@agentwares/agentguard 0.1.7 → 0.1.10

package/dist/chunk-TJXZBOHL.js

@@ -0,0 +1,529 @@
+import {
+  readAllPages
+} from "./chunk-IS3DAHZI.js";
+import {
+  version
+} from "./chunk-4WTFMFRY.js";
+
+// src/proxy/runtime.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import {
+  getDefaultEnvironment,
+  StdioClientTransport
+} from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import {
+  CreateMessageRequestSchema,
+  ElicitRequestSchema,
+  LoggingMessageNotificationSchema,
+  PromptListChangedNotificationSchema,
+  ResourceListChangedNotificationSchema,
+  ResourceUpdatedNotificationSchema,
+  ToolListChangedNotificationSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import {
+  GuardError,
+  classifyTool,
+  upstreamHeaders
+} from "@agentwares/agentguard-core";
+var ProxyRuntime = class {
+  loaded;
+  guard;
+  agent;
+  defaultRunId;
+  configured;
+  sessions = /* @__PURE__ */ new Set();
+  connections = /* @__PURE__ */ new Map();
+  exposed = [];
+  resourceOwner = /* @__PURE__ */ new Map();
+  templateOwner = /* @__PURE__ */ new Map();
+  promptOwner = /* @__PURE__ */ new Map();
+  log;
+  connectTimeoutMs;
+  testClients;
+  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */
+  closing = false;
+  constructor(opts) {
+    this.loaded = opts.loaded;
+    this.guard = opts.guard;
+    this.agent = opts.agent;
+    this.defaultRunId = opts.defaultRunId;
+    this.configured = opts.configured ?? true;
+    this.log = opts.log ?? ((line) => process.stderr.write(`[okgate] ${line}
+`));
+    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15e3;
+    this.testClients = opts.clients ?? {};
+  }
+  get policy() {
+    return this.loaded.policy;
+  }
+  async start() {
+    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));
+    for (const [name, client] of Object.entries(this.testClients)) {
+      if (this.connections.has(name)) continue;
+      const upstream = {
+        name,
+        command: "in-memory",
+        args: [],
+        env: {},
+        headers: {},
+        prefix: false,
+        timeout_ms: 6e4
+      };
+      const conn = {
+        upstream,
+        client,
+        tools: [],
+        capabilities: client.getServerCapabilities(),
+        connected: true
+      };
+      this.connections.set(name, conn);
+      this.wire(conn);
+      await this.refreshTools(name);
+    }
+    this.rebuildExposed();
+    const status = this.upstreamStatus();
+    this.log(
+      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`
+    );
+  }
+  async connect(upstream) {
+    const client = new Client(
+      { name: "okgate", version: version() },
+      { capabilities: { sampling: {}, elicitation: {} } }
+    );
+    const conn = {
+      upstream,
+      client,
+      tools: [],
+      capabilities: void 0,
+      connected: false
+    };
+    this.connections.set(upstream.name, conn);
+    try {
+      const transport = upstream.url ? new StreamableHTTPClientTransport(new URL(upstream.url), {
+        requestInit: { headers: upstreamHeaders(upstream) }
+      }) : new StdioClientTransport({
+        command: upstream.command,
+        args: upstream.args,
+        env: { ...getDefaultEnvironment(), ...upstream.env },
+        cwd: upstream.cwd,
+        stderr: "pipe"
+      });
+      if (transport instanceof StdioClientTransport) {
+        transport.stderr?.on("data", (chunk) => {
+          if (this.closing) return;
+          for (const line of chunk.toString("utf8").split("\n"))
+            if (line.trim()) this.log(`${upstream.name}: ${line}`);
+        });
+      }
+      await withTimeout(
+        client.connect(transport),
+        this.connectTimeoutMs,
+        `connect to upstream "${upstream.name}"`
+      );
+      conn.capabilities = client.getServerCapabilities();
+      conn.connected = true;
+      this.wire(conn);
+      await this.refreshTools(upstream.name);
+    } catch (err) {
+      conn.connected = false;
+      conn.error = err instanceof Error ? err.message : String(err);
+      this.log(`upstream "${upstream.name}" unavailable: ${conn.error}`);
+    }
+  }
+  wire(conn) {
+    const { client, upstream } = conn;
+    client.onclose = () => {
+      conn.connected = false;
+      conn.error = "connection closed";
+      if (!this.closing) this.log(`upstream "${upstream.name}" closed`);
+    };
+    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {
+      await this.broadcast(upstream.name, n.method, n.params);
+    });
+    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {
+      await this.broadcast(upstream.name, n.method, n.params);
+    });
+    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {
+      this.resourceOwner.clear();
+      await this.broadcast(upstream.name, "notifications/resources/list_changed", void 0);
+    });
+    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
+      this.promptOwner.clear();
+      await this.broadcast(upstream.name, "notifications/prompts/list_changed", void 0);
+    });
+    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
+      await this.refreshTools(upstream.name);
+      this.rebuildExposed();
+      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => void 0);
+    });
+    try {
+      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {
+        const session = this.pickSession(upstream.name);
+        if (!session) throw new Error("no downstream client is connected to relay sampling to");
+        const related = session.inflight.get(upstream.name)?.at(-1);
+        return session.server.server.createMessage(req.params, { relatedRequestId: related });
+      });
+      client.setRequestHandler(ElicitRequestSchema, async (req) => {
+        const session = this.pickSession(upstream.name);
+        if (!session) throw new Error("no downstream client is connected to relay elicitation to");
+        const related = session.inflight.get(upstream.name)?.at(-1);
+        return session.server.server.elicitInput(req.params, { relatedRequestId: related });
+      });
+    } catch {
+    }
+  }
+  pickSession(upstream) {
+    let best;
+    for (const s of this.sessions) {
+      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;
+      if (!best || s.lastActive > best.lastActive) best = s;
+    }
+    return best;
+  }
+  async broadcast(upstream, method, params) {
+    for (const s of this.sessions) {
+      const related = s.inflight.get(upstream)?.at(-1);
+      try {
+        await s.server.server.notification(
+          { method, params },
+          related !== void 0 ? { relatedRequestId: related } : void 0
+        );
+      } catch {
+      }
+    }
+  }
+  /**
+   * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each
+   * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow
+   * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for
+   * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,
+   * changes nothing: the agent keeps the last good list, and the log says why.
+   */
+  async refreshTools(name) {
+    const conn = this.connections.get(name);
+    if (!conn?.connected) return;
+    if (conn.capabilities && !conn.capabilities.tools) {
+      conn.tools = [];
+      return;
+    }
+    const kept = () => `keeping the last good list (${conn.tools.length} tool${conn.tools.length === 1 ? "" : "s"})`;
+    try {
+      const read = await readAllPages(async (cursor) => {
+        const page = await conn.client.listTools(cursor ? { cursor } : void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        return { items: page.tools, nextCursor: page.nextCursor };
+      });
+      if (read.truncated) {
+        this.log(`tools/list for "${name}" not applied: ${read.truncated.reason}; ${kept()}`);
+        return;
+      }
+      conn.tools = read.items;
+    } catch (err) {
+      this.log(
+        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}; ${kept()}`
+      );
+    }
+  }
+  rebuildExposed() {
+    const taken = /* @__PURE__ */ new Set();
+    const out = [];
+    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];
+    for (const name of order) {
+      const conn = this.connections.get(name);
+      if (!conn) continue;
+      const prefix = conn.upstream.prefix === true ? name : typeof conn.upstream.prefix === "string" ? conn.upstream.prefix : void 0;
+      for (const tool of conn.tools) {
+        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;
+        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;
+        if (taken.has(exposedName)) {
+          this.log(`skipping duplicate tool ${exposedName} from ${name}`);
+          continue;
+        }
+        taken.add(exposedName);
+        out.push({
+          name: exposedName,
+          upstream: name,
+          original: tool.name,
+          tool,
+          classification: classifyTool(
+            {
+              name: exposedName,
+              description: tool.description,
+              annotations: tool.annotations,
+              inputSchema: tool.inputSchema,
+              outputSchema: tool.outputSchema
+            },
+            this.policy
+          )
+        });
+      }
+    }
+    this.exposed = out;
+  }
+  listTools(agent) {
+    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams.includes(t.upstream));
+    return this.exposed;
+  }
+  findTool(name) {
+    return this.exposed.find((t) => t.name === name);
+  }
+  upstreamStatus() {
+    return [...this.connections.values()].map((c) => ({
+      name: c.upstream.name,
+      connected: c.connected,
+      tools: c.tools.length,
+      transport: c.upstream.url ? "http" : "stdio",
+      error: c.error
+    }));
+  }
+  attach(session) {
+    this.sessions.add(session);
+  }
+  detach(session) {
+    this.sessions.delete(session);
+  }
+  /** Run a tool call through the policy engine and, if allowed, the upstream. */
+  async callTool(name, args, ctx) {
+    const tool = this.findTool(name);
+    const agent = ctx.agent === void 0 ? this.agent : ctx.agent;
+    if (!tool) {
+      const result2 = await this.guard.run(
+        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },
+        async () => {
+          throw new GuardError({
+            code: "UNKNOWN_TOOL",
+            cause: `no upstream exposes a tool named "${name}"`,
+            fix: "call tools/list and use one of the listed names",
+            retryable: false
+          });
+        }
+      );
+      return { result: result2 };
+    }
+    const conn = this.connections.get(tool.upstream);
+    const track = () => {
+      if (!ctx.session || ctx.requestId === void 0) return () => void 0;
+      const list = ctx.session.inflight.get(tool.upstream) ?? [];
+      list.push(ctx.requestId);
+      ctx.session.inflight.set(tool.upstream, list);
+      return () => {
+        const l = ctx.session.inflight.get(tool.upstream) ?? [];
+        const i = l.indexOf(ctx.requestId);
+        if (i >= 0) l.splice(i, 1);
+      };
+    };
+    const result = await this.guard.run(
+      {
+        tool: {
+          name: tool.name,
+          description: tool.tool.description,
+          annotations: tool.tool.annotations,
+          inputSchema: tool.tool.inputSchema,
+          outputSchema: tool.tool.outputSchema
+        },
+        args,
+        runId: ctx.runId,
+        agent,
+        sessionId: ctx.sessionId,
+        upstream: tool.upstream
+      },
+      async (finalArgs) => {
+        if (!conn?.connected) {
+          throw new GuardError({
+            code: "UPSTREAM_ERROR",
+            cause: `upstream "${tool.upstream}" is not connected${conn?.error ? ` (${conn.error})` : ""}`,
+            fix: "check the upstream command/url in okgate.yaml and restart the proxy",
+            retryable: true
+          });
+        }
+        const untrack = track();
+        try {
+          return await conn.client.callTool(
+            { name: tool.original, arguments: finalArgs ?? {} },
+            void 0,
+            {
+              timeout: conn.upstream.timeout_ms,
+              resetTimeoutOnProgress: true,
+              onprogress: ctx.onprogress
+            }
+          );
+        } finally {
+          untrack();
+        }
+      }
+    );
+    return { result, tool };
+  }
+  connectedWith(capability) {
+    return [...this.connections.values()].filter(
+      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === void 0)
+    );
+  }
+  async listResources() {
+    const resources = [];
+    for (const conn of this.connectedWith("resources")) {
+      try {
+        const page = await conn.client.listResources(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const r of page.resources) {
+          this.resourceOwner.set(r.uri, conn.upstream.name);
+          resources.push(r);
+        }
+      } catch {
+      }
+    }
+    return { resources };
+  }
+  async listResourceTemplates() {
+    const resourceTemplates = [];
+    for (const conn of this.connectedWith("resources")) {
+      try {
+        const page = await conn.client.listResourceTemplates(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const t of page.resourceTemplates) {
+          this.templateOwner.set(t.uriTemplate, conn.upstream.name);
+          resourceTemplates.push(t);
+        }
+      } catch {
+      }
+    }
+    return { resourceTemplates };
+  }
+  ownerForUri(uri) {
+    const owner = this.resourceOwner.get(uri);
+    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)];
+    for (const [template, name] of this.templateOwner) {
+      if (templateMatches(template, uri) && this.connections.get(name)?.connected)
+        return [this.connections.get(name)];
+    }
+    return this.connectedWith("resources");
+  }
+  async readResource(uri) {
+    let lastError;
+    for (const conn of this.ownerForUri(uri)) {
+      try {
+        const result = await conn.client.readResource(
+          { uri },
+          { timeout: conn.upstream.timeout_ms }
+        );
+        this.resourceOwner.set(uri, conn.upstream.name);
+        return result;
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error(`no upstream serves resource ${uri}`);
+  }
+  async subscribe(uri, on) {
+    for (const conn of this.ownerForUri(uri)) {
+      try {
+        if (on) await conn.client.subscribeResource({ uri });
+        else await conn.client.unsubscribeResource({ uri });
+        return;
+      } catch {
+      }
+    }
+  }
+  async listPrompts() {
+    const prompts = [];
+    const taken = /* @__PURE__ */ new Set();
+    this.promptOwner.clear();
+    for (const conn of this.connectedWith("prompts")) {
+      try {
+        const page = await conn.client.listPrompts(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const p of page.prompts) {
+          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;
+          taken.add(name);
+          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });
+          prompts.push({ ...p, name });
+        }
+      } catch {
+      }
+    }
+    return { prompts };
+  }
+  async getPrompt(name, args) {
+    if (this.promptOwner.size === 0) await this.listPrompts();
+    const owner = this.promptOwner.get(name);
+    const conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("prompts");
+    let lastError;
+    for (const conn of conns) {
+      try {
+        return await conn.client.getPrompt(
+          { name: owner?.original ?? name, arguments: args },
+          { timeout: conn.upstream.timeout_ms }
+        );
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error(`no upstream serves prompt ${name}`);
+  }
+  async complete(params) {
+    let conns;
+    if (params.ref.type === "ref/prompt") {
+      if (this.promptOwner.size === 0) await this.listPrompts();
+      const owner = this.promptOwner.get(params.ref.name);
+      conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("completions");
+      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };
+    } else {
+      if (this.templateOwner.size === 0) await this.listResourceTemplates();
+      conns = this.ownerForUri(params.ref.uri);
+    }
+    let lastError;
+    for (const conn of conns) {
+      try {
+        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error("no upstream supports completions");
+  }
+  async setLevel(level) {
+    await Promise.all(
+      this.connectedWith("logging").map(
+        (c) => c.client.setLoggingLevel(level).catch(() => void 0)
+      )
+    );
+  }
+  async close() {
+    this.closing = true;
+    for (const conn of this.connections.values()) {
+      try {
+        await conn.client.close();
+      } catch {
+      }
+    }
+    this.connections.clear();
+  }
+};
+function templateMatches(template, uri) {
+  const re = new RegExp(
+    "^" + template.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^}]+\\\}/g, "[^/]+") + "$"
+  );
+  return re.test(uri);
+}
+async function withTimeout(promise, ms, what) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+export {
+  ProxyRuntime
+};
+//# sourceMappingURL=chunk-TJXZBOHL.js.map

package/dist/chunk-TJXZBOHL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy/runtime.ts"],"sourcesContent":["/**\n * Upstream side of the proxy: one MCP client per upstream (stdio or Streamable HTTP), the merged\n * tool table, resource/prompt routing, notification fan-out to downstream sessions, and\n * `callTool` through the policy engine.\n */\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { version as cliVersion } from \"../version.js\";\nimport {\n  getDefaultEnvironment,\n  StdioClientTransport,\n} from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport {\n  CreateMessageRequestSchema,\n  ElicitRequestSchema,\n  LoggingMessageNotificationSchema,\n  PromptListChangedNotificationSchema,\n  ResourceListChangedNotificationSchema,\n  ResourceUpdatedNotificationSchema,\n  ToolListChangedNotificationSchema,\n  type CallToolResult,\n  type CompleteRequest,\n  type CompleteResult,\n  type GetPromptResult,\n  type ListPromptsResult,\n  type ListResourceTemplatesResult,\n  type ListResourcesResult,\n  type LoggingLevel,\n  type Prompt,\n  type ReadResourceResult,\n  type Resource,\n  type ResourceTemplate,\n  type Tool,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport type { RequestId } from \"@modelcontextprotocol/sdk/types.js\";\nimport {\n  GuardError,\n  classifyTool,\n  upstreamHeaders,\n  type AgentScope,\n  type Classification,\n  type Guard,\n  type GuardResult,\n  type Upstream,\n} from \"@agentwares/agentguard-core\";\nimport type { LoadedPolicy } from \"@agentwares/agentguard-core/node\";\n// The root export, not `@agentwares/mcp-kit/paging`: tsup bundles mcp-kit into the published CLI\n// by an exact-name match, and a subpath would be left as an undeclared runtime dependency.\nimport { readAllPages } from \"@agentwares/mcp-kit\";\n\nexport interface ExposedTool {\n  /** the name the agent sees */\n  name: string;\n  upstream: string;\n  /** the name the upstream knows */\n  original: string;\n  tool: Tool;\n  classification: Classification;\n}\n\nexport interface DownstreamSession {\n  id: string;\n  server: McpServer;\n  lastActive: number;\n  /** upstream name → downstream request ids currently waiting on it (newest last) */\n  inflight: Map<string, RequestId[]>;\n}\n\nexport interface UpstreamStatus {\n  name: string;\n  connected: boolean;\n  tools: number;\n  transport: \"stdio\" | \"http\";\n  error?: string;\n}\n\ninterface Connection {\n  upstream: Upstream;\n  client: Client;\n  tools: Tool[];\n  capabilities: ReturnType<Client[\"getServerCapabilities\"]>;\n  connected: boolean;\n  error?: string;\n}\n\nexport interface RuntimeOptions {\n  loaded: LoadedPolicy;\n  guard: Guard;\n  /** fixed agent scope for stdio (`--agent`) */\n  agent?: AgentScope | null;\n  /** run id when neither `X-Run-Id` nor `_meta.runId` is present */\n  defaultRunId: string;\n  log?: (line: string) => void;\n  /** connect timeout per upstream (ms) */\n  connectTimeoutMs?: number;\n  /** in-process upstreams for tests: name → already-connected client */\n  clients?: Record<string, Client>;\n  /**\n   * false when no policy file was found and the proxy runs on the default policy with no\n   * upstreams, serving only its own read-only tools (default true)\n   */\n  configured?: boolean;\n}\n\nexport interface CallContext {\n  runId: string;\n  agent?: AgentScope | null;\n  sessionId?: string;\n  onprogress?: (progress: { progress: number; total?: number; message?: string }) => void;\n  /** downstream session + request id, so upstream notifications can be related to this call */\n  session?: DownstreamSession;\n  requestId?: RequestId;\n}\n\nexport class ProxyRuntime {\n  readonly loaded: LoadedPolicy;\n  readonly guard: Guard;\n  readonly agent: AgentScope | null | undefined;\n  readonly defaultRunId: string;\n  readonly configured: boolean;\n  readonly sessions = new Set<DownstreamSession>();\n  private readonly connections = new Map<string, Connection>();\n  private exposed: ExposedTool[] = [];\n  private readonly resourceOwner = new Map<string, string>();\n  private readonly templateOwner = new Map<string, string>();\n  private readonly promptOwner = new Map<string, { upstream: string; original: string }>();\n  private readonly log: (line: string) => void;\n  private readonly connectTimeoutMs: number;\n  private readonly testClients: Record<string, Client>;\n  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */\n  private closing = false;\n\n  constructor(opts: RuntimeOptions) {\n    this.loaded = opts.loaded;\n    this.guard = opts.guard;\n    this.agent = opts.agent;\n    this.defaultRunId = opts.defaultRunId;\n    this.configured = opts.configured ?? true;\n    this.log = opts.log ?? ((line) => process.stderr.write(`[okgate] ${line}\\n`));\n    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15_000;\n    this.testClients = opts.clients ?? {};\n  }\n\n  get policy() {\n    return this.loaded.policy;\n  }\n\n  async start(): Promise<void> {\n    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));\n    for (const [name, client] of Object.entries(this.testClients)) {\n      if (this.connections.has(name)) continue;\n      const upstream: Upstream = {\n        name,\n        command: \"in-memory\",\n        args: [],\n        env: {},\n        headers: {},\n        prefix: false,\n        timeout_ms: 60_000,\n      };\n      const conn: Connection = {\n        upstream,\n        client,\n        tools: [],\n        capabilities: client.getServerCapabilities(),\n        connected: true,\n      };\n      this.connections.set(name, conn);\n      this.wire(conn);\n      await this.refreshTools(name);\n    }\n    this.rebuildExposed();\n    const status = this.upstreamStatus();\n    this.log(\n      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`,\n    );\n  }\n\n  private async connect(upstream: Upstream): Promise<void> {\n    const client = new Client(\n      { name: \"okgate\", version: cliVersion() },\n      { capabilities: { sampling: {}, elicitation: {} } },\n    );\n    const conn: Connection = {\n      upstream,\n      client,\n      tools: [],\n      capabilities: undefined,\n      connected: false,\n    };\n    this.connections.set(upstream.name, conn);\n    try {\n      const transport = upstream.url\n        ? new StreamableHTTPClientTransport(new URL(upstream.url), {\n            requestInit: { headers: upstreamHeaders(upstream) },\n          })\n        : new StdioClientTransport({\n            command: upstream.command!,\n            args: upstream.args,\n            env: { ...getDefaultEnvironment(), ...upstream.env },\n            cwd: upstream.cwd,\n            stderr: \"pipe\",\n          });\n      if (transport instanceof StdioClientTransport) {\n        transport.stderr?.on(\"data\", (chunk: Buffer) => {\n          if (this.closing) return;\n          for (const line of chunk.toString(\"utf8\").split(\"\\n\"))\n            if (line.trim()) this.log(`${upstream.name}: ${line}`);\n        });\n      }\n      await withTimeout(\n        client.connect(transport),\n        this.connectTimeoutMs,\n        `connect to upstream \"${upstream.name}\"`,\n      );\n      conn.capabilities = client.getServerCapabilities();\n      conn.connected = true;\n      this.wire(conn);\n      await this.refreshTools(upstream.name);\n    } catch (err) {\n      conn.connected = false;\n      conn.error = err instanceof Error ? err.message : String(err);\n      this.log(`upstream \"${upstream.name}\" unavailable: ${conn.error}`);\n    }\n  }\n\n  private wire(conn: Connection): void {\n    const { client, upstream } = conn;\n    client.onclose = () => {\n      conn.connected = false;\n      conn.error = \"connection closed\";\n      if (!this.closing) this.log(`upstream \"${upstream.name}\" closed`);\n    };\n    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {\n      await this.broadcast(upstream.name, n.method, n.params);\n    });\n    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {\n      await this.broadcast(upstream.name, n.method, n.params);\n    });\n    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {\n      this.resourceOwner.clear();\n      await this.broadcast(upstream.name, \"notifications/resources/list_changed\", undefined);\n    });\n    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {\n      this.promptOwner.clear();\n      await this.broadcast(upstream.name, \"notifications/prompts/list_changed\", undefined);\n    });\n    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {\n      await this.refreshTools(upstream.name);\n      this.rebuildExposed();\n      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => undefined);\n    });\n    // Relay server→client requests (sampling, elicitation) to the downstream session that is\n    // waiting on this upstream. Clients created without those capabilities (tests) skip this.\n    try {\n      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {\n        const session = this.pickSession(upstream.name);\n        if (!session) throw new Error(\"no downstream client is connected to relay sampling to\");\n        const related = session.inflight.get(upstream.name)?.at(-1);\n        return session.server.server.createMessage(req.params, { relatedRequestId: related });\n      });\n      client.setRequestHandler(ElicitRequestSchema, async (req) => {\n        const session = this.pickSession(upstream.name);\n        if (!session) throw new Error(\"no downstream client is connected to relay elicitation to\");\n        const related = session.inflight.get(upstream.name)?.at(-1);\n        return session.server.server.elicitInput(req.params, { relatedRequestId: related });\n      });\n    } catch {\n      // client declared no sampling/elicitation capability\n    }\n  }\n\n  private pickSession(upstream: string): DownstreamSession | undefined {\n    let best: DownstreamSession | undefined;\n    for (const s of this.sessions) {\n      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;\n      if (!best || s.lastActive > best.lastActive) best = s;\n    }\n    return best;\n  }\n\n  private async broadcast(upstream: string, method: string, params: unknown): Promise<void> {\n    for (const s of this.sessions) {\n      const related = s.inflight.get(upstream)?.at(-1);\n      try {\n        await s.server.server.notification(\n          { method, params: params as Record<string, unknown> | undefined },\n          related !== undefined ? { relatedRequestId: related } : undefined,\n        );\n      } catch {\n        // session gone\n      }\n    }\n  }\n\n  /**\n   * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each\n   * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow\n   * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for\n   * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,\n   * changes nothing: the agent keeps the last good list, and the log says why.\n   */\n  private async refreshTools(name: string): Promise<void> {\n    const conn = this.connections.get(name);\n    if (!conn?.connected) return;\n    if (conn.capabilities && !conn.capabilities.tools) {\n      conn.tools = [];\n      return;\n    }\n    const kept = () =>\n      `keeping the last good list (${conn.tools.length} tool${conn.tools.length === 1 ? \"\" : \"s\"})`;\n    try {\n      const read = await readAllPages<Tool>(async (cursor) => {\n        const page = await conn.client.listTools(cursor ? { cursor } : undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        return { items: page.tools, nextCursor: page.nextCursor };\n      });\n      if (read.truncated) {\n        this.log(`tools/list for \"${name}\" not applied: ${read.truncated.reason}; ${kept()}`);\n        return;\n      }\n      conn.tools = read.items;\n    } catch (err) {\n      this.log(\n        `tools/list failed for \"${name}\": ${err instanceof Error ? err.message : String(err)}; ${kept()}`,\n      );\n    }\n  }\n\n  private rebuildExposed(): void {\n    const taken = new Set<string>();\n    const out: ExposedTool[] = [];\n    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];\n    for (const name of order) {\n      const conn = this.connections.get(name);\n      if (!conn) continue;\n      const prefix =\n        conn.upstream.prefix === true\n          ? name\n          : typeof conn.upstream.prefix === \"string\"\n            ? conn.upstream.prefix\n            : undefined;\n      for (const tool of conn.tools) {\n        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;\n        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;\n        if (taken.has(exposedName)) {\n          this.log(`skipping duplicate tool ${exposedName} from ${name}`);\n          continue;\n        }\n        taken.add(exposedName);\n        out.push({\n          name: exposedName,\n          upstream: name,\n          original: tool.name,\n          tool,\n          classification: classifyTool(\n            {\n              name: exposedName,\n              description: tool.description,\n              annotations: tool.annotations,\n              inputSchema: tool.inputSchema,\n              outputSchema: tool.outputSchema,\n            },\n            this.policy,\n          ),\n        });\n      }\n    }\n    this.exposed = out;\n  }\n\n  listTools(agent?: AgentScope | null): ExposedTool[] {\n    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams!.includes(t.upstream));\n    return this.exposed;\n  }\n\n  findTool(name: string): ExposedTool | undefined {\n    return this.exposed.find((t) => t.name === name);\n  }\n\n  upstreamStatus(): UpstreamStatus[] {\n    return [...this.connections.values()].map((c) => ({\n      name: c.upstream.name,\n      connected: c.connected,\n      tools: c.tools.length,\n      transport: c.upstream.url ? \"http\" : \"stdio\",\n      error: c.error,\n    }));\n  }\n\n  attach(session: DownstreamSession): void {\n    this.sessions.add(session);\n  }\n  detach(session: DownstreamSession): void {\n    this.sessions.delete(session);\n  }\n\n  /** Run a tool call through the policy engine and, if allowed, the upstream. */\n  async callTool(\n    name: string,\n    args: unknown,\n    ctx: CallContext,\n  ): Promise<{ result: GuardResult; tool?: ExposedTool }> {\n    const tool = this.findTool(name);\n    const agent = ctx.agent === undefined ? this.agent : ctx.agent;\n    if (!tool) {\n      const result = await this.guard.run(\n        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },\n        async () => {\n          throw new GuardError({\n            code: \"UNKNOWN_TOOL\",\n            cause: `no upstream exposes a tool named \"${name}\"`,\n            fix: \"call tools/list and use one of the listed names\",\n            retryable: false,\n          });\n        },\n      );\n      return { result };\n    }\n    const conn = this.connections.get(tool.upstream);\n    const track = (): (() => void) => {\n      if (!ctx.session || ctx.requestId === undefined) return () => undefined;\n      const list = ctx.session.inflight.get(tool.upstream) ?? [];\n      list.push(ctx.requestId);\n      ctx.session.inflight.set(tool.upstream, list);\n      return () => {\n        const l = ctx.session!.inflight.get(tool.upstream) ?? [];\n        const i = l.indexOf(ctx.requestId!);\n        if (i >= 0) l.splice(i, 1);\n      };\n    };\n    const result = await this.guard.run(\n      {\n        tool: {\n          name: tool.name,\n          description: tool.tool.description,\n          annotations: tool.tool.annotations,\n          inputSchema: tool.tool.inputSchema,\n          outputSchema: tool.tool.outputSchema,\n        },\n        args,\n        runId: ctx.runId,\n        agent,\n        sessionId: ctx.sessionId,\n        upstream: tool.upstream,\n      },\n      async (finalArgs) => {\n        if (!conn?.connected) {\n          throw new GuardError({\n            code: \"UPSTREAM_ERROR\",\n            cause: `upstream \"${tool.upstream}\" is not connected${conn?.error ? ` (${conn.error})` : \"\"}`,\n            fix: \"check the upstream command/url in okgate.yaml and restart the proxy\",\n            retryable: true,\n          });\n        }\n        const untrack = track();\n        try {\n          return (await conn.client.callTool(\n            { name: tool.original, arguments: (finalArgs ?? {}) as Record<string, unknown> },\n            undefined,\n            {\n              timeout: conn.upstream.timeout_ms,\n              resetTimeoutOnProgress: true,\n              onprogress: ctx.onprogress,\n            },\n          )) as CallToolResult;\n        } finally {\n          untrack();\n        }\n      },\n    );\n    return { result, tool };\n  }\n\n  private connectedWith(\n    capability: \"resources\" | \"prompts\" | \"completions\" | \"logging\",\n  ): Connection[] {\n    return [...this.connections.values()].filter(\n      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === undefined),\n    );\n  }\n\n  async listResources(): Promise<ListResourcesResult> {\n    const resources: Resource[] = [];\n    for (const conn of this.connectedWith(\"resources\")) {\n      try {\n        const page = await conn.client.listResources(undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        for (const r of page.resources) {\n          this.resourceOwner.set(r.uri, conn.upstream.name);\n          resources.push(r);\n        }\n      } catch {\n        // upstream has no resources\n      }\n    }\n    return { resources };\n  }\n\n  async listResourceTemplates(): Promise<ListResourceTemplatesResult> {\n    const resourceTemplates: ResourceTemplate[] = [];\n    for (const conn of this.connectedWith(\"resources\")) {\n      try {\n        const page = await conn.client.listResourceTemplates(undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        for (const t of page.resourceTemplates) {\n          this.templateOwner.set(t.uriTemplate, conn.upstream.name);\n          resourceTemplates.push(t);\n        }\n      } catch {\n        // none\n      }\n    }\n    return { resourceTemplates };\n  }\n\n  private ownerForUri(uri: string): Connection[] {\n    const owner = this.resourceOwner.get(uri);\n    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)!];\n    for (const [template, name] of this.templateOwner) {\n      if (templateMatches(template, uri) && this.connections.get(name)?.connected)\n        return [this.connections.get(name)!];\n    }\n    return this.connectedWith(\"resources\");\n  }\n\n  async readResource(uri: string): Promise<ReadResourceResult> {\n    let lastError: unknown;\n    for (const conn of this.ownerForUri(uri)) {\n      try {\n        const result = await conn.client.readResource(\n          { uri },\n          { timeout: conn.upstream.timeout_ms },\n        );\n        this.resourceOwner.set(uri, conn.upstream.name);\n        return result;\n      } catch (err) {\n        lastError = err;\n      }\n    }\n    throw lastError ?? new Error(`no upstream serves resource ${uri}`);\n  }\n\n  async subscribe(uri: string, on: boolean): Promise<void> {\n    for (const conn of this.ownerForUri(uri)) {\n      try {\n        if (on) await conn.client.subscribeResource({ uri });\n        else await conn.client.unsubscribeResource({ uri });\n        return;\n      } catch {\n        // try next\n      }\n    }\n  }\n\n  async listPrompts(): Promise<ListPromptsResult> {\n    const prompts: Prompt[] = [];\n    const taken = new Set<string>();\n    this.promptOwner.clear();\n    for (const conn of this.connectedWith(\"prompts\")) {\n      try {\n        const page = await conn.client.listPrompts(undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        for (const p of page.prompts) {\n          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;\n          taken.add(name);\n          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });\n          prompts.push({ ...p, name });\n        }\n      } catch {\n        // none\n      }\n    }\n    return { prompts };\n  }\n\n  async getPrompt(\n    name: string,\n    args: Record<string, string> | undefined,\n  ): Promise<GetPromptResult> {\n    if (this.promptOwner.size === 0) await this.listPrompts();\n    const owner = this.promptOwner.get(name);\n    const conns = owner ? [this.connections.get(owner.upstream)!] : this.connectedWith(\"prompts\");\n    let lastError: unknown;\n    for (const conn of conns) {\n      try {\n        return await conn.client.getPrompt(\n          { name: owner?.original ?? name, arguments: args },\n          { timeout: conn.upstream.timeout_ms },\n        );\n      } catch (err) {\n        lastError = err;\n      }\n    }\n    throw lastError ?? new Error(`no upstream serves prompt ${name}`);\n  }\n\n  async complete(params: CompleteRequest[\"params\"]): Promise<CompleteResult> {\n    let conns: Connection[];\n    if (params.ref.type === \"ref/prompt\") {\n      if (this.promptOwner.size === 0) await this.listPrompts();\n      const owner = this.promptOwner.get(params.ref.name);\n      conns = owner ? [this.connections.get(owner.upstream)!] : this.connectedWith(\"completions\");\n      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };\n    } else {\n      if (this.templateOwner.size === 0) await this.listResourceTemplates();\n      conns = this.ownerForUri(params.ref.uri);\n    }\n    let lastError: unknown;\n    for (const conn of conns) {\n      try {\n        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });\n      } catch (err) {\n        lastError = err;\n      }\n    }\n    throw lastError ?? new Error(\"no upstream supports completions\");\n  }\n\n  async setLevel(level: LoggingLevel): Promise<void> {\n    await Promise.all(\n      this.connectedWith(\"logging\").map((c) =>\n        c.client.setLoggingLevel(level).catch(() => undefined),\n      ),\n    );\n  }\n\n  async close(): Promise<void> {\n    this.closing = true;\n    for (const conn of this.connections.values()) {\n      try {\n        await conn.client.close();\n      } catch {\n        // already closed\n      }\n    }\n    this.connections.clear();\n  }\n}\n\nfunction templateMatches(template: string, uri: string): boolean {\n  const re = new RegExp(\n    \"^\" + template.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replace(/\\\\\\{[^}]+\\\\\\}/g, \"[^/]+\") + \"$\",\n  );\n  return re.test(uri);\n}\n\nexport async function withTimeout<T>(promise: Promise<T>, ms: number, what: string): Promise<T> {\n  let timer: NodeJS.Timeout | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);\n  });\n  try {\n    return await Promise.race([promise, timeout]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n"],"mappings":";;;;;;;;AAKA,SAAS,cAAc;AAEvB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAE9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAcK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AAsEA,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,oBAAI,IAAuB;AAAA,EAC9B,cAAc,oBAAI,IAAwB;AAAA,EACnD,UAAyB,CAAC;AAAA,EACjB,gBAAgB,oBAAI,IAAoB;AAAA,EACxC,gBAAgB,oBAAI,IAAoB;AAAA,EACxC,cAAc,oBAAI,IAAoD;AAAA,EACtE;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAET,UAAU;AAAA,EAElB,YAAY,MAAsB;AAChC,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK;AAClB,SAAK,eAAe,KAAK;AACzB,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,MAAM,KAAK,QAAQ,CAAC,SAAS,QAAQ,OAAO,MAAM,YAAY,IAAI;AAAA,CAAI;AAC3E,SAAK,mBAAmB,KAAK,oBAAoB;AACjD,SAAK,cAAc,KAAK,WAAW,CAAC;AAAA,EACtC;AAAA,EAEA,IAAI,SAAS;AACX,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,IAAI,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC;AACnE,eAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,KAAK,WAAW,GAAG;AAC7D,UAAI,KAAK,YAAY,IAAI,IAAI,EAAG;AAChC,YAAM,WAAqB;AAAA,QACzB;AAAA,QACA,SAAS;AAAA,QACT,MAAM,CAAC;AAAA,QACP,KAAK,CAAC;AAAA,QACN,SAAS,CAAC;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,MACd;AACA,YAAM,OAAmB;AAAA,QACvB;AAAA,QACA;AAAA,QACA,OAAO,CAAC;AAAA,QACR,cAAc,OAAO,sBAAsB;AAAA,QAC3C,WAAW;AAAA,MACb;AACA,WAAK,YAAY,IAAI,MAAM,IAAI;AAC/B,WAAK,KAAK,IAAI;AACd,YAAM,KAAK,aAAa,IAAI;AAAA,IAC9B;AACA,SAAK,eAAe;AACpB,UAAM,SAAS,KAAK,eAAe;AACnC,SAAK;AAAA,MACH,aAAa,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,OAAO,MAAM,eAAe,KAAK,QAAQ,MAAM,gBAAgB,KAAK,OAAO,IAAI;AAAA,IAC1I;AAAA,EACF;AAAA,EAEA,MAAc,QAAQ,UAAmC;AACvD,UAAM,SAAS,IAAI;AAAA,MACjB,EAAE,MAAM,UAAU,SAAS,QAAW,EAAE;AAAA,MACxC,EAAE,cAAc,EAAE,UAAU,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE;AAAA,IACpD;AACA,UAAM,OAAmB;AAAA,MACvB;AAAA,MACA;AAAA,MACA,OAAO,CAAC;AAAA,MACR,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AACA,SAAK,YAAY,IAAI,SAAS,MAAM,IAAI;AACxC,QAAI;AACF,YAAM,YAAY,SAAS,MACvB,IAAI,8BAA8B,IAAI,IAAI,SAAS,GAAG,GAAG;AAAA,QACvD,aAAa,EAAE,SAAS,gBAAgB,QAAQ,EAAE;AAAA,MACpD,CAAC,IACD,IAAI,qBAAqB;AAAA,QACvB,SAAS,SAAS;AAAA,QAClB,MAAM,SAAS;AAAA,QACf,KAAK,EAAE,GAAG,sBAAsB,GAAG,GAAG,SAAS,IAAI;AAAA,QACnD,KAAK,SAAS;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AACL,UAAI,qBAAqB,sBAAsB;AAC7C,kBAAU,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC9C,cAAI,KAAK,QAAS;AAClB,qBAAW,QAAQ,MAAM,SAAS,MAAM,EAAE,MAAM,IAAI;AAClD,gBAAI,KAAK,KAAK,EAAG,MAAK,IAAI,GAAG,SAAS,IAAI,KAAK,IAAI,EAAE;AAAA,QACzD,CAAC;AAAA,MACH;AACA,YAAM;AAAA,QACJ,OAAO,QAAQ,SAAS;AAAA,QACxB,KAAK;AAAA,QACL,wBAAwB,SAAS,IAAI;AAAA,MACvC;AACA,WAAK,eAAe,OAAO,sBAAsB;AACjD,WAAK,YAAY;AACjB,WAAK,KAAK,IAAI;AACd,YAAM,KAAK,aAAa,SAAS,IAAI;AAAA,IACvC,SAAS,KAAK;AACZ,WAAK,YAAY;AACjB,WAAK,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC5D,WAAK,IAAI,aAAa,SAAS,IAAI,kBAAkB,KAAK,KAAK,EAAE;AAAA,IACnE;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,UAAM,EAAE,QAAQ,SAAS,IAAI;AAC7B,WAAO,UAAU,MAAM;AACrB,WAAK,YAAY;AACjB,WAAK,QAAQ;AACb,UAAI,CAAC,KAAK,QAAS,MAAK,IAAI,aAAa,SAAS,IAAI,UAAU;AAAA,IAClE;AACA,WAAO,uBAAuB,kCAAkC,OAAO,MAAM;AAC3E,YAAM,KAAK,UAAU,SAAS,MAAM,EAAE,QAAQ,EAAE,MAAM;AAAA,IACxD,CAAC;AACD,WAAO,uBAAuB,mCAAmC,OAAO,MAAM;AAC5E,YAAM,KAAK,UAAU,SAAS,MAAM,EAAE,QAAQ,EAAE,MAAM;AAAA,IACxD,CAAC;AACD,WAAO,uBAAuB,uCAAuC,YAAY;AAC/E,WAAK,cAAc,MAAM;AACzB,YAAM,KAAK,UAAU,SAAS,MAAM,wCAAwC,MAAS;AAAA,IACvF,CAAC;AACD,WAAO,uBAAuB,qCAAqC,YAAY;AAC7E,WAAK,YAAY,MAAM;AACvB,YAAM,KAAK,UAAU,SAAS,MAAM,sCAAsC,MAAS;AAAA,IACrF,CAAC;AACD,WAAO,uBAAuB,mCAAmC,YAAY;AAC3E,YAAM,KAAK,aAAa,SAAS,IAAI;AACrC,WAAK,eAAe;AACpB,iBAAW,KAAK,KAAK,SAAU,GAAE,OAAO,OAAO,oBAAoB,EAAE,MAAM,MAAM,MAAS;AAAA,IAC5F,CAAC;AAGD,QAAI;AACF,aAAO,kBAAkB,4BAA4B,OAAO,QAAQ;AAClE,cAAM,UAAU,KAAK,YAAY,SAAS,IAAI;AAC9C,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,wDAAwD;AACtF,cAAM,UAAU,QAAQ,SAAS,IAAI,SAAS,IAAI,GAAG,GAAG,EAAE;AAC1D,eAAO,QAAQ,OAAO,OAAO,cAAc,IAAI,QAAQ,EAAE,kBAAkB,QAAQ,CAAC;AAAA,MACtF,CAAC;AACD,aAAO,kBAAkB,qBAAqB,OAAO,QAAQ;AAC3D,cAAM,UAAU,KAAK,YAAY,SAAS,IAAI;AAC9C,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,2DAA2D;AACzF,cAAM,UAAU,QAAQ,SAAS,IAAI,SAAS,IAAI,GAAG,GAAG,EAAE;AAC1D,eAAO,QAAQ,OAAO,OAAO,YAAY,IAAI,QAAQ,EAAE,kBAAkB,QAAQ,CAAC;AAAA,MACpF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,YAAY,UAAiD;AACnE,QAAI;AACJ,eAAW,KAAK,KAAK,UAAU;AAC7B,WAAK,EAAE,SAAS,IAAI,QAAQ,GAAG,UAAU,KAAK,EAAG,QAAO;AACxD,UAAI,CAAC,QAAQ,EAAE,aAAa,KAAK,WAAY,QAAO;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,UAAkB,QAAgB,QAAgC;AACxF,eAAW,KAAK,KAAK,UAAU;AAC7B,YAAM,UAAU,EAAE,SAAS,IAAI,QAAQ,GAAG,GAAG,EAAE;AAC/C,UAAI;AACF,cAAM,EAAE,OAAO,OAAO;AAAA,UACpB,EAAE,QAAQ,OAAsD;AAAA,UAChE,YAAY,SAAY,EAAE,kBAAkB,QAAQ,IAAI;AAAA,QAC1D;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,aAAa,MAA6B;AACtD,UAAM,OAAO,KAAK,YAAY,IAAI,IAAI;AACtC,QAAI,CAAC,MAAM,UAAW;AACtB,QAAI,KAAK,gBAAgB,CAAC,KAAK,aAAa,OAAO;AACjD,WAAK,QAAQ,CAAC;AACd;AAAA,IACF;AACA,UAAM,OAAO,MACX,+BAA+B,KAAK,MAAM,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAC5F,QAAI;AACF,YAAM,OAAO,MAAM,aAAmB,OAAO,WAAW;AACtD,cAAM,OAAO,MAAM,KAAK,OAAO,UAAU,SAAS,EAAE,OAAO,IAAI,QAAW;AAAA,UACxE,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,eAAO,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,WAAW;AAAA,MAC1D,CAAC;AACD,UAAI,KAAK,WAAW;AAClB,aAAK,IAAI,mBAAmB,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC,EAAE;AACpF;AAAA,MACF;AACA,WAAK,QAAQ,KAAK;AAAA,IACpB,SAAS,KAAK;AACZ,WAAK;AAAA,QACH,0BAA0B,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,KAAK,KAAK,CAAC;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iBAAuB;AAC7B,UAAM,QAAQ,oBAAI,IAAY;AAC9B,UAAM,MAAqB,CAAC;AAC5B,UAAM,QAAQ,CAAC,GAAG,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC;AAC5F,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,KAAK,YAAY,IAAI,IAAI;AACtC,UAAI,CAAC,KAAM;AACX,YAAM,SACJ,KAAK,SAAS,WAAW,OACrB,OACA,OAAO,KAAK,SAAS,WAAW,WAC9B,KAAK,SAAS,SACd;AACR,iBAAW,QAAQ,KAAK,OAAO;AAC7B,YAAI,cAAc,SAAS,GAAG,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK;AAC5D,YAAI,MAAM,IAAI,WAAW,EAAG,eAAc,GAAG,IAAI,KAAK,KAAK,IAAI;AAC/D,YAAI,MAAM,IAAI,WAAW,GAAG;AAC1B,eAAK,IAAI,2BAA2B,WAAW,SAAS,IAAI,EAAE;AAC9D;AAAA,QACF;AACA,cAAM,IAAI,WAAW;AACrB,YAAI,KAAK;AAAA,UACP,MAAM;AAAA,UACN,UAAU;AAAA,UACV,UAAU,KAAK;AAAA,UACf;AAAA,UACA,gBAAgB;AAAA,YACd;AAAA,cACE,MAAM;AAAA,cACN,aAAa,KAAK;AAAA,cAClB,aAAa,KAAK;AAAA,cAClB,aAAa,KAAK;AAAA,cAClB,cAAc,KAAK;AAAA,YACrB;AAAA,YACA,KAAK;AAAA,UACP;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AACA,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,UAAU,OAA0C;AAClD,QAAI,OAAO,UAAW,QAAO,KAAK,QAAQ,OAAO,CAAC,MAAM,MAAM,UAAW,SAAS,EAAE,QAAQ,CAAC;AAC7F,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,SAAS,MAAuC;AAC9C,WAAO,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAAA,EACjD;AAAA,EAEA,iBAAmC;AACjC,WAAO,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MAChD,MAAM,EAAE,SAAS;AAAA,MACjB,WAAW,EAAE;AAAA,MACb,OAAO,EAAE,MAAM;AAAA,MACf,WAAW,EAAE,SAAS,MAAM,SAAS;AAAA,MACrC,OAAO,EAAE;AAAA,IACX,EAAE;AAAA,EACJ;AAAA,EAEA,OAAO,SAAkC;AACvC,SAAK,SAAS,IAAI,OAAO;AAAA,EAC3B;AAAA,EACA,OAAO,SAAkC;AACvC,SAAK,SAAS,OAAO,OAAO;AAAA,EAC9B;AAAA;AAAA,EAGA,MAAM,SACJ,MACA,MACA,KACsD;AACtD,UAAM,OAAO,KAAK,SAAS,IAAI;AAC/B,UAAM,QAAQ,IAAI,UAAU,SAAY,KAAK,QAAQ,IAAI;AACzD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,MAAM,KAAK,MAAM;AAAA,QAC9B,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,OAAO,IAAI,OAAO,OAAO,WAAW,IAAI,UAAU;AAAA,QAC1E,YAAY;AACV,gBAAM,IAAI,WAAW;AAAA,YACnB,MAAM;AAAA,YACN,OAAO,qCAAqC,IAAI;AAAA,YAChD,KAAK;AAAA,YACL,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO,EAAE,QAAAA,QAAO;AAAA,IAClB;AACA,UAAM,OAAO,KAAK,YAAY,IAAI,KAAK,QAAQ;AAC/C,UAAM,QAAQ,MAAoB;AAChC,UAAI,CAAC,IAAI,WAAW,IAAI,cAAc,OAAW,QAAO,MAAM;AAC9D,YAAM,OAAO,IAAI,QAAQ,SAAS,IAAI,KAAK,QAAQ,KAAK,CAAC;AACzD,WAAK,KAAK,IAAI,SAAS;AACvB,UAAI,QAAQ,SAAS,IAAI,KAAK,UAAU,IAAI;AAC5C,aAAO,MAAM;AACX,cAAM,IAAI,IAAI,QAAS,SAAS,IAAI,KAAK,QAAQ,KAAK,CAAC;AACvD,cAAM,IAAI,EAAE,QAAQ,IAAI,SAAU;AAClC,YAAI,KAAK,EAAG,GAAE,OAAO,GAAG,CAAC;AAAA,MAC3B;AAAA,IACF;AACA,UAAM,SAAS,MAAM,KAAK,MAAM;AAAA,MAC9B;AAAA,QACE,MAAM;AAAA,UACJ,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,KAAK;AAAA,UACvB,aAAa,KAAK,KAAK;AAAA,UACvB,aAAa,KAAK,KAAK;AAAA,UACvB,cAAc,KAAK,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,OAAO,IAAI;AAAA,QACX;AAAA,QACA,WAAW,IAAI;AAAA,QACf,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,OAAO,cAAc;AACnB,YAAI,CAAC,MAAM,WAAW;AACpB,gBAAM,IAAI,WAAW;AAAA,YACnB,MAAM;AAAA,YACN,OAAO,aAAa,KAAK,QAAQ,qBAAqB,MAAM,QAAQ,KAAK,KAAK,KAAK,MAAM,EAAE;AAAA,YAC3F,KAAK;AAAA,YACL,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,UAAU,MAAM;AACtB,YAAI;AACF,iBAAQ,MAAM,KAAK,OAAO;AAAA,YACxB,EAAE,MAAM,KAAK,UAAU,WAAY,aAAa,CAAC,EAA8B;AAAA,YAC/E;AAAA,YACA;AAAA,cACE,SAAS,KAAK,SAAS;AAAA,cACvB,wBAAwB;AAAA,cACxB,YAAY,IAAI;AAAA,YAClB;AAAA,UACF;AAAA,QACF,UAAE;AACA,kBAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB;AAAA,EAEQ,cACN,YACc;AACd,WAAO,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,EAAE;AAAA,MACpC,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,UAAU,KAAK,EAAE,iBAAiB;AAAA,IAC5E;AAAA,EACF;AAAA,EAEA,MAAM,gBAA8C;AAClD,UAAM,YAAwB,CAAC;AAC/B,eAAW,QAAQ,KAAK,cAAc,WAAW,GAAG;AAClD,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,cAAc,QAAW;AAAA,UACtD,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,mBAAW,KAAK,KAAK,WAAW;AAC9B,eAAK,cAAc,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI;AAChD,oBAAU,KAAK,CAAC;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,UAAU;AAAA,EACrB;AAAA,EAEA,MAAM,wBAA8D;AAClE,UAAM,oBAAwC,CAAC;AAC/C,eAAW,QAAQ,KAAK,cAAc,WAAW,GAAG;AAClD,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,sBAAsB,QAAW;AAAA,UAC9D,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,mBAAW,KAAK,KAAK,mBAAmB;AACtC,eAAK,cAAc,IAAI,EAAE,aAAa,KAAK,SAAS,IAAI;AACxD,4BAAkB,KAAK,CAAC;AAAA,QAC1B;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,kBAAkB;AAAA,EAC7B;AAAA,EAEQ,YAAY,KAA2B;AAC7C,UAAM,QAAQ,KAAK,cAAc,IAAI,GAAG;AACxC,QAAI,SAAS,KAAK,YAAY,IAAI,KAAK,GAAG,UAAW,QAAO,CAAC,KAAK,YAAY,IAAI,KAAK,CAAE;AACzF,eAAW,CAAC,UAAU,IAAI,KAAK,KAAK,eAAe;AACjD,UAAI,gBAAgB,UAAU,GAAG,KAAK,KAAK,YAAY,IAAI,IAAI,GAAG;AAChE,eAAO,CAAC,KAAK,YAAY,IAAI,IAAI,CAAE;AAAA,IACvC;AACA,WAAO,KAAK,cAAc,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,aAAa,KAA0C;AAC3D,QAAI;AACJ,eAAW,QAAQ,KAAK,YAAY,GAAG,GAAG;AACxC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AAAA,UAC/B,EAAE,IAAI;AAAA,UACN,EAAE,SAAS,KAAK,SAAS,WAAW;AAAA,QACtC;AACA,aAAK,cAAc,IAAI,KAAK,KAAK,SAAS,IAAI;AAC9C,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM,aAAa,IAAI,MAAM,+BAA+B,GAAG,EAAE;AAAA,EACnE;AAAA,EAEA,MAAM,UAAU,KAAa,IAA4B;AACvD,eAAW,QAAQ,KAAK,YAAY,GAAG,GAAG;AACxC,UAAI;AACF,YAAI,GAAI,OAAM,KAAK,OAAO,kBAAkB,EAAE,IAAI,CAAC;AAAA,YAC9C,OAAM,KAAK,OAAO,oBAAoB,EAAE,IAAI,CAAC;AAClD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAA0C;AAC9C,UAAM,UAAoB,CAAC;AAC3B,UAAM,QAAQ,oBAAI,IAAY;AAC9B,SAAK,YAAY,MAAM;AACvB,eAAW,QAAQ,KAAK,cAAc,SAAS,GAAG;AAChD,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,YAAY,QAAW;AAAA,UACpD,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,mBAAW,KAAK,KAAK,SAAS;AAC5B,gBAAM,OAAO,MAAM,IAAI,EAAE,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE;AACxE,gBAAM,IAAI,IAAI;AACd,eAAK,YAAY,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,MAAM,UAAU,EAAE,KAAK,CAAC;AAC7E,kBAAQ,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC;AAAA,QAC7B;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,QAAQ;AAAA,EACnB;AAAA,EAEA,MAAM,UACJ,MACA,MAC0B;AAC1B,QAAI,KAAK,YAAY,SAAS,EAAG,OAAM,KAAK,YAAY;AACxD,UAAM,QAAQ,KAAK,YAAY,IAAI,IAAI;AACvC,UAAM,QAAQ,QAAQ,CAAC,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAE,IAAI,KAAK,cAAc,SAAS;AAC5F,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,eAAO,MAAM,KAAK,OAAO;AAAA,UACvB,EAAE,MAAM,OAAO,YAAY,MAAM,WAAW,KAAK;AAAA,UACjD,EAAE,SAAS,KAAK,SAAS,WAAW;AAAA,QACtC;AAAA,MACF,SAAS,KAAK;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM,aAAa,IAAI,MAAM,6BAA6B,IAAI,EAAE;AAAA,EAClE;AAAA,EAEA,MAAM,SAAS,QAA4D;AACzE,QAAI;AACJ,QAAI,OAAO,IAAI,SAAS,cAAc;AACpC,UAAI,KAAK,YAAY,SAAS,EAAG,OAAM,KAAK,YAAY;AACxD,YAAM,QAAQ,KAAK,YAAY,IAAI,OAAO,IAAI,IAAI;AAClD,cAAQ,QAAQ,CAAC,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAE,IAAI,KAAK,cAAc,aAAa;AAC1F,UAAI,MAAO,UAAS,EAAE,GAAG,QAAQ,KAAK,EAAE,GAAG,OAAO,KAAK,MAAM,MAAM,SAAS,EAAE;AAAA,IAChF,OAAO;AACL,UAAI,KAAK,cAAc,SAAS,EAAG,OAAM,KAAK,sBAAsB;AACpE,cAAQ,KAAK,YAAY,OAAO,IAAI,GAAG;AAAA,IACzC;AACA,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,eAAO,MAAM,KAAK,OAAO,SAAS,QAAQ,EAAE,SAAS,KAAK,SAAS,WAAW,CAAC;AAAA,MACjF,SAAS,KAAK;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM,aAAa,IAAI,MAAM,kCAAkC;AAAA,EACjE;AAAA,EAEA,MAAM,SAAS,OAAoC;AACjD,UAAM,QAAQ;AAAA,MACZ,KAAK,cAAc,SAAS,EAAE;AAAA,QAAI,CAAC,MACjC,EAAE,OAAO,gBAAgB,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,eAAW,QAAQ,KAAK,YAAY,OAAO,GAAG;AAC5C,UAAI;AACF,cAAM,KAAK,OAAO,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,YAAY,MAAM;AAAA,EACzB;AACF;AAEA,SAAS,gBAAgB,UAAkB,KAAsB;AAC/D,QAAM,KAAK,IAAI;AAAA,IACb,MAAM,SAAS,QAAQ,uBAAuB,MAAM,EAAE,QAAQ,kBAAkB,OAAO,IAAI;AAAA,EAC7F;AACA,SAAO,GAAG,KAAK,GAAG;AACpB;AAEA,eAAsB,YAAe,SAAqB,IAAY,MAA0B;AAC9F,MAAI;AACJ,QAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,YAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,GAAG,IAAI,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE;AAAA,EACnF,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,EAC9C,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;","names":["result"]}