHosts: z.array(z.string().min(1)).min(1),\n\t\tallowedOrigins: z.array(z.string().url()),\n\t\tauthentication: toolPortalBearerEntrypointAuthenticationSchema,\n\t\tenabled: z.literal(true),\n\t\troute: toolPortalEntrypointRouteSchema,\n\t\ttransport: z.literal('streamable-http'),\n\t})\n\t.strict();\n\nexport type ToolPortalMcpEntrypoint = z.infer<typeof toolPortalMcpEntrypointSchema>;\n\nexport const toolPortalStdioEntrypointSchema = z\n\t.object({\n\t\tauthentication: z\n\t\t\t.object({\n\t\t\t\tagentId: z.string().min(1),\n\t\t\t\tkind: z.literal('scoped-principal'),\n\t\t\t})\n\t\t\t.strict(),\n\t\tenabled: z.literal(true),\n\t})\n\t.strict();\n\nexport type ToolPortalStdioEntrypoint = z.infer<typeof toolPortalStdioEntrypointSchema>;\n\nexport const toolPortalStandaloneEntrypointsSchema = z\n\t.object({\n\t\thttp: toolPortalHttpEntrypointSchema.optional(),\n\t\tmcp: toolPortalMcpEntrypointSchema.optional(),\n\t\tstdio: toolPortalStdioEntrypointSchema.optional(),\n\t})\n\t.strict();\n\nexport type ToolPortalStandaloneEntrypoints = z.infer<typeof toolPortalStandaloneEntrypointsSchema>;\n\nconst toolPortalCommonConfigShape = {\n\t$schema: z.string().min(1).optional(),\n\tagents: z.record(z.string().min(1), toolPortalAgentConfigSchema).default({}),\n\tprofiles: z.record(z.string().min(1), toolPortalProfileDefinitionSchema),\n\tschemaVersion: z.literal(1),\n} as const;\n\nexport const managedToolPortalConfigSchema = z\n\t.object({\n\t\t...toolPortalCommonConfigShape,\n\t\tmode: z.literal('managed'),\n\t})\n\t.strict();\n\nexport type ManagedToolPortalConfig = z.infer<typeof managedToolPortalConfigSchema>;\n\nexport const standaloneToolPortalConfigSchema = z\n\t.object({\n\t\t...toolPortalCommonConfigShape,\n\t\tauthentication: toolPortalStandaloneAuthenticationSchema,\n\t\tdrain: z\n\t\t\t.object({\n\t\t\t\ttimeoutMs: z.number().int().positive(),\n\t\t\t})\n\t\t\t.strict(),\n\t\tentrypoints: toolPortalStandaloneEntrypointsSchema,\n\t\tmode: z.literal('standalone'),\n\t})\n\t.strict();\n\nexport type StandaloneToolPortalConfig = z.infer<typeof standaloneToolPortalConfigSchema>;\n\nexport const toolPortalConfigSchema = z\n\t.discriminatedUnion('mode', [managedToolPortalConfigSchema, standaloneToolPortalConfigSchema])\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'tool-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\n\t\tfor (const [agentId, agentConfig] of Object.entries(config.agents)) {\n\t\t\tif (config.profiles[agentConfig.profile] === undefined) {\n\t\t\t\tcontext.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `Tool Portal agent \"${agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t\t\t\tpath: ['agents', agentId, 'profile'],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tfor (const [profileId, profile] of Object.entries(config.profiles)) {\n\t\t\tfor (const [namespaceId, namespacePolicy] of Object.entries(profile.namespaces)) {\n\t\t\t\tif (namespacePolicy.backend.kind !== 'tool_vm_runner') {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst operationNames = new Set(Object.keys(namespacePolicy.backend.operations));\n\t\t\t\tfor (const [selectorPath, selector] of [\n\t\t\t\t\t[['tools'], namespacePolicy.tools],\n\t\t\t\t\t[['calls', 'requiresApproval'], namespacePolicy.calls.requiresApproval],\n\t\t\t\t\t[['calls', 'withoutApproval'], namespacePolicy.calls.withoutApproval],\n\t\t\t\t] as const) {\n\t\t\t\t\tconst explicitNames = [\n\t\t\t\t\t\t...(selector.allow === '*' ? [] : selector.allow),\n\t\t\t\t\t\t...selector.deny,\n\t\t\t\t\t];\n\t\t\t\t\tfor (const operationName of explicitNames) {\n\t\t\t\t\t\tif (!operationNames.has(operationName)) {\n\t\t\t\t\t\t\tcontext.addIssue({\n\t\t\t\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\t\t\t\tmessage: `Tool VM runner selector references missing operation \"${operationName}\".`,\n\t\t\t\t\t\t\t\tpath: ['profiles', profileId, 'namespaces', namespaceId, ...selectorPath],\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mode !== 'standalone') {\n\t\t\treturn;\n\t\t}\n\n\t\tfor (const [profileId, profile] of Object.entries(config.profiles)) {\n\t\t\tfor (const [namespaceId, namespacePolicy] of Object.entries(profile.namespaces)) {\n\t\t\t\tif (namespacePolicy.backend.kind === 'mcp_provider') {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tcontext.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `Standalone Tool Portal version 1 does not admit the privileged \"${namespacePolicy.backend.kind}\" backend.`,\n\t\t\t\t\tpath: ['profiles', profileId, 'namespaces', namespaceId, 'backend', 'kind'],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tconst configuredAgentIds = Object.keys(config.agents);\n\t\tif (configuredAgentIds.length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'Standalone Tool Portal must define at least one agent.',\n\t\t\t\tpath: ['agents'],\n\t\t\t});\n\t\t}\n\n\t\tfor (const configuredAgentId of configuredAgentIds) {\n\t\t\tif (config.authentication.agents[configuredAgentId] === undefined) {\n\t\t\t\tcontext.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `Standalone Tool Portal agent \"${configuredAgentId}\" is missing authentication material.`,\n\t\t\t\t\tpath: ['authentication', 'agents', configuredAgentId],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tfor (const authenticatedAgentId of Object.keys(config.authentication.agents)) {\n\t\t\tif (config.agents[authenticatedAgentId] === undefined) {\n\t\t\t\tcontext.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `Standalone Tool Portal authentication references unknown agent \"${authenticatedAgentId}\".`,\n\t\t\t\t\tpath: ['authentication', 'agents', authenticatedAgentId],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tif (Object.values(config.entrypoints).every((entrypoint) => entrypoint === undefined)) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'Standalone Tool Portal must explicitly enable at least one entrypoint.',\n\t\t\t\tpath: ['entrypoints'],\n\t\t\t});\n\t\t}\n\n\t\tconst stdioAgentId = config.entrypoints.stdio?.authentication.agentId;\n\t\tif (stdioAgentId !== undefined && config.agents[stdioAgentId] === undefined) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: `Standalone Tool Portal stdio principal references unknown agent \"${stdioAgentId}\".`,\n\t\t\t\tpath: ['entrypoints', 'stdio', 'authentication', 'agentId'],\n\t\t\t});\n\t\t}\n\t});\n\nexport type ToolPortalConfig = z.infer<typeof toolPortalConfigSchema>;\n\nexport async function loadToolPortalConfig(configPath: string): Promise<ToolPortalConfig> {\n\treturn toolPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport const ToolPortalMcpProjectionNamespaceSchema = z\n\t.object({\n\t\tcalls: toolPortalCallPolicySchema,\n\t\ttools: toolPortalToolSelectorSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalMcpProjectionNamespace = z.infer<\n\ttypeof ToolPortalMcpProjectionNamespaceSchema\n>;\n\nexport const ToolPortalMcpProjectionSchema = z\n\t.object({\n\t\tagentId: z.string().min(1),\n\t\tnamespaces: z.record(z.string().min(1), ToolPortalMcpProjectionNamespaceSchema),\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalMcpProjection = z.infer<typeof ToolPortalMcpProjectionSchema>;\n\nexport const ToolPortalControllerHostActionProjectionNamespaceSchema =\n\tToolPortalMcpProjectionNamespaceSchema;\n\nexport type ToolPortalControllerHostActionProjectionNamespace = z.infer<\n\ttypeof ToolPortalControllerHostActionProjectionNamespaceSchema\n>;\n\nexport const ToolPortalControllerHostActionProjectionSchema = z\n\t.object({\n\t\tagentId: z.string().min(1),\n\t\tnamespaces: z.record(\n\t\t\tz.string().min(1),\n\t\t\tToolPortalControllerHostActionProjectionNamespaceSchema,\n\t\t),\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalControllerHostActionProjection = z.infer<\n\ttypeof ToolPortalControllerHostActionProjectionSchema\n>;\n\nexport interface CreateToolPortalMcpProjectionProps {\n\treadonly agentId: string;\n\treadonly config: ToolPortalConfig;\n}\n\nexport function createToolPortalMcpProjection(\n\tprops: CreateToolPortalMcpProjectionProps,\n): ToolPortalMcpProjection {\n\tconst agentConfig = props.config.agents[props.agentId];\n\tif (agentConfig === undefined) {\n\t\tthrow new Error(`Tool Portal agent \"${props.agentId}\" is not configured.`);\n\t}\n\n\tconst profileConfig = props.config.profiles[agentConfig.profile];\n\tif (profileConfig === undefined) {\n\t\tthrow new Error(\n\t\t\t`Tool Portal agent \"${props.agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t);\n\t}\n\n\tconst namespaces = Object.fromEntries(\n\t\tObject.entries(profileConfig.namespaces)\n\t\t\t.filter(([, namespacePolicy]) => namespacePolicy.backend.kind === 'mcp_provider')\n\t\t\t.map(([namespace, namespacePolicy]) => [\n\t\t\t\tnamespace,\n\t\t\t\t{\n\t\t\t\t\tcalls: namespacePolicy.calls,\n\t\t\t\t\ttools: namespacePolicy.tools,\n\t\t\t\t},\n\t\t\t]),\n\t);\n\n\treturn ToolPortalMcpProjectionSchema.parse({\n\t\tagentId: props.agentId,\n\t\tnamespaces,\n\t\tprofile: agentConfig.profile,\n\t});\n}\n\nexport interface CreateToolPortalControllerHostActionProjectionProps {\n\treadonly agentId: string;\n\treadonly config: ToolPortalConfig;\n}\n\nexport function createToolPortalControllerHostActionProjection(\n\tprops: CreateToolPortalControllerHostActionProjectionProps,\n): ToolPortalControllerHostActionProjection {\n\tconst agentConfig = props.config.agents[props.agentId];\n\tif (agentConfig === undefined) {\n\t\tthrow new Error(`Tool Portal agent \"${props.agentId}\" is not configured.`);\n\t}\n\n\tconst profileConfig = props.config.profiles[agentConfig.profile];\n\tif (profileConfig === undefined) {\n\t\tthrow new Error(\n\t\t\t`Tool Portal agent \"${props.agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t);\n\t}\n\n\tconst namespaces = Object.fromEntries(\n\t\tObject.entries(profileConfig.namespaces)\n\t\t\t.filter(([, namespacePolicy]) => namespacePolicy.backend.kind === 'controller_host_action')\n\t\t\t.map(([namespace, namespacePolicy]) => [\n\t\t\t\tnamespace,\n\t\t\t\t{\n\t\t\t\t\tcalls: namespacePolicy.calls,\n\t\t\t\t\ttools: namespacePolicy.tools,\n\t\t\t\t},\n\t\t\t]),\n\t);\n\n\treturn ToolPortalControllerHostActionProjectionSchema.parse({\n\t\tagentId: props.agentId,\n\t\tnamespaces,\n\t\tprofile: agentConfig.profile,\n\t});\n}\n\nfunction toolSelectorsOverlap(\n\tleft: ToolPortalToolSelector,\n\tright: ToolPortalToolSelector,\n): boolean {\n\tconst leftAllow = left.allow;\n\tconst rightAllow = right.allow;\n\tif (leftAllow === '*' && rightAllow === '*') {\n\t\treturn true;\n\t}\n\tif (leftAllow === '*') {\n\t\tif (rightAllow === '*') {\n\t\t\treturn true;\n\t\t}\n\t\treturn rightAllow.some((toolName) => !left.deny.includes(toolName));\n\t}\n\tif (rightAllow === '*') {\n\t\treturn leftAllow.some((toolName) => !right.deny.includes(toolName));\n\t}\n\treturn leftAllow.some(\n\t\t(toolName) =>\n\t\t\trightAllow.includes(toolName) &&\n\t\t\t!left.deny.includes(toolName) &&\n\t\t\t!right.deny.includes(toolName),\n\t);\n}\n","import * as zod from 'zod';\n\nimport { mcpConfigSchema } from './mcp-config.js';\nimport { mcpPortalConfigSchema } from './mcp-portal-config.js';\nimport { toolPortalConfigSchema } from './tool-portal-config.js';\n\nexport const mcpPortalConfigSchemaVersions = {\n\tmcp: 1,\n\tmcpPortal: 1,\n\ttoolPortal: 1,\n} as const;\n\nexport const mcpPortalConfigSchemaIds = {\n\tmcp: 'agent-vm:mcp:1',\n\tmcpPortal: 'agent-vm:mcp-portal:1',\n\ttoolPortal: 'agent-vm:tool-portal:1',\n} as const;\n\nexport const mcpPortalConfigSchemaPaths = {\n\tmcpFromGatewayConfig: '../../schemas/mcp.schema.json',\n\tmcpPortalFromGatewayConfig: '../../schemas/mcp-portal.schema.json',\n\ttoolPortalFromGatewayConfig: '../../schemas/tool-portal.schema.json',\n} as const;\n\nexport interface ConfigContractSchemaArtifacts {\n\treadonly mcp: Record<string, unknown>;\n\treadonly mcpPortal: Record<string, unknown>;\n\treadonly toolPortal: Record<string, unknown>;\n}\n\nfunction withSchemaId(schema: Record<string, unknown>, schemaId: string): Record<string, unknown> {\n\treturn {\n\t\t$id: schemaId,\n\t\t...schema,\n\t};\n}\n\nexport function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts {\n\treturn {\n\t\tmcp: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcp,\n\t\t),\n\t\tmcpPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcpPortal,\n\t\t),\n\t\ttoolPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(toolPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.toolPortal,\n\t\t),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,sBACL;AAED,SAAS,iBAAiB,MAAc,QAAwB;CAC/D,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO;CAIpC,OAAO,QAHM,OAAO,MAAM,KAAK,CAAC,OAGZ,WADL,SADY,OAAO,YAAY,KACJ;;AAI3C,SAAS,iBAAiB,UAAkB,MAAc,OAA2B;CACpF,OAAO,CACN,oBAAoB,SAAS,IAAI,iBAAiB,MAAM,MAAM,OAAO,CAAC,IACtE,oBAAoB,MAAM,MAAM,CAChC,CAAC,KAAK,IAAI;;AAGZ,eAAsB,mBAAmB,UAAoC;CAC5E,MAAM,YAAY,MAAM,SAAS,UAAU,OAAO;CAClD,MAAM,cAA4B,EAAE;CACpC,MAAM,eAAe,oBAAoB,WAAW,aAAa;EAChE,oBAAoB;EACpB,kBAAkB;EAClB,CAAC;CAEF,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,kBAAkB,YAAY;EACpC,IAAI,oBAAoB,KAAA,GACvB,MAAM,IAAI,MAAM,iBAAiB,UAAU,WAAW,gBAAgB,CAAC;;CAIzE,OAAO;;;;AC9BR,MAAa,kBAAwC,EAAE,WACtD,EAAE,MAAM;CACP,EAAE,QAAQ;CACV,EAAE,QAAQ,CAAC,QAAQ;CACnB,EAAE,SAAS;CACX,EAAE,MAAM;CACR,EAAE,MAAM,gBAAgB;CACxB;CACA,CAAC,CACF;AAED,MAAa,mBAA0C,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB;AAE5F,SAAgB,aAAa,OAAqC;CACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,iBAAiB,OAAgB,OAA2B;CAC3E,IAAI,CAAC,aAAa,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAGnD,OAAO,iBAAiB,MAAM,MAAM;;;;AC3BrC,MAAa,qBAAqB,EAAE,mBAAmB,QAAQ,CAC9D,EACE,OAAO,EACP,MAAM,EAAE,QAAQ,SAAS,EACzB,CAAC,CACD,QAAQ,EACV,EACE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,QAAQ,EACN,QAAQ,CACR,IAAI,GAAG,0CAA0C,CACjD,IAAI,IAAI,uDAAuD,CAC/D,QACC,UAAU,CAAC,MAAM,KAAK,MAAM,EAC7B,gFACA;CACF,CAAC,CACD,QAAQ,CACV,CAAC;AAEF,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,cAAc;CAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,CAAC,CACD,QAAQ;AAEV,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,YAAY;CAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM,aAAa,uCAAuC;CAC1E,CAAC,CACD,QAAQ;AAEV,MAAa,oBAAoB,EAAE,mBAAmB,UAAU,CAC/D,8BACA,6BACA,CAAC;AAEF,MAAa,6BAA6B,EAAE,mBAAmB,UAAU,CACxE,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,EACF,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,CACF,CAAC;AAMF,SAAgB,kBAAkB,QAA8B,UAA0B;CACzF,IAAI,OAAO,WAAW,KAAA,GACrB,OAAO;CAER,QAAQ,OAAO,OAAO,MAAtB;EACC,KAAK,UACJ,OAAO,UAAU;EAClB,KAAK,UACJ,OAAO,GAAG,OAAO,OAAO,OAAO,GAAG;EACnC,SAEC,OADgC,OAAO;;;;;AC5D1C,MAAM,6BAA6B,EACjC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACrC,CAAC,CACD,QAAQ;AAEV,MAAM,2BAA2B,EAAE,KAAK,CAAC,QACvC,UAAU;CACV,MAAM,WAAW,IAAI,IAAI,MAAM,CAAC;CAChC,OAAO,aAAa,WAAW,aAAa;GAE7C,EAAE,SAAS,qDAAqD,CAChE;AAED,MAAM,4BAA4B,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ;AAEtE,MAAM,gCAAgC,EACpC,OAAO;CACP,MAAM,EAAE,QAAQ,kBAAkB;CAClC,KAAK;CACL,qBAAqB,0BAA0B,UAAU;CACzD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,qBAAqB,EACzB,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK;CACL,qBAAqB,0BAA0B,UAAU;CACzD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,uBAAuB,EAC3B,OAAO;CACP,MAAM,EAAE,QAAQ,QAAQ;CACxB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACrC,qBAAqB,0BAA0B,UAAU;CACzD,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACjC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACjE,eAAe,EAAE,KAAK,CAAC,YAAY,OAAO,CAAC,CAAC,UAAU;CACtD,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAa,wBAAwB,EACnC,OAAO;CACP,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACtC,WAAW,EAAE,KAAK,CAAC,OAAO,iBAAiB,CAAC;CAC5C,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,cAAc,oBAAoB,OAAO,MAAM,WAAW,GACpE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;CAEH,IAAI,OAAO,cAAc,SAAS,OAAO,MAAM,SAAS,GACvD,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;EAEF;AAEH,MAAa,oBAAoB,EAC/B,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,WAAW,2BAA2B,QAAQ,EAAE,CAAC;CACjD,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;CAC9E,WAAW,EAAE,mBAAmB,QAAQ;EACvC;EACA;EACA;EACA,CAAC;CACF,CAAC,CACD,QAAQ;AAEV,MAAa,kBAAkB,EAC7B,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CACrE,CAAC,CACD,QAAQ;AAuBV,eAAsB,cAAc,YAAwC;CAC3E,OAAO,gBAAgB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGnE,SAAgB,6BAA6B,QAAmD;CAC/F,OAAO,OAAO,OAAO,OAAO,UAAU,CAAC,KAAK,aAAa;EACxD,MAAM,YAAY,SAAS;EAC3B,IAAI,UAAU,SAAS,SAAS;GAC/B,MAAM,mBAQF;IACH,MAAM,UAAU;IAChB,SAAS,UAAU;IACnB,KAAK,UAAU;IACf,WAAW,SAAS;IACpB,WAAW,UAAU;IACrB;GACD,IAAI,UAAU,wBAAwB,KAAA,GACrC,iBAAiB,sBAAsB,UAAU;GAElD,IAAI,UAAU,QAAQ,KAAA,GACrB,iBAAiB,MAAM,UAAU;GAElC,OAAO;;EAGR,MAAM,mBAMF;GACH,SAAS,UAAU;GACnB,WAAW,SAAS;GACpB,WAAW,UAAU;GACrB,KAAK,UAAU;GACf;EACD,IAAI,UAAU,wBAAwB,KAAA,GACrC,iBAAiB,sBAAsB,UAAU;EAElD,OAAO;GACN;;;;AC3JH,SAAS,gBACR,WACA,WACA,UACU;CACV,OAAO,UAAU,MACf,aAAa,SAAS,cAAc,aAAa,SAAS,aAAa,SACxE;;AAGF,SAAS,yBACR,SACA,cACA,WACA,UACU;CACV,MAAM,YAAY,QAAQ,SAAS,2BAA2B,EAAE,EAAE,aAAa;CAC/E,IAAI,aAAa,KAAA,GAChB,OAAO;CAER,KAAK,SAAS,QAAQ,EAAE,EAAE,SAAS,SAAS,EAC3C,OAAO;CAER,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS,SAAS;;AAGnE,SAAS,6BACR,SACA,MACU;CACV,OACC,QAAQ,SAAS,qBAAqB,mCACtC,QAAQ,SAAS,4BAA4B,SAAS,KAAK,UAAU,IACrE,KAAK,aAAa,iBAAiB,QACnC,KAAK,YAAY,oBAAoB;;AASvC,SAAgB,4BACf,SACA,MAC8B;CAC9B,IACC,gBAAgB,QAAQ,SAAS,2BAA2B,KAAK,WAAW,KAAK,SAAS,IAC1F,yBAAyB,SAAS,mBAAmB,KAAK,WAAW,KAAK,SAAS,IACnF,6BAA6B,SAAS,KAAK,EAE3C,OAAO,EAAE,MAAM,0BAA0B;CAE1C,IAAI,QAAQ,SAAS,qBAAqB,2BACzC,OAAO,EAAE,MAAM,qBAAqB;CAErC,IACC,gBAAgB,QAAQ,SAAS,gBAAgB,KAAK,WAAW,KAAK,SAAS,IAC/E,gBAAgB,QAAQ,SAAS,YAAY,KAAK,WAAW,KAAK,SAAS,IAC3E,yBAAyB,SAAS,oBAAoB,KAAK,WAAW,KAAK,SAAS,EAEpF,OAAO,EAAE,MAAM,qBAAqB;CAErC,OAAO,EAAE,MAAM,WAAW;;AAG3B,SAAgB,8BACf,SACA,MACU;CACV,OAAO,4BAA4B,SAAS,KAAK,CAAC,SAAS;;;;AC/E5D,MAAa,yBAAyB,EACpC,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;AAIV,MAAa,2BAA2B,EACtC,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,2BAA2B,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACtE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CAC3D,kBAAkB,EAChB,KAAK,CAAC,iCAAiC,0BAA0B,CAAC,CAClE,QAAQ,gCAAgC;CAC1C,yBAAyB,EACvB,OACA,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,EACE,OAAO;EACP,kBAAkB;EAClB,iBAAiB;EACjB,CAAC,CACD,QAAQ,CACV,CACA,QAAQ,EAAE,CAAC;CACb,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACnE,YAAY,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACvD,CAAC,CACD,QAAQ;AAIV,MAAM,kCAAkC,EACtC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ;AAEV,MAAM,gCAAgC,EACpC,OAAO;CACP,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5D,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACjD,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;CAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC7C,CAAC,CACD,QAAQ;AASV,MAAM,8BAA8B,EAClC,OAAO;CACP,UAAU,8BAA8B,QAAQ;EARjD,sBAAsB,EAAE;EACxB,WAAW,EAAE;EACb,oBAAoB;EACpB,OAAO,EAAE;EAKsE,CAAC,CAAC,UAAU;CAC1F,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,mCAAmC,EAC9C,OAAO;CACP,UAAU,EACR,OAAO,EACP,kBAAkB,2BAA2B,MAAM,iBAAiB,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAChF,SAAS,EACP,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAC/C,QAAQ,CACR,UAAU;CACZ,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG;EACtD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,OAAO,EACL,OAAO,EACP,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAO,EACzD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,CAAC,CACD,QAAQ;AAIV,MAAa,iCAAiC,EAC5C,OAAO;CACP,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;CAC7C,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAChF,wBAAwB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ;CACpD,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS;EACpB,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;CACV,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ;CACvE,UAAU;CACV,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,WAAW,mBACX,CAAC,CACD,QAAQ;AAIV,SAAS,oBAAoB,MAAuB;CACnD,MAAM,iBAAiB,KAAK,aAAa;CACzC,OACC,mBAAmB,eAAe,mBAAmB,eAAe,mBAAmB;;AAIzF,MAAa,uBAAuB,EAClC,OAAO;CACP,QAAQ,EACN,OAAO;EACP,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,OAAO,qBAAqB,EAC5B,SAAS,oEACT,CAAC,CACD,QAAQ,YAAY;EACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAO,CAAC,QAAQ,MAAO;EACzD,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,MAAM;EAAa,MAAM;EAAQ,CAAC;CAC9C,MAAM,EACJ,OAAO,EACP,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,gBAAgB,EACtD,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,YAAY,iBAAiB,CAAC;CAC1C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;CACzD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,SAAS,kBAAkB,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAa,wBAAwB,EACnC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,cAAc,4BAA4B,UAAU;CACpD,UAAU,qBAAqB,UAAU;CACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CAC3E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;EAEF;AAOH,MAAa,sCAAsC,EACjD,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAM,iBAA2C;CAChD,UAAU,2BAA2B,MAAM,EAAE,CAAC;CAC9C,OAAO,EAAE,cAAc,KAAQ;CAC/B,mBAAmB,EAAE;CACrB,yBAAyB,EAAE;CAC3B,wBAAwB,EAAE;CAC1B,SAAS,EAAE,SAAS,OAAO;CAC3B,eAAe;EAAE,SAAS;EAAM,eAAe;EAAI;CACnD;AAID,eAAsB,oBAAoB,YAA8C;CACvF,OAAO,sBAAsB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGzE,SAAS,kBACR,YACA,UAC8B;CAC9B,OAAO,OAAO,QAAQ,WAAW,CAAC,SAAS,CAAC,WAAW,YACtD,SAAS,OAAO,CAAC,KAAK,cAAc;EAAE;EAAW;EAAU,EAAE,CAC7D;;AAGF,SAAS,kBAAkB,UAAiD;CAC3E,OAAO,SAAS,UAAU,MAAM,EAAE,GAAG,SAAS;;AAG/C,SAAS,wBAAwB,UAAuC;CACvE,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS;;AAG1D,SAAS,iBACR,YACkD;CAClD,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CAAC,QAAQ,GAAG,YAAY,wBAAwB,OAAO,MAAM,CAAC,CACxF;;AAGF,SAAS,yBACR,YACA,kBACuB;CACvB,OAAO,2BAA2B,MAAM;EACvC,2BAA2B,kBAAkB,aAAa,WAAW,CACpE,GAAG,kBAAkB,OAAO,MAAM,gBAAgB,EAClD,GAAI,OAAO,UAAU,wBAAwB,EAAE,CAC/C,CAAC;EACF;EACA,gBAAgB,kBAAkB,aAAa,WAAW,CACzD,GAAG,kBAAkB,OAAO,MAAM,iBAAiB,EACnD,GAAI,OAAO,UAAU,aAAa,EAAE,CACpC,CAAC;EACF,yBAAyB,OAAO,YAC/B,OAAO,QAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,CAAC,CAClF;EACD,6BAA6B,OAAO,QAAQ,WAAW,CACrD,QAAQ,GAAG,YAAY,OAAO,UAAU,mBAAmB,CAC3D,KAAK,CAAC,eAAe,UAAU;EACjC,YAAY,kBAAkB,aAAa,WAAW,OAAO,UAAU,SAAS,EAAE,CAAC;EACnF,CAAC;;AAGH,SAAS,+BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,YAAY,OAAO,MAAM,UAAU,IAAI,CAClD,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,kBAAkB,OAAO,MAAM,CAAC,CAAC,CAC5E;;AAGF,SAAS,8BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,aAAa,OAAO,MAAM,QAAQ,EAAE,EAAE,SAAS,EAAE,CAC5D,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,QAAQ,EAAE,CAAC,CAAC,CACpE;;AAGF,SAAS,6BACR,YACA,SAC2B;CAC3B,MAAM,mBACL,QAAQ,UAAU,oBAAoB,eAAe,SAAS;CAC/D,MAAM,0BAA0B,iBAAiB,WAAW;CAC5D,OAAO,+BAA+B,MAAM;EAC3C,UAAU,yBAAyB,yBAAyB,iBAAiB;EAC7E,OAAO,QAAQ,SAAS,eAAe;EACvC,mBAAmB,OAAO,KAAK,wBAAwB;EACvD,yBAAyB,+BAA+B,wBAAwB;EAChF,wBAAwB,8BAA8B,wBAAwB;EAC9E,SAAS,QAAQ,WAAW,eAAe;EAC3C,eAAe,QAAQ,iBAAiB,eAAe;EACvD,CAAC;;AAGH,SAAgB,wBACf,QACA,aAC2B;CAC3B,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,MAAM,wBAAwB,YAAY,GAAG;CAExD,OAAO,6BAA6B,QAAQ,YAAY,QAAQ;;AAGjE,SAAgB,kCAAkC,QAA6B;CAC9E,IAAI,OAAO,WAAW,eACrB,OAAO,MAAM,OAAO,KAAK;CAE1B,OAAO,OAAO;;;;ACzUf,MAAa,+BAA+B,EAC1C,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,qBAAqB,OAAO,kBAAkB,OAAO,gBAAgB,EACxE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,kBAAkB;EACzB,CAAC;EAEF;AAIH,MAAa,8BAA8B,EAAE,KAAK;CACjD;CACA;CACA;CACA,CAAC;AAEF,MAAM,oCAAoC,EAAE,QAAQ,CAAC,IAAI,EAAE;AAC3D,MAAM,0BAA0B,EAC9B,QAAQ,CACR,IAAI,EAAE,CACN,QAAQ,UAAU,MAAM,WAAW,IAAI,IAAI,CAAC,MAAM,SAAS,KAAK,EAAE,EAClE,SAAS,0EACT,CAAC;AACH,MAAM,mCAAmC,EACvC,MACA,EACE,QAAQ,CACR,IAAI,KAAM,CACV,QAAQ,UAAU,CAAC,MAAM,SAAS,KAAK,EAAE,EACzC,SAAS,wDACT,CAAC,CACH,CACA,IAAI,GAAG;AACT,MAAM,gCAAgC,EACpC,QAAQ,CACR,IAAI,EAAE,CACN,QACC,UAAU,CAAC,MAAM,SAAS,KAAK,IAAI,CAAC,MAAM,WAAW,IAAI,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,KAAK,EAC9F,EACC,SAAS,oFACT,CACD;AAEF,MAAa,gDAAgD,EAAE,mBAAmB,QAAQ;CACzF,EACE,OAAO;EACP,aAAa;EACb,YAAY;EACZ,MAAM,EAAE,QAAQ,gBAAgB;EAChC,qBAAqB;EACrB,kBAAkB;EAClB,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,MAAM,EAAE,QAAQ,kBAAkB;EAClC,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,MAAM,EAAE,QAAQ,mBAAmB;EACnC,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,MAAM,EAAE,QAAQ,iBAAiB;EACjC,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,MAAM,EAAE,QAAQ,eAAe;EAC/B,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,YAAY;EACZ,MAAM,EAAE,QAAQ,gBAAgB;EAChC,qBAAqB;EACrB,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAU;EACxD,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,SAAW;EAC9D,kBAAkB;EAClB,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,MAAM,EAAE,QAAQ,iBAAiB;EACjC,CAAC,CACD,QAAQ;CACV,EACE,OAAO;EACP,aAAa;EACb,MAAM,EAAE,QAAQ,eAAe;EAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAU;EACrD,CAAC,CACD,QAAQ;CACV,CAAC;AAMF,MAAa,2CAA2C,EACtD,OAAO;CACP,MAAM,EAAE,QAAQ,4BAA4B,KAAK,eAAe;CAChE,YAAY,EACV,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,8CAA8C,CACxE,QAAQ,eAAe,OAAO,KAAK,WAAW,CAAC,SAAS,GAAG,EAC3D,SAAS,kEACT,CAAC;CACH,SAAS,EAAE,QAAQ,cAAc;CACjC,CAAC,CACD,QAAQ;AAMV,MAAa,iCAAiC,EAAE,mBAAmB,QAAQ;CAC1E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,4BAA4B,KAAK,aAAa,EAAE,CAAC,CAAC,QAAQ;CACrF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,4BAA4B,KAAK,uBAAuB,EAAE,CAAC,CAAC,QAAQ;CAC/F;CACA,CAAC;AAKF,MAAa,kCAAkC,EAC7C,OAAO;CACP,SAAS;CACT,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,oCAAoC,EAC/C,OAAO,EACP,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,gCAAgC,CAAC,QAAQ,EAAE,CAAC,EACpF,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,gDAAgD,EAC3D,OAAO;CACP,iBAAiB;CACjB,WAAW;CACX,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAC9C,CAAC,CACD,QAAQ;AAMV,MAAa,2CAA2C,EACtD,OAAO,EACP,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,8CAA8C,EAClF,CAAC,CACD,QAAQ;AAMV,MAAa,iCAAiC,EAC5C,OAAO;CACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAO;CACzC,CAAC,CACD,QAAQ;AAIV,MAAM,iDAAiD,EACrD,OAAO,EACP,MAAM,EAAE,QAAQ,SAAS,EACzB,CAAC,CACD,QAAQ;AAEV,MAAM,kCAAkC,EACtC,QAAQ,CACR,IAAI,EAAE,CACN,QAAQ,UAAU,MAAM,WAAW,IAAI,EAAE,EACzC,SAAS,wDACT,CAAC;AAEH,MAAa,iCAAiC,EAC5C,OAAO;CACP,SAAS;CACT,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC/C,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;CACzC,gBAAgB;CAChB,SAAS,EAAE,QAAQ,KAAK;CACxB,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,gCAAgC,EAC3C,OAAO;CACP,SAAS;CACT,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC/C,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;CACzC,gBAAgB;CAChB,SAAS,EAAE,QAAQ,KAAK;CACxB,OAAO;CACP,WAAW,EAAE,QAAQ,kBAAkB;CACvC,CAAC,CACD,QAAQ;AAIV,MAAa,kCAAkC,EAC7C,OAAO;CACP,gBAAgB,EACd,OAAO;EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;EAC1B,MAAM,EAAE,QAAQ,mBAAmB;EACnC,CAAC,CACD,QAAQ;CACV,SAAS,EAAE,QAAQ,KAAK;CACxB,CAAC,CACD,QAAQ;AAIV,MAAa,wCAAwC,EACnD,OAAO;CACP,MAAM,+BAA+B,UAAU;CAC/C,KAAK,8BAA8B,UAAU;CAC7C,OAAO,gCAAgC,UAAU;CACjD,CAAC,CACD,QAAQ;AAIV,MAAM,8BAA8B;CACnC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAC5E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxE,eAAe,EAAE,QAAQ,EAAE;CAC3B;AAED,MAAa,gCAAgC,EAC3C,OAAO;CACP,GAAG;CACH,MAAM,EAAE,QAAQ,UAAU;CAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,mCAAmC,EAC9C,OAAO;CACP,GAAG;CACH,gBAAgB;CAChB,OAAO,EACL,OAAO,EACP,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EACtC,CAAC,CACD,QAAQ;CACV,aAAa;CACb,MAAM,EAAE,QAAQ,aAAa;CAC7B,CAAC,CACD,QAAQ;AAIV,MAAa,yBAAyB,EACpC,mBAAmB,QAAQ,CAAC,+BAA+B,iCAAiC,CAAC,CAC7F,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;CAGH,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAAQ,OAAO,OAAO,EACjE,IAAI,OAAO,SAAS,YAAY,aAAa,KAAA,GAC5C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS,sBAAsB,QAAQ,gCAAgC,YAAY,QAAQ;EAC3F,MAAM;GAAC;GAAU;GAAS;GAAU;EACpC,CAAC;CAIJ,KAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,OAAO,SAAS,EACjE,KAAK,MAAM,CAAC,aAAa,oBAAoB,OAAO,QAAQ,QAAQ,WAAW,EAAE;EAChF,IAAI,gBAAgB,QAAQ,SAAS,kBACpC;EAED,MAAM,iBAAiB,IAAI,IAAI,OAAO,KAAK,gBAAgB,QAAQ,WAAW,CAAC;EAC/E,KAAK,MAAM,CAAC,cAAc,aAAa;GACtC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,MAAM;GAClC,CAAC,CAAC,SAAS,mBAAmB,EAAE,gBAAgB,MAAM,iBAAiB;GACvE,CAAC,CAAC,SAAS,kBAAkB,EAAE,gBAAgB,MAAM,gBAAgB;GACrE,EAAW;GACX,MAAM,gBAAgB,CACrB,GAAI,SAAS,UAAU,MAAM,EAAE,GAAG,SAAS,OAC3C,GAAG,SAAS,KACZ;GACD,KAAK,MAAM,iBAAiB,eAC3B,IAAI,CAAC,eAAe,IAAI,cAAc,EACrC,QAAQ,SAAS;IAChB,MAAM,EAAE,aAAa;IACrB,SAAS,yDAAyD,cAAc;IAChF,MAAM;KAAC;KAAY;KAAW;KAAc;KAAa,GAAG;KAAa;IACzE,CAAC;;;CAOP,IAAI,OAAO,SAAS,cACnB;CAGD,KAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,OAAO,SAAS,EACjE,KAAK,MAAM,CAAC,aAAa,oBAAoB,OAAO,QAAQ,QAAQ,WAAW,EAAE;EAChF,IAAI,gBAAgB,QAAQ,SAAS,gBACpC;EAED,QAAQ,SAAS;GAChB,MAAM,EAAE,aAAa;GACrB,SAAS,mEAAmE,gBAAgB,QAAQ,KAAK;GACzG,MAAM;IAAC;IAAY;IAAW;IAAc;IAAa;IAAW;IAAO;GAC3E,CAAC;;CAIJ,MAAM,qBAAqB,OAAO,KAAK,OAAO,OAAO;CACrD,IAAI,mBAAmB,WAAW,GACjC,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,SAAS;EAChB,CAAC;CAGH,KAAK,MAAM,qBAAqB,oBAC/B,IAAI,OAAO,eAAe,OAAO,uBAAuB,KAAA,GACvD,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS,iCAAiC,kBAAkB;EAC5D,MAAM;GAAC;GAAkB;GAAU;GAAkB;EACrD,CAAC;CAIJ,KAAK,MAAM,wBAAwB,OAAO,KAAK,OAAO,eAAe,OAAO,EAC3E,IAAI,OAAO,OAAO,0BAA0B,KAAA,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS,mEAAmE,qBAAqB;EACjG,MAAM;GAAC;GAAkB;GAAU;GAAqB;EACxD,CAAC;CAIJ,IAAI,OAAO,OAAO,OAAO,YAAY,CAAC,OAAO,eAAe,eAAe,KAAA,EAAU,EACpF,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,cAAc;EACrB,CAAC;CAGH,MAAM,eAAe,OAAO,YAAY,OAAO,eAAe;CAC9D,IAAI,iBAAiB,KAAA,KAAa,OAAO,OAAO,kBAAkB,KAAA,GACjE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS,oEAAoE,aAAa;EAC1F,MAAM;GAAC;GAAe;GAAS;GAAkB;GAAU;EAC3D,CAAC;EAEF;AAIH,eAAsB,qBAAqB,YAA+C;CACzF,OAAO,uBAAuB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAG1E,MAAa,yCAAyC,EACpD,OAAO;CACP,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAMV,MAAa,gCAAgC,EAC3C,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,uCAAuC;CAC/E,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,0DACZ;AAMD,MAAa,iDAAiD,EAC5D,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,YAAY,EAAE,OACb,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,wDACA;CACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC,CACD,QAAQ;AAWV,SAAgB,8BACf,OAC0B;CAC1B,MAAM,cAAc,MAAM,OAAO,OAAO,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,sBAAsB,MAAM,QAAQ,sBAAsB;CAG3E,MAAM,gBAAgB,MAAM,OAAO,SAAS,YAAY;CACxD,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MACT,sBAAsB,MAAM,QAAQ,gCAAgC,YAAY,QAAQ,IACxF;CAGF,MAAM,aAAa,OAAO,YACzB,OAAO,QAAQ,cAAc,WAAW,CACtC,QAAQ,GAAG,qBAAqB,gBAAgB,QAAQ,SAAS,eAAe,CAChF,KAAK,CAAC,WAAW,qBAAqB,CACtC,WACA;EACC,OAAO,gBAAgB;EACvB,OAAO,gBAAgB;EACvB,CACD,CAAC,CACH;CAED,OAAO,8BAA8B,MAAM;EAC1C,SAAS,MAAM;EACf;EACA,SAAS,YAAY;EACrB,CAAC;;AAQH,SAAgB,+CACf,OAC2C;CAC3C,MAAM,cAAc,MAAM,OAAO,OAAO,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,sBAAsB,MAAM,QAAQ,sBAAsB;CAG3E,MAAM,gBAAgB,MAAM,OAAO,SAAS,YAAY;CACxD,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MACT,sBAAsB,MAAM,QAAQ,gCAAgC,YAAY,QAAQ,IACxF;CAGF,MAAM,aAAa,OAAO,YACzB,OAAO,QAAQ,cAAc,WAAW,CACtC,QAAQ,GAAG,qBAAqB,gBAAgB,QAAQ,SAAS,yBAAyB,CAC1F,KAAK,CAAC,WAAW,qBAAqB,CACtC,WACA;EACC,OAAO,gBAAgB;EACvB,OAAO,gBAAgB;EACvB,CACD,CAAC,CACH;CAED,OAAO,+CAA+C,MAAM;EAC3D,SAAS,MAAM;EACf;EACA,SAAS,YAAY;EACrB,CAAC;;AAGH,SAAS,qBACR,MACA,OACU;CACV,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,MAAM;CACzB,IAAI,cAAc,OAAO,eAAe,KACvC,OAAO;CAER,IAAI,cAAc,KAAK;EACtB,IAAI,eAAe,KAClB,OAAO;EAER,OAAO,WAAW,MAAM,aAAa,CAAC,KAAK,KAAK,SAAS,SAAS,CAAC;;CAEpE,IAAI,eAAe,KAClB,OAAO,UAAU,MAAM,aAAa,CAAC,MAAM,KAAK,SAAS,SAAS,CAAC;CAEpE,OAAO,UAAU,MACf,aACA,WAAW,SAAS,SAAS,IAC7B,CAAC,KAAK,KAAK,SAAS,SAAS,IAC7B,CAAC,MAAM,KAAK,SAAS,SAAS,CAC/B;;;;ACpjBF,MAAa,gCAAgC;CAC5C,KAAK;CACL,WAAW;CACX,YAAY;CACZ;AAED,MAAa,2BAA2B;CACvC,KAAK;CACL,WAAW;CACX,YAAY;CACZ;AAED,MAAa,6BAA6B;CACzC,sBAAsB;CACtB,4BAA4B;CAC5B,6BAA6B;CAC7B;AAQD,SAAS,aAAa,QAAiC,UAA2C;CACjG,OAAO;EACN,KAAK;EACL,GAAG;EACH;;AAGF,SAAgB,sCAAqE;CACpF,OAAO;EACN,KAAK,aACJ,IAAI,aAAa,iBAAiB,EAAE,QAAQ,YAAY,CAAC,EACzD,yBAAyB,IACzB;EACD,WAAW,aACV,IAAI,aAAa,uBAAuB,EAAE,QAAQ,YAAY,CAAC,EAC/D,yBAAyB,UACzB;EACD,YAAY,aACX,IAAI,aAAa,wBAAwB,EAAE,QAAQ,YAAY,CAAC,EAChE,yBAAyB,WACzB;EACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/config-contracts",
-  "version": "0.0.114",
+  "version": "0.0.115",
   "description": "Shared agent-vm JSONC config schemas and TypeScript contracts.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {