@animalabs/agent-framework 0.8.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/src/agent.d.ts +10 -0
- package/dist/src/agent.d.ts.map +1 -1
- package/dist/src/agent.js +33 -3
- package/dist/src/agent.js.map +1 -1
- package/dist/src/framework.d.ts +171 -15
- package/dist/src/framework.d.ts.map +1 -1
- package/dist/src/framework.js +1059 -224
- package/dist/src/framework.js.map +1 -1
- package/dist/src/gate/event-gate.d.ts +11 -0
- package/dist/src/gate/event-gate.d.ts.map +1 -1
- package/dist/src/gate/event-gate.js +66 -0
- package/dist/src/gate/event-gate.js.map +1 -1
- package/dist/src/index.d.ts +1 -0
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +1 -0
- package/dist/src/index.js.map +1 -1
- package/dist/src/mcpl/capability-grant.d.ts +115 -0
- package/dist/src/mcpl/capability-grant.d.ts.map +1 -0
- package/dist/src/mcpl/capability-grant.js +291 -0
- package/dist/src/mcpl/capability-grant.js.map +1 -0
- package/dist/src/mcpl/capability-mask.d.ts +51 -0
- package/dist/src/mcpl/capability-mask.d.ts.map +1 -0
- package/dist/src/mcpl/capability-mask.js +190 -0
- package/dist/src/mcpl/capability-mask.js.map +1 -0
- package/dist/src/mcpl/channel-registry.d.ts +3 -1
- package/dist/src/mcpl/channel-registry.d.ts.map +1 -1
- package/dist/src/mcpl/channel-registry.js +163 -36
- package/dist/src/mcpl/channel-registry.js.map +1 -1
- package/dist/src/mcpl/checkpoint-manager.d.ts +8 -3
- package/dist/src/mcpl/checkpoint-manager.d.ts.map +1 -1
- package/dist/src/mcpl/checkpoint-manager.js +28 -8
- package/dist/src/mcpl/checkpoint-manager.js.map +1 -1
- package/dist/src/mcpl/errors.d.ts +6 -0
- package/dist/src/mcpl/errors.d.ts.map +1 -1
- package/dist/src/mcpl/errors.js +6 -0
- package/dist/src/mcpl/errors.js.map +1 -1
- package/dist/src/mcpl/feature-set-manager.d.ts +10 -1
- package/dist/src/mcpl/feature-set-manager.d.ts.map +1 -1
- package/dist/src/mcpl/feature-set-manager.js +45 -4
- package/dist/src/mcpl/feature-set-manager.js.map +1 -1
- package/dist/src/mcpl/hook-orchestrator.d.ts +10 -14
- package/dist/src/mcpl/hook-orchestrator.d.ts.map +1 -1
- package/dist/src/mcpl/hook-orchestrator.js +58 -67
- package/dist/src/mcpl/hook-orchestrator.js.map +1 -1
- package/dist/src/mcpl/index.d.ts +1 -1
- package/dist/src/mcpl/index.d.ts.map +1 -1
- package/dist/src/mcpl/index.js.map +1 -1
- package/dist/src/mcpl/prose-stream-router.d.ts +9 -0
- package/dist/src/mcpl/prose-stream-router.d.ts.map +1 -1
- package/dist/src/mcpl/prose-stream-router.js +16 -0
- package/dist/src/mcpl/prose-stream-router.js.map +1 -1
- package/dist/src/mcpl/push-handler.d.ts.map +1 -1
- package/dist/src/mcpl/push-handler.js +20 -2
- package/dist/src/mcpl/push-handler.js.map +1 -1
- package/dist/src/mcpl/server-connection.d.ts +93 -9
- package/dist/src/mcpl/server-connection.d.ts.map +1 -1
- package/dist/src/mcpl/server-connection.js +231 -32
- package/dist/src/mcpl/server-connection.js.map +1 -1
- package/dist/src/mcpl/server-registry.d.ts.map +1 -1
- package/dist/src/mcpl/server-registry.js +4 -3
- package/dist/src/mcpl/server-registry.js.map +1 -1
- package/dist/src/mcpl/tags.d.ts +24 -0
- package/dist/src/mcpl/tags.d.ts.map +1 -0
- package/dist/src/mcpl/tags.js +52 -0
- package/dist/src/mcpl/tags.js.map +1 -0
- package/dist/src/mcpl/transport.d.ts.map +1 -1
- package/dist/src/mcpl/transport.js +10 -0
- package/dist/src/mcpl/transport.js.map +1 -1
- package/dist/src/mcpl/types.d.ts +159 -64
- package/dist/src/mcpl/types.d.ts.map +1 -1
- package/dist/src/mcpl/types.js +16 -2
- package/dist/src/mcpl/types.js.map +1 -1
- package/dist/src/refusal-reactions.d.ts +27 -0
- package/dist/src/refusal-reactions.d.ts.map +1 -0
- package/dist/src/refusal-reactions.js +35 -0
- package/dist/src/refusal-reactions.js.map +1 -0
- package/dist/src/tool-result-history.d.ts +10 -0
- package/dist/src/tool-result-history.d.ts.map +1 -1
- package/dist/src/tool-result-history.js +16 -5
- package/dist/src/tool-result-history.js.map +1 -1
- package/dist/src/types/agent.d.ts +35 -0
- package/dist/src/types/agent.d.ts.map +1 -1
- package/dist/src/types/framework.d.ts +16 -0
- package/dist/src/types/framework.d.ts.map +1 -1
- package/dist/src/types/trace.d.ts +24 -0
- package/dist/src/types/trace.d.ts.map +1 -1
- package/dist/test/channel-registry-routing.test.js +38 -10
- package/dist/test/channel-registry-routing.test.js.map +1 -1
- package/dist/test/channel-registry-typing.test.js +10 -1
- package/dist/test/channel-registry-typing.test.js.map +1 -1
- package/dist/test/checkpoint-attribution.test.js +168 -8
- package/dist/test/checkpoint-attribution.test.js.map +1 -1
- package/dist/test/conversation-fork-injection-scoping.test.js +8 -3
- package/dist/test/conversation-fork-injection-scoping.test.js.map +1 -1
- package/dist/test/event-gate-selfwake.test.d.ts +15 -0
- package/dist/test/event-gate-selfwake.test.d.ts.map +1 -0
- package/dist/test/event-gate-selfwake.test.js +125 -0
- package/dist/test/event-gate-selfwake.test.js.map +1 -0
- package/dist/test/machine-close-provenance.test.js +6 -0
- package/dist/test/machine-close-provenance.test.js.map +1 -1
- package/dist/test/mcpl-awareness-barrier.test.js +10 -0
- package/dist/test/mcpl-awareness-barrier.test.js.map +1 -1
- package/dist/test/mcpl-capability-grant.test.d.ts +10 -0
- package/dist/test/mcpl-capability-grant.test.d.ts.map +1 -0
- package/dist/test/mcpl-capability-grant.test.js +109 -0
- package/dist/test/mcpl-capability-grant.test.js.map +1 -0
- package/dist/test/mcpl-capability-scoping.test.d.ts +2 -0
- package/dist/test/mcpl-capability-scoping.test.d.ts.map +1 -0
- package/dist/test/mcpl-capability-scoping.test.js +266 -0
- package/dist/test/mcpl-capability-scoping.test.js.map +1 -0
- package/dist/test/mcpl-gate-roundtrip.test.js +13 -0
- package/dist/test/mcpl-gate-roundtrip.test.js.map +1 -1
- package/dist/test/mcpl-list-status.test.d.ts +2 -0
- package/dist/test/mcpl-list-status.test.d.ts.map +1 -0
- package/dist/test/mcpl-list-status.test.js +78 -0
- package/dist/test/mcpl-list-status.test.js.map +1 -0
- package/dist/test/mcpl-manifest-changed.test.d.ts +2 -0
- package/dist/test/mcpl-manifest-changed.test.d.ts.map +1 -0
- package/dist/test/mcpl-manifest-changed.test.js +177 -0
- package/dist/test/mcpl-manifest-changed.test.js.map +1 -0
- package/dist/test/mcpl-reconnect-events.test.js +27 -2
- package/dist/test/mcpl-reconnect-events.test.js.map +1 -1
- package/dist/test/mcpl-reconnect-reregistration.test.js +53 -17
- package/dist/test/mcpl-reconnect-reregistration.test.js.map +1 -1
- package/dist/test/mcpl-request-timeout.test.js +1 -1
- package/dist/test/mcpl-request-timeout.test.js.map +1 -1
- package/dist/test/physical-window-restart.test.d.ts +14 -0
- package/dist/test/physical-window-restart.test.d.ts.map +1 -0
- package/dist/test/physical-window-restart.test.js +222 -0
- package/dist/test/physical-window-restart.test.js.map +1 -0
- package/dist/test/present-while-acting.test.js +199 -1
- package/dist/test/present-while-acting.test.js.map +1 -1
- package/dist/test/refusal-reaction-baseline.test.d.ts +2 -0
- package/dist/test/refusal-reaction-baseline.test.d.ts.map +1 -0
- package/dist/test/refusal-reaction-baseline.test.js +74 -0
- package/dist/test/refusal-reaction-baseline.test.js.map +1 -0
- package/dist/test/state-scaling-e2e.test.js +7 -1
- package/dist/test/state-scaling-e2e.test.js.map +1 -1
- package/dist/test/state-scaling.test.js +9 -1
- package/dist/test/state-scaling.test.js.map +1 -1
- package/dist/test/tool-result-spill.test.d.ts +13 -0
- package/dist/test/tool-result-spill.test.d.ts.map +1 -0
- package/dist/test/tool-result-spill.test.js +463 -0
- package/dist/test/tool-result-spill.test.js.map +1 -0
- package/dist/test/trunk-channel-routing.test.js +45 -0
- package/dist/test/trunk-channel-routing.test.js.map +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +4 -4
- package/src/agent.ts +37 -3
- package/src/framework.ts +1219 -248
- package/src/gate/event-gate.ts +72 -0
- package/src/index.ts +1 -0
- package/src/mcpl/capability-grant.ts +319 -0
- package/src/mcpl/capability-mask.ts +228 -0
- package/src/mcpl/channel-registry.ts +167 -39
- package/src/mcpl/checkpoint-manager.ts +28 -8
- package/src/mcpl/errors.ts +7 -0
- package/src/mcpl/feature-set-manager.ts +50 -5
- package/src/mcpl/hook-orchestrator.ts +64 -86
- package/src/mcpl/index.ts +0 -2
- package/src/mcpl/prose-stream-router.ts +17 -0
- package/src/mcpl/push-handler.ts +18 -2
- package/src/mcpl/server-connection.ts +262 -34
- package/src/mcpl/server-registry.ts +4 -3
- package/src/mcpl/tags.ts +50 -0
- package/src/mcpl/transport.ts +11 -0
- package/src/mcpl/types.ts +176 -78
- package/src/refusal-reactions.ts +37 -0
- package/src/tool-result-history.ts +17 -5
- package/src/types/agent.ts +36 -0
- package/src/types/framework.ts +17 -0
- package/src/types/trace.ts +22 -0
|
@@ -0,0 +1,291 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Capability grants — the MCPL 0.5 security boundary (SPEC §5.4).
|
|
3
|
+
*
|
|
4
|
+
* Three layers, kept deliberately distinct:
|
|
5
|
+
*
|
|
6
|
+
* 1. **Advertisement walk** — what the server *can* do, read from its
|
|
7
|
+
* initialize response by a generic recursive walk over the §6.2
|
|
8
|
+
* vocabulary. Boolean `true` at any level is shorthand for every leaf
|
|
9
|
+
* beneath it (§5.1). An unrecognized member name cannot mint a
|
|
10
|
+
* capability. Advertisement is an input, never an authorization.
|
|
11
|
+
*
|
|
12
|
+
* 2. **Config mask** — host policy from `enabledCapabilities` /
|
|
13
|
+
* `disabledCapabilities` (folded in from PR #75, Meganeuridae's
|
|
14
|
+
* capability-scoping work, semantics unchanged). This is the DENY
|
|
15
|
+
* direction, so a pattern matching a parent masks the whole subtree —
|
|
16
|
+
* deny-safe by construction.
|
|
17
|
+
*
|
|
18
|
+
* 3. **The grant** — the intersection, expressed as an explicit allowlist
|
|
19
|
+
* of full capability paths. `effectiveCapabilities` is the sole
|
|
20
|
+
* normative allowlist; **absence is denial and there is no unspecified
|
|
21
|
+
* state**. Matching here is NOT the mask's subtree matching: `*` matches
|
|
22
|
+
* exactly one segment, segment counts must agree, and a bare parent
|
|
23
|
+
* grants nothing beneath it (§5.4 as pinned 2026-08-02 — the suffix
|
|
24
|
+
* reading was implemented once and adjudicated out; see mcpl e869744).
|
|
25
|
+
*
|
|
26
|
+
* §13.4: `contextHooks.beforeInference.inject.system` is DENIED BY DEFAULT.
|
|
27
|
+
* A server that needs it must be granted it explicitly via
|
|
28
|
+
* `enabledCapabilities`. This is the one place the default is not
|
|
29
|
+
* "everything advertised survives the mask", and it is loud when it fires.
|
|
30
|
+
*/
|
|
31
|
+
// ============================================================================
|
|
32
|
+
// §6.2 vocabulary
|
|
33
|
+
// ============================================================================
|
|
34
|
+
/**
|
|
35
|
+
* The closed capability-path vocabulary (SPEC §6.2). A tree, not a flat
|
|
36
|
+
* list, because the advertisement walk and boolean-shorthand expansion are
|
|
37
|
+
* defined over the tree. Leaves are `null`; interior nodes that are
|
|
38
|
+
* themselves grantable paths (e.g. `inferenceRequest`) appear as nodes whose
|
|
39
|
+
* path is also emitted when advertised.
|
|
40
|
+
*/
|
|
41
|
+
const VOCABULARY = {
|
|
42
|
+
pushEvents: null,
|
|
43
|
+
tools: null,
|
|
44
|
+
modelInfo: null,
|
|
45
|
+
inferenceRequest: { streaming: null },
|
|
46
|
+
inferenceLifecycle: null,
|
|
47
|
+
contextHooks: {
|
|
48
|
+
beforeInference: {
|
|
49
|
+
observe: null,
|
|
50
|
+
inject: { system: null, beforeUser: null, afterUser: null },
|
|
51
|
+
},
|
|
52
|
+
},
|
|
53
|
+
channels: {
|
|
54
|
+
register: null,
|
|
55
|
+
lifecycle: null,
|
|
56
|
+
publish: null,
|
|
57
|
+
incoming: null,
|
|
58
|
+
streaming: null,
|
|
59
|
+
acknowledge: null,
|
|
60
|
+
typing: null,
|
|
61
|
+
},
|
|
62
|
+
};
|
|
63
|
+
/** Interior nodes that are grantable paths in their own right (§6.2 lists
|
|
64
|
+
* `inferenceRequest` alongside `inferenceRequest.streaming`). Namespaces
|
|
65
|
+
* (`contextHooks`, `channels`, `inject`) are not: they hold no authority. */
|
|
66
|
+
const SELF_GRANTABLE_INTERIOR = new Set(['inferenceRequest']);
|
|
67
|
+
/** Every full path in the vocabulary (leaves plus self-grantable interiors). */
|
|
68
|
+
export const ALL_CAPABILITY_PATHS = (() => {
|
|
69
|
+
const out = [];
|
|
70
|
+
const walk = (node, prefix) => {
|
|
71
|
+
for (const [key, child] of Object.entries(node)) {
|
|
72
|
+
const path = prefix ? `${prefix}.${key}` : key;
|
|
73
|
+
if (child === null) {
|
|
74
|
+
out.push(path);
|
|
75
|
+
}
|
|
76
|
+
else {
|
|
77
|
+
if (SELF_GRANTABLE_INTERIOR.has(path))
|
|
78
|
+
out.push(path);
|
|
79
|
+
walk(child, path);
|
|
80
|
+
}
|
|
81
|
+
}
|
|
82
|
+
};
|
|
83
|
+
walk(VOCABULARY, '');
|
|
84
|
+
return out;
|
|
85
|
+
})();
|
|
86
|
+
const KNOWN_PATHS = new Set(ALL_CAPABILITY_PATHS);
|
|
87
|
+
/** Is this exact string a §6.2 capability path? (Used by §6.4 `uses`
|
|
88
|
+
* validation — `uses` MUST contain only these values.) */
|
|
89
|
+
export function isKnownCapabilityPath(path) {
|
|
90
|
+
return KNOWN_PATHS.has(path);
|
|
91
|
+
}
|
|
92
|
+
// ============================================================================
|
|
93
|
+
// Advertisement walk (§5.1)
|
|
94
|
+
// ============================================================================
|
|
95
|
+
function isPlainObject(value) {
|
|
96
|
+
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
|
97
|
+
}
|
|
98
|
+
function collectSubtree(node, path, out) {
|
|
99
|
+
if (node === null) {
|
|
100
|
+
out.add(path);
|
|
101
|
+
return;
|
|
102
|
+
}
|
|
103
|
+
if (SELF_GRANTABLE_INTERIOR.has(path))
|
|
104
|
+
out.add(path);
|
|
105
|
+
for (const [key, child] of Object.entries(node)) {
|
|
106
|
+
collectSubtree(child, path ? `${path}.${key}` : key, out);
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
/**
|
|
110
|
+
* The set of full capability paths a capabilities object advertises.
|
|
111
|
+
* Generic recursive walk; `true` at any level advertises every leaf beneath
|
|
112
|
+
* it; `false`/absent advertises nothing; unrecognized member names are
|
|
113
|
+
* ignored — an unknown name cannot mint a capability.
|
|
114
|
+
*
|
|
115
|
+
* `tools` is deliberately NOT sourced here. §5.1 sources it from the OUTER
|
|
116
|
+
* standard MCP `capabilities.tools` only — the experimental manifest cannot
|
|
117
|
+
* mint standard MCP tool capability (review blocker 2 on PR #79). A nested
|
|
118
|
+
* `experimental.mcpl.tools` is treated as an unknown member. Callers join
|
|
119
|
+
* the outer signal via computeGrant's mcpToolsAdvertised.
|
|
120
|
+
*/
|
|
121
|
+
export function advertisedPaths(capabilities) {
|
|
122
|
+
const out = new Set();
|
|
123
|
+
if (!capabilities)
|
|
124
|
+
return out;
|
|
125
|
+
const walk = (vocab, value, prefix) => {
|
|
126
|
+
if (vocab === null || !isPlainObject(value))
|
|
127
|
+
return;
|
|
128
|
+
for (const [key, child] of Object.entries(vocab)) {
|
|
129
|
+
const path = prefix ? `${prefix}.${key}` : key;
|
|
130
|
+
if (path === 'tools')
|
|
131
|
+
continue; // outer MCP caps only — see doc comment
|
|
132
|
+
const v = value[key];
|
|
133
|
+
if (v === true) {
|
|
134
|
+
collectSubtree(child, path, out);
|
|
135
|
+
}
|
|
136
|
+
else if (isPlainObject(v)) {
|
|
137
|
+
if (child !== null) {
|
|
138
|
+
if (SELF_GRANTABLE_INTERIOR.has(path))
|
|
139
|
+
out.add(path);
|
|
140
|
+
walk(child, v, path);
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
// false / absent / non-object-non-true: advertises nothing.
|
|
144
|
+
}
|
|
145
|
+
};
|
|
146
|
+
walk(VOCABULARY, capabilities, '');
|
|
147
|
+
return out;
|
|
148
|
+
}
|
|
149
|
+
/**
|
|
150
|
+
* Expand §5.1 boolean shorthand into the explicit leaf tree, IN PLACE of the
|
|
151
|
+
* boolean, for every vocabulary node — so the config mask's generic child
|
|
152
|
+
* walk can address sub-leaves. Without this, `channels: true` is an atomic
|
|
153
|
+
* top-level leaf to the mask: `disabledCapabilities:['channels.streaming']`
|
|
154
|
+
* silently no-ops and `enabledCapabilities:['channels.publish']` drops the
|
|
155
|
+
* whole tree (review blocker 1 — live release geometry, since discord
|
|
156
|
+
* truthfully keeps `channels: true`).
|
|
157
|
+
*
|
|
158
|
+
* Unrecognized members and non-capability members (`version`, `revision`,
|
|
159
|
+
* `featureSets`) pass through untouched. The wire keeps its shorthand; this
|
|
160
|
+
* expanded form is the host's POLICY representation.
|
|
161
|
+
*/
|
|
162
|
+
export function expandAdvertisementShorthand(capabilities) {
|
|
163
|
+
if (!capabilities)
|
|
164
|
+
return capabilities;
|
|
165
|
+
const expandNode = (node) => {
|
|
166
|
+
if (node === null)
|
|
167
|
+
return true;
|
|
168
|
+
const out = {};
|
|
169
|
+
for (const [key, child] of Object.entries(node))
|
|
170
|
+
out[key] = expandNode(child);
|
|
171
|
+
return out;
|
|
172
|
+
};
|
|
173
|
+
const walk = (vocab, value) => {
|
|
174
|
+
const out = { ...value };
|
|
175
|
+
for (const [key, child] of Object.entries(vocab)) {
|
|
176
|
+
if (key === 'tools')
|
|
177
|
+
continue; // never expanded from experimental
|
|
178
|
+
const v = value[key];
|
|
179
|
+
if (child === null)
|
|
180
|
+
continue; // leaf: boolean stays a boolean
|
|
181
|
+
if (v === true) {
|
|
182
|
+
out[key] = expandNode(child);
|
|
183
|
+
}
|
|
184
|
+
else if (isPlainObject(v)) {
|
|
185
|
+
out[key] = walk(child, v);
|
|
186
|
+
}
|
|
187
|
+
}
|
|
188
|
+
return out;
|
|
189
|
+
};
|
|
190
|
+
return walk(VOCABULARY, capabilities);
|
|
191
|
+
}
|
|
192
|
+
// ============================================================================
|
|
193
|
+
// Grant matching (§5.4) — one-segment wildcards, equal counts
|
|
194
|
+
// ============================================================================
|
|
195
|
+
/**
|
|
196
|
+
* `*` matches exactly one dot-segment; literal segments match exactly;
|
|
197
|
+
* segment counts MUST agree. A bare parent does not match its subtree and a
|
|
198
|
+
* trailing `*` is not a suffix wildcard (SPEC §5.4, pinned 2026-08-02).
|
|
199
|
+
*/
|
|
200
|
+
export function capabilityPatternMatches(pattern, path) {
|
|
201
|
+
const p = pattern.split('.');
|
|
202
|
+
const n = path.split('.');
|
|
203
|
+
if (p.length !== n.length)
|
|
204
|
+
return false;
|
|
205
|
+
for (let i = 0; i < p.length; i++) {
|
|
206
|
+
if (p[i] !== '*' && p[i] !== n[i])
|
|
207
|
+
return false;
|
|
208
|
+
}
|
|
209
|
+
return true;
|
|
210
|
+
}
|
|
211
|
+
// ============================================================================
|
|
212
|
+
// The grant
|
|
213
|
+
// ============================================================================
|
|
214
|
+
/** §13.4: denied unless explicitly enabled by host config. */
|
|
215
|
+
const DENY_BY_DEFAULT = ['contextHooks.beforeInference.inject.system'];
|
|
216
|
+
export class CapabilityGrant {
|
|
217
|
+
/** Exact granted paths (already expanded — no patterns stored). */
|
|
218
|
+
granted;
|
|
219
|
+
/** Advertised-but-denied paths, for the §5.3 diagnostic field only. */
|
|
220
|
+
deniedPaths;
|
|
221
|
+
constructor(granted, deniedPaths) {
|
|
222
|
+
this.granted = granted;
|
|
223
|
+
this.deniedPaths = deniedPaths;
|
|
224
|
+
}
|
|
225
|
+
/** Sole authorization question. Absence is denial (§5.4). */
|
|
226
|
+
has(path) {
|
|
227
|
+
return this.granted.has(path);
|
|
228
|
+
}
|
|
229
|
+
/** Sorted list for `effectiveCapabilities` (§5.3). */
|
|
230
|
+
effectiveList() {
|
|
231
|
+
return [...this.granted].sort();
|
|
232
|
+
}
|
|
233
|
+
/** True when nothing at all is granted. */
|
|
234
|
+
isEmpty() {
|
|
235
|
+
return this.granted.size === 0;
|
|
236
|
+
}
|
|
237
|
+
static empty() {
|
|
238
|
+
return new CapabilityGrant(new Set(), []);
|
|
239
|
+
}
|
|
240
|
+
/**
|
|
241
|
+
* The grant carried by a connection-like object, failing CLOSED when the
|
|
242
|
+
* object has none. Registry consumers receive whatever the registry holds
|
|
243
|
+
* — including test stubs and objects created before the field existed —
|
|
244
|
+
* and a missing grant must mean "nothing granted" (§5.4 absence is
|
|
245
|
+
* denial), never a TypeError that takes the gate down open-ended.
|
|
246
|
+
*/
|
|
247
|
+
static of(conn) {
|
|
248
|
+
return conn?.grant ?? CapabilityGrant.empty();
|
|
249
|
+
}
|
|
250
|
+
/**
|
|
251
|
+
* A copy of this grant with the named paths removed — the reduction
|
|
252
|
+
* primitive. §6.7's ordering contract lives at the call site: install the
|
|
253
|
+
* narrowed grant (establishGrant) BEFORE sending the reducing
|
|
254
|
+
* featureSets/update Request; security cannot wait on consent.
|
|
255
|
+
*/
|
|
256
|
+
without(...paths) {
|
|
257
|
+
const granted = new Set(this.granted);
|
|
258
|
+
const denied = new Set(this.deniedPaths);
|
|
259
|
+
for (const p of paths) {
|
|
260
|
+
if (granted.delete(p))
|
|
261
|
+
denied.add(p);
|
|
262
|
+
}
|
|
263
|
+
return new CapabilityGrant(granted, [...denied].sort());
|
|
264
|
+
}
|
|
265
|
+
}
|
|
266
|
+
/**
|
|
267
|
+
* Compute the effective grant for a connection: the server's advertisement
|
|
268
|
+
* (post config-mask — the mask runs first at handshake, so `capabilities`
|
|
269
|
+
* here is already the masked object) intersected with the deny-by-default
|
|
270
|
+
* floor. `enabledCapabilities` config patterns can re-grant a
|
|
271
|
+
* deny-by-default path — that is the explicit decision §13.4 asks for.
|
|
272
|
+
*/
|
|
273
|
+
export function computeGrant(capabilities, config, opts) {
|
|
274
|
+
const advertised = advertisedPaths(capabilities);
|
|
275
|
+
if (opts?.mcpToolsAdvertised)
|
|
276
|
+
advertised.add('tools');
|
|
277
|
+
const granted = new Set();
|
|
278
|
+
const denied = [];
|
|
279
|
+
const explicitlyEnabled = (path) => !!config.enabledCapabilities?.some((pat) => capabilityPatternMatches(pat, path));
|
|
280
|
+
for (const path of advertised) {
|
|
281
|
+
if (DENY_BY_DEFAULT.includes(path) && !explicitlyEnabled(path)) {
|
|
282
|
+
denied.push(path);
|
|
283
|
+
console.error(`[mcpl] "${path}" advertised but DENIED BY DEFAULT (SPEC §13.4) — ` +
|
|
284
|
+
`grant it explicitly via enabledCapabilities if intended`);
|
|
285
|
+
continue;
|
|
286
|
+
}
|
|
287
|
+
granted.add(path);
|
|
288
|
+
}
|
|
289
|
+
return new CapabilityGrant(granted, denied.sort());
|
|
290
|
+
}
|
|
291
|
+
//# sourceMappingURL=capability-grant.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"capability-grant.js","sourceRoot":"","sources":["../../../src/mcpl/capability-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,GAAY;IAC1B,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;IACrC,kBAAkB,EAAE,IAAI;IACxB,YAAY,EAAE;QACZ,eAAe,EAAE;YACf,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC5D;KACF;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,IAAI;KACb;CACF,CAAC;AAOF;;8EAE8E;AAC9E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE9D,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,GAAG,EAAE;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,IAAgB,EAAE,MAAc,EAAQ,EAAE;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAElD;2DAC2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,IAAY,EAAE,GAAgB;IACnE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,YAAqC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,KAAc,EAAE,MAAc,EAAQ,EAAE;QACpE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO;QACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/C,IAAI,IAAI,KAAK,OAAO;gBAAE,SAAS,CAAC,wCAAwC;YACxE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrD,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,4DAA4D;QAC9D,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,YAAkD,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAAC,YAAqC;IAChF,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,IAAa,EAAW,EAAE;QAC5C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9E,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAE,KAA8B,EAA2B,EAAE;QAC1F,MAAM,GAAG,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,KAAK,OAAO;gBAAE,SAAS,CAAC,mCAAmC;YAClE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS,CAAC,gCAAgC;YAC9D,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,UAAwB,EAAE,YAAkD,CAAgC,CAAC;AAC3H,CAAC;AAED,+EAA+E;AAC/E,8DAA8D;AAC9D,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,IAAY;IACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,8DAA8D;AAC9D,MAAM,eAAe,GAAsB,CAAC,4CAA4C,CAAC,CAAC;AAE1F,MAAM,OAAO,eAAe;IAC1B,mEAAmE;IAClD,OAAO,CAAsB;IAC9C,uEAAuE;IAC9D,WAAW,CAAoB;IAExC,YAAY,OAAoB,EAAE,WAAqB;QACrD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,sDAAsD;IACtD,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,2CAA2C;IAC3C,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,eAAe,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,IAAoD;QAC5D,OAAO,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAG,KAAe;QACxB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,YAAqC,EACrC,MAAqD,EACrD,IAMC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,IAAI,EAAE,kBAAkB;QAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAW,EAAE,CAClD,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAEnF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CACX,WAAW,IAAI,oDAAoD;gBACjE,yDAAyD,CAC5D,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC"}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Host-side capability scoping for MCPL servers.
|
|
3
|
+
*
|
|
4
|
+
* A server names its own capabilities in its initialize response, and
|
|
5
|
+
* everything downstream — hook fan-out, channel streaming, push handling —
|
|
6
|
+
* keys off that self-advertisement. `enabledCapabilities` /
|
|
7
|
+
* `disabledCapabilities` in McplServerConfig let the host intersect the
|
|
8
|
+
* advertisement with its own policy at handshake time, so a capability the
|
|
9
|
+
* config masks behaves exactly as if the server had never advertised it.
|
|
10
|
+
*
|
|
11
|
+
* The mask is applied once, where the negotiated capabilities are stored
|
|
12
|
+
* (McplServerConnection.handshake), rather than re-checked at each consumer:
|
|
13
|
+
* hook orchestration, streaming observation, and capability queries all read
|
|
14
|
+
* the already-masked object. Inbound server-initiated methods gated by a
|
|
15
|
+
* masked capability are additionally rejected at the connection
|
|
16
|
+
* (see METHOD_TO_REQUIRED_CAPABILITY in server-connection.ts).
|
|
17
|
+
*
|
|
18
|
+
* Matching is a generic recursive walk per SPEC 0.5 §5.4: every path at
|
|
19
|
+
* every depth is addressable (`contextHooks.beforeInference.inject.system`
|
|
20
|
+
* works the day the host stores that shape), and a pattern matching a parent
|
|
21
|
+
* masks the whole subtree. No hardcoded set of nestable keys.
|
|
22
|
+
*/
|
|
23
|
+
import type { McplCapabilities, McplServerConfig } from './types.js';
|
|
24
|
+
/** Result of masking: the surviving capabilities plus what was dropped. */
|
|
25
|
+
export interface MaskedCapabilities {
|
|
26
|
+
capabilities: McplCapabilities | null;
|
|
27
|
+
/**
|
|
28
|
+
* Dotted paths of advertised capabilities removed by the mask (e.g.
|
|
29
|
+
* `contextHooks.afterInference`). When an entire multi-flag capability is
|
|
30
|
+
* removed (`channels` advertised as a boolean, denied as a parent, or
|
|
31
|
+
* every advertised flag masked), the bare parent path (`channels`) is
|
|
32
|
+
* included so inbound enforcement can key on it.
|
|
33
|
+
*/
|
|
34
|
+
dropped: string[];
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Intersect a server's advertised MCPL capabilities with the host config's
|
|
38
|
+
* `enabledCapabilities` / `disabledCapabilities`.
|
|
39
|
+
*
|
|
40
|
+
* Semantics mirror enabledTools/disabledTools: if `enabledCapabilities` is
|
|
41
|
+
* set, only advertised capabilities matching at least one pattern survive;
|
|
42
|
+
* `disabledCapabilities` removes matches and wins on conflict. Patterns are
|
|
43
|
+
* dotted paths with `*` matching one segment, and a pattern that matches a
|
|
44
|
+
* parent (`contextHooks`) covers every path beneath it. `version` and
|
|
45
|
+
* `featureSets` are never masked here — feature sets have their own
|
|
46
|
+
* enable/disable knobs.
|
|
47
|
+
*
|
|
48
|
+
* With neither list set, the advertisement passes through untouched.
|
|
49
|
+
*/
|
|
50
|
+
export declare function maskNegotiatedCapabilities(capabilities: McplCapabilities | null, config: Pick<McplServerConfig, 'enabledCapabilities' | 'disabledCapabilities'>): MaskedCapabilities;
|
|
51
|
+
//# sourceMappingURL=capability-mask.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"capability-mask.d.ts","sourceRoot":"","sources":["../../../src/mcpl/capability-mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAmED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,gBAAgB,GAAG,IAAI,EACrC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,GAAG,sBAAsB,CAAC,GAC7E,kBAAkB,CA2GpB"}
|
|
@@ -0,0 +1,190 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Host-side capability scoping for MCPL servers.
|
|
3
|
+
*
|
|
4
|
+
* A server names its own capabilities in its initialize response, and
|
|
5
|
+
* everything downstream — hook fan-out, channel streaming, push handling —
|
|
6
|
+
* keys off that self-advertisement. `enabledCapabilities` /
|
|
7
|
+
* `disabledCapabilities` in McplServerConfig let the host intersect the
|
|
8
|
+
* advertisement with its own policy at handshake time, so a capability the
|
|
9
|
+
* config masks behaves exactly as if the server had never advertised it.
|
|
10
|
+
*
|
|
11
|
+
* The mask is applied once, where the negotiated capabilities are stored
|
|
12
|
+
* (McplServerConnection.handshake), rather than re-checked at each consumer:
|
|
13
|
+
* hook orchestration, streaming observation, and capability queries all read
|
|
14
|
+
* the already-masked object. Inbound server-initiated methods gated by a
|
|
15
|
+
* masked capability are additionally rejected at the connection
|
|
16
|
+
* (see METHOD_TO_REQUIRED_CAPABILITY in server-connection.ts).
|
|
17
|
+
*
|
|
18
|
+
* Matching is a generic recursive walk per SPEC 0.5 §5.4: every path at
|
|
19
|
+
* every depth is addressable (`contextHooks.beforeInference.inject.system`
|
|
20
|
+
* works the day the host stores that shape), and a pattern matching a parent
|
|
21
|
+
* masks the whole subtree. No hardcoded set of nestable keys.
|
|
22
|
+
*/
|
|
23
|
+
/**
|
|
24
|
+
* Segment-wise wildcard match, same rules as feature-set patterns:
|
|
25
|
+
* `*` matches exactly one dot-segment, literal segments match exactly,
|
|
26
|
+
* segment counts must agree.
|
|
27
|
+
*/
|
|
28
|
+
function wildcardMatch(pattern, name) {
|
|
29
|
+
const patternParts = pattern.split('.');
|
|
30
|
+
const nameParts = name.split('.');
|
|
31
|
+
if (patternParts.length !== nameParts.length) {
|
|
32
|
+
return false;
|
|
33
|
+
}
|
|
34
|
+
for (let i = 0; i < patternParts.length; i++) {
|
|
35
|
+
const p = patternParts[i];
|
|
36
|
+
if (p === '*') {
|
|
37
|
+
continue;
|
|
38
|
+
}
|
|
39
|
+
if (p !== nameParts[i]) {
|
|
40
|
+
return false;
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
return true;
|
|
44
|
+
}
|
|
45
|
+
/**
|
|
46
|
+
* Whether a pattern matches a capability path or any ancestor prefix of it —
|
|
47
|
+
* `contextHooks` (or `*`) covers `contextHooks.beforeInference.inject.system`
|
|
48
|
+
* at any depth, so masking a parent masks everything beneath it.
|
|
49
|
+
*/
|
|
50
|
+
function patternMatchesPath(pattern, path) {
|
|
51
|
+
const parts = path.split('.');
|
|
52
|
+
for (let depth = parts.length; depth >= 1; depth--) {
|
|
53
|
+
if (wildcardMatch(pattern, parts.slice(0, depth).join('.'))) {
|
|
54
|
+
return true;
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
return false;
|
|
58
|
+
}
|
|
59
|
+
function anyMatches(patterns, path) {
|
|
60
|
+
return patterns.some((pattern) => patternMatchesPath(pattern, path));
|
|
61
|
+
}
|
|
62
|
+
/** Keys that are negotiation metadata, not grantable capabilities. */
|
|
63
|
+
const UNMASKABLE_KEYS = new Set(['version', 'featureSets']);
|
|
64
|
+
/**
|
|
65
|
+
* Interior object paths whose object value is itself the capability, with
|
|
66
|
+
* children as refinements — dropping a refinement leaves the capability
|
|
67
|
+
* granted (`inferenceRequest` minus `.streaming` is still inferenceRequest).
|
|
68
|
+
* Every other interior object is a pure namespace (`contextHooks`,
|
|
69
|
+
* `channels`, a future `inject`): it holds no authority of its own and is
|
|
70
|
+
* pruned when all its advertised children are masked.
|
|
71
|
+
*
|
|
72
|
+
* This is a retention-shape distinction only — matching and addressability
|
|
73
|
+
* are fully generic and depth-unbounded either way.
|
|
74
|
+
*/
|
|
75
|
+
const OBJECT_CAPABILITY_PATHS = new Set(['inferenceRequest', 'contextHooks.afterInference']);
|
|
76
|
+
function isPlainObject(value) {
|
|
77
|
+
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
|
78
|
+
}
|
|
79
|
+
/**
|
|
80
|
+
* Intersect a server's advertised MCPL capabilities with the host config's
|
|
81
|
+
* `enabledCapabilities` / `disabledCapabilities`.
|
|
82
|
+
*
|
|
83
|
+
* Semantics mirror enabledTools/disabledTools: if `enabledCapabilities` is
|
|
84
|
+
* set, only advertised capabilities matching at least one pattern survive;
|
|
85
|
+
* `disabledCapabilities` removes matches and wins on conflict. Patterns are
|
|
86
|
+
* dotted paths with `*` matching one segment, and a pattern that matches a
|
|
87
|
+
* parent (`contextHooks`) covers every path beneath it. `version` and
|
|
88
|
+
* `featureSets` are never masked here — feature sets have their own
|
|
89
|
+
* enable/disable knobs.
|
|
90
|
+
*
|
|
91
|
+
* With neither list set, the advertisement passes through untouched.
|
|
92
|
+
*/
|
|
93
|
+
export function maskNegotiatedCapabilities(capabilities, config) {
|
|
94
|
+
const enabled = config.enabledCapabilities;
|
|
95
|
+
const disabled = config.disabledCapabilities;
|
|
96
|
+
if (capabilities === null || (!enabled && !disabled)) {
|
|
97
|
+
return { capabilities, dropped: [] };
|
|
98
|
+
}
|
|
99
|
+
const denied = (path) => !!disabled && anyMatches(disabled, path);
|
|
100
|
+
const allowed = (path) => !enabled || anyMatches(enabled, path);
|
|
101
|
+
const keep = (path) => !denied(path) && allowed(path);
|
|
102
|
+
const dropped = [];
|
|
103
|
+
/**
|
|
104
|
+
* Mask one interior object node. Returns the surviving object, or
|
|
105
|
+
* undefined when the node is pruned entirely. Falsy children are carried
|
|
106
|
+
* through untouched (they advertise nothing, so there is nothing to mask).
|
|
107
|
+
*/
|
|
108
|
+
const maskNode = (node, path) => {
|
|
109
|
+
if (denied(path)) {
|
|
110
|
+
dropped.push(path);
|
|
111
|
+
return undefined;
|
|
112
|
+
}
|
|
113
|
+
const survivors = {};
|
|
114
|
+
let advertised = 0;
|
|
115
|
+
let survived = 0;
|
|
116
|
+
for (const [key, value] of Object.entries(node)) {
|
|
117
|
+
if (value === undefined)
|
|
118
|
+
continue;
|
|
119
|
+
if (!value) {
|
|
120
|
+
// false / 0 / '' advertise nothing — preserve for fidelity.
|
|
121
|
+
survivors[key] = value;
|
|
122
|
+
continue;
|
|
123
|
+
}
|
|
124
|
+
advertised++;
|
|
125
|
+
const childPath = path ? `${path}.${key}` : key;
|
|
126
|
+
if (isPlainObject(value)) {
|
|
127
|
+
const masked = maskNode(value, childPath);
|
|
128
|
+
if (masked !== undefined) {
|
|
129
|
+
survivors[key] = masked;
|
|
130
|
+
survived++;
|
|
131
|
+
}
|
|
132
|
+
continue;
|
|
133
|
+
}
|
|
134
|
+
// Truthy leaf.
|
|
135
|
+
if (keep(childPath)) {
|
|
136
|
+
survivors[key] = value;
|
|
137
|
+
survived++;
|
|
138
|
+
}
|
|
139
|
+
else {
|
|
140
|
+
dropped.push(childPath);
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
if (advertised === 0) {
|
|
144
|
+
// No truthy children: the object itself is the advert (e.g.
|
|
145
|
+
// `inferenceRequest: {}`), so its own path decides.
|
|
146
|
+
if (keep(path))
|
|
147
|
+
return survivors;
|
|
148
|
+
dropped.push(path);
|
|
149
|
+
return undefined;
|
|
150
|
+
}
|
|
151
|
+
if (survived > 0) {
|
|
152
|
+
return survivors;
|
|
153
|
+
}
|
|
154
|
+
// Every advertised child was masked. An object-capability keeps its
|
|
155
|
+
// (still-granted) hull; a namespace holds no authority of its own and
|
|
156
|
+
// is pruned, recording the bare path for inbound enforcement.
|
|
157
|
+
if (OBJECT_CAPABILITY_PATHS.has(path) && keep(path)) {
|
|
158
|
+
return survivors;
|
|
159
|
+
}
|
|
160
|
+
dropped.push(path);
|
|
161
|
+
return undefined;
|
|
162
|
+
};
|
|
163
|
+
const masked = {};
|
|
164
|
+
const source = capabilities;
|
|
165
|
+
for (const [key, value] of Object.entries(source)) {
|
|
166
|
+
if (value === undefined)
|
|
167
|
+
continue;
|
|
168
|
+
if (UNMASKABLE_KEYS.has(key) || !value) {
|
|
169
|
+
masked[key] = value;
|
|
170
|
+
continue;
|
|
171
|
+
}
|
|
172
|
+
if (isPlainObject(value)) {
|
|
173
|
+
const node = maskNode(value, key);
|
|
174
|
+
if (node !== undefined) {
|
|
175
|
+
masked[key] = node;
|
|
176
|
+
}
|
|
177
|
+
continue;
|
|
178
|
+
}
|
|
179
|
+
// Truthy leaf at the top level (booleans, or `channels: true` from
|
|
180
|
+
// servers that advertise the boolean form).
|
|
181
|
+
if (keep(key)) {
|
|
182
|
+
masked[key] = value;
|
|
183
|
+
}
|
|
184
|
+
else {
|
|
185
|
+
dropped.push(key);
|
|
186
|
+
}
|
|
187
|
+
}
|
|
188
|
+
return { capabilities: masked, dropped };
|
|
189
|
+
}
|
|
190
|
+
//# sourceMappingURL=capability-mask.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"capability-mask.js","sourceRoot":"","sources":["../../../src/mcpl/capability-mask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAiBH;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAY;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,sEAAsE;AACtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAE7F,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAqC,EACrC,MAA8E;IAE9E,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAE7C,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B;;;;OAIG;IACH,MAAM,QAAQ,GAAG,CAAC,IAA6B,EAAE,IAAY,EAAuC,EAAE;QACpG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,4DAA4D;gBAC5D,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,UAAU,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAEhD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;oBACxB,QAAQ,EAAE,CAAC;gBACb,CAAC;gBACD,SAAS;YACX,CAAC;YAED,eAAe;YACf,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpB,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACvB,QAAQ,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,4DAA4D;YAC5D,oDAAoD;YACpD,IAAI,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,YAAkD,CAAC;IAElE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAElC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,MAAqC,EAAE,OAAO,EAAE,CAAC;AAC1E,CAAC"}
|
|
@@ -163,7 +163,7 @@ export declare class ChannelRegistry {
|
|
|
163
163
|
* Processes added (register + reconcile), removed (delete + stop typing),
|
|
164
164
|
* and updated (replace descriptor) channels.
|
|
165
165
|
*/
|
|
166
|
-
handleChanged(serverId: string, params: ChannelsChangedParams): Promise<void>;
|
|
166
|
+
handleChanged(serverId: string, params: ChannelsChangedParams, responder?: Responder): Promise<void>;
|
|
167
167
|
/**
|
|
168
168
|
* Handle `channels/incoming` from a server.
|
|
169
169
|
*
|
|
@@ -283,6 +283,8 @@ export declare class ChannelRegistry {
|
|
|
283
283
|
* (typing timer lifecycle is still managed for when the callback is wired).
|
|
284
284
|
*/
|
|
285
285
|
private sendTypingNotification;
|
|
286
|
+
/** Descriptors registered by one server — the §14.3 channels/list answer. */
|
|
287
|
+
descriptorsForServer(serverId: string): ChannelDescriptor[];
|
|
286
288
|
/** Server id owning a registered channel (by descriptor id), or null. */
|
|
287
289
|
getChannelServerId(channelId: string): string | null;
|
|
288
290
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"channel-registry.d.ts","sourceRoot":"","sources":["../../../src/mcpl/channel-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EAEtB,qBAAqB,EACrB,sBAAsB,EAOvB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"channel-registry.d.ts","sourceRoot":"","sources":["../../../src/mcpl/channel-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EAEtB,qBAAqB,EACrB,sBAAsB,EAOvB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWlF,KAAK,mBAAmB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAgC7C,qEAAqE;AACrE,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qEAAqE;AACrE,UAAU,SAAS;IACjB,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAkMD,UAAU,sBAAsB;IAC9B,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IACzF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,IAAI,CAAC;IACX;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,8EAA8E;QAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,qBAAqB,GAAG,oBAAoB,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxD,KAAK,IAAI,CAAC;IACX;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChE;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACnE;AAMD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;sCAEsC;AACtC,eAAO,MAAM,qBAAqB,aAA+C,CAAC;AAElF,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,WAAW,CAA4D;IAC/E,OAAO,CAAC,YAAY,CAAC,CAKX;IACV,OAAO,CAAC,sBAAsB,CAAC,CAAkE;IACjG,OAAO,CAAC,cAAc,CAAC,CAKZ;IACX,OAAO,CAAC,mBAAmB,CAAC,CAKjB;IACX,OAAO,CAAC,mBAAmB,CAAC,CAA4C;IACxE,OAAO,CAAC,qBAAqB,CAAC,CAA4C;IAC1E,OAAO,CAAC,KAAK,CAAC,CAAU;IAExB,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAmC;IAEnD,mFAAmF;IACnF,OAAO,CAAC,qBAAqB,CAAuB;IAEpD,2EAA2E;IAC3E,OAAO,CAAC,uBAAuB,CAAuB;IACtD,OAAO,CAAC,sBAAsB,CAAiC;IAE/D,2CAA2C;IAC3C,OAAO,CAAC,eAAe,CAAqD;IAE5E;0EACsE;IACtE,OAAO,CAAC,cAAc,CAA8C;IAEpE;;8EAE0E;IAC1E,OAAO,CAAC,aAAa,CAAqE;IAE1F,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAmD;IACzE,OAAO,CAAC,sBAAsB,CAAqB;gBAGjD,cAAc,EAAE,kBAAkB,EAClC,iBAAiB,EAAE,iBAAiB,EACpC,WAAW,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,EAC1C,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,EACtE,OAAO,CAAC,EAAE,sBAAsB,GAAG;QACjC,YAAY,CAAC,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,KAClB,IAAI,CAAC;KACX;IAgBH;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,EAAE,GAAG,IAAI;IAUnF;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,IAAI,CAAC;IA2ChB;;;;;OAKG;IACG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,IAAI,CAAC;IAwEhB;;;;;OAKG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,SAAS,GACpB,IAAI;IA8HP;;;;;;;;;;;;;;OAcG;IACH,uBAAuB,CACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,IAAI;IA0CP;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IA0CxE;;;;;OAKG;IACH,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAuCpC;;OAEG;IACH,wBAAwB,IAAI,MAAM,GAAG,IAAI;IAIzC;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI/D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIzC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAIrF;;OAEG;IACH,eAAe,IAAI,YAAY,EAAE;IAcjC;;OAEG;IACH,eAAe,IAAI,cAAc,EAAE;IAInC;;;;;;;;;;;OAWG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,UAAU,CAAC;IAkDtB;;;;OAIG;IACH,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAiDnE;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAcpC;;OAEG;IACH,OAAO,IAAI,IAAI;IAoBf,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,wBAAwB;IAiChC,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,eAAe;IAmBvB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;YAiCnB,iBAAiB;IAuF/B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAgB9B,6EAA6E;IAC7E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAM3D,yEAAyE;IACzE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpD;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,cAAc;IA6BtB;;;;;;;;OAQG;YACW,cAAc;IAyB5B;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,GACX;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;IA8HnF;;;;;;;OAOG;IACG,mBAAmB,CACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACT,MAAM,EAAE,QAAQ,GAAG,cAAc,GAAG,iBAAiB,GAAG,WAAW,GAAG,aAAa,CAAC;QACpF,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;YAqCY,cAAc;YAkDd,eAAe;YAgHf,iBAAiB;IAwE/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAevB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;;;;;;;OAQG;IACH;;kFAE8E;IAC9E;;;;;;;OAOG;IACH,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,IAAI;IAQP,8EAA8E;IAC9E,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,IAAI;IAaP,OAAO,CAAC,kBAAkB;IAiB1B,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAK7C,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM;IACZ;;;;;;4EAMwE;IACxE,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAkHlE,iBAAiB;CAkEhC"}
|