@ankhorage/flow 0.0.0-stage → 0.4.1

package/dist/features/mcp/prepareMcpProviders.js

@@ -0,0 +1,97 @@
+import { McpToolError } from './McpToolError.js';
+const MAX_TIMEOUT_MS = 30_000;
+/*** Snapshots and validates explicit MCP provider authority before any connection is opened. */
+export const prepareMcpProviders = (configured) => {
+    const providers = new Map(configured.map(cloneProvider).map((provider) => [provider.id, provider]));
+    if (!providers.size || providers.size !== configured.length)
+        throw new McpToolError('invalid_provider', 'MCP provider identifiers must be unique.');
+    providers.forEach(validateProvider);
+    return providers;
+};
+/*** Clones provider data so later workflow-object mutation cannot expand authority. */
+const cloneProvider = (provider) => {
+    const common = {
+        id: provider.id,
+        allowedTools: provider.allowedTools.map((item) => ({
+            name: item.name,
+            grantedScopes: [...item.grantedScopes],
+        })),
+        grantedScopes: [...provider.grantedScopes],
+        ...(provider.timeoutMs === undefined ? {} : { timeoutMs: provider.timeoutMs }),
+    };
+    return provider.transport === 'stdio'
+        ? { ...common, transport: 'stdio' }
+        : {
+            ...common,
+            transport: 'remote',
+            endpoint: provider.endpoint,
+            allowedHosts: [...provider.allowedHosts],
+        };
+};
+/*** Requires non-empty scopes, unique tool permissions, and safe transport configuration. */
+const validateProvider = (provider) => {
+    if (!provider.id || !uniqueStrings(provider.grantedScopes) || !provider.allowedTools.length)
+        throw new McpToolError('invalid_provider', 'MCP providers need an id, explicit granted scopes, and tool permissions.');
+    if (!uniqueStrings(provider.allowedTools.map((item) => item.name)))
+        throw new McpToolError('invalid_provider', 'MCP tool permission names must be unique.');
+    if (provider.allowedTools.some((item) => !uniqueStrings(item.grantedScopes) ||
+        !item.grantedScopes.every((scope) => provider.grantedScopes.includes(scope))))
+        throw new McpToolError('invalid_provider', 'MCP tools require explicitly granted provider scopes.');
+    if (provider.timeoutMs !== undefined &&
+        (!Number.isSafeInteger(provider.timeoutMs) ||
+            provider.timeoutMs < 100 ||
+            provider.timeoutMs > MAX_TIMEOUT_MS))
+        throw new McpToolError('invalid_provider', 'MCP timeout must be bounded.');
+    if (provider.transport === 'remote')
+        validateRemote(provider);
+};
+/*** Rejects credentials, private literals, and endpoints outside their explicit host allowlist. */
+const validateRemote = (provider) => {
+    let url;
+    try {
+        url = new URL(provider.endpoint);
+    }
+    catch {
+        throw new McpToolError('unsafe_endpoint', 'Remote MCP endpoint must be an absolute URL.');
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (url.username || url.password || url.hash)
+        throw new McpToolError('unsafe_endpoint', 'Remote MCP endpoints cannot embed credentials or fragments.');
+    if (url.protocol !== 'https:' ||
+        privateIpv4(host) ||
+        privateIpv6(host) ||
+        !uniqueStrings(provider.allowedHosts) ||
+        !provider.allowedHosts.includes(host))
+        throw new McpToolError('unsafe_endpoint', 'Remote MCP endpoints require HTTPS, a public host allowlist, and no private address.');
+};
+/*** Detects loopback, link-local, unique-local, and unspecified IPv6 literals. */
+const privateIpv6 = (host) => {
+    const normalized = host.replace(/^\[|\]$/g, '').toLowerCase();
+    return (normalized === '::' ||
+        normalized === '::1' ||
+        normalized.startsWith('fc') ||
+        normalized.startsWith('fd') ||
+        normalized.startsWith('fe8') ||
+        normalized.startsWith('fe9') ||
+        normalized.startsWith('fea') ||
+        normalized.startsWith('feb') ||
+        normalized.startsWith('::ffff:'));
+};
+/*** Detects private, reserved, and local IPv4 literals. */
+const privateIpv4 = (host) => {
+    const parts = host.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return false;
+    const [first, second] = parts;
+    return (first === 0 ||
+        first === 10 ||
+        first === 127 ||
+        first >= 224 ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168));
+};
+/*** Checks unique non-empty strings. */
+const uniqueStrings = (values) => values.every((value) => typeof value === 'string' && value.length > 0) &&
+    new Set(values).size === values.length;
+//# sourceMappingURL=prepareMcpProviders.js.map

package/dist/features/mcp/prepareMcpProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareMcpProviders.js","sourceRoot":"","sources":["../../../src/features/mcp/prepareMcpProviders.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,UAA4C,EACA,EAAE;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;QACzD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;IACzF,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,aAAa,GAAG,CAAC,QAA+B,EAAyB,EAAE;IAC/E,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;SACvC,CAAC,CAAC;QACH,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;KAC/E,CAAC;IACF,OAAO,QAAQ,CAAC,SAAS,KAAK,OAAO;QACnC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;QACnC,CAAC,CAAC;YACE,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC;SACzC,CAAC;AACR,CAAC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,gBAAgB,GAAG,CAAC,QAA+B,EAAQ,EAAE;IACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM;QACzF,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,0EAA0E,CAC3E,CAAC;IACJ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;IAC1F,IACE,QAAQ,CAAC,YAAY,CAAC,IAAI,CACxB,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QAClC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC/E;QAED,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;IACJ,IACE,QAAQ,CAAC,SAAS,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,QAAQ,CAAC,SAAS,GAAG,GAAG;YACxB,QAAQ,CAAC,SAAS,GAAG,cAAc,CAAC;QAEtC,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ;QAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,cAAc,GAAG,CACrB,QAA0E,EACpE,EAAE;IACR,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAC1C,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;IACJ,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,WAAW,CAAC,IAAI,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC;QACjB,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAErC,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;AACN,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,OAAO,CACL,UAAU,KAAK,IAAI;QACnB,UAAU,KAAK,KAAK;QACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CACjC,CAAC;AACJ,CAAC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAyC,CAAC;IAClE,OAAO,CACL,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,EAAE;QACZ,KAAK,KAAK,GAAG;QACb,KAAK,IAAI,GAAG;QACZ,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACjC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;QAC/C,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAClC,CAAC;AACJ,CAAC,CAAC;AAEF,wCAAwC;AACxC,MAAM,aAAa,GAAG,CAAC,MAA0B,EAA+B,EAAE,CAChF,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC","sourcesContent":["import type { McpProviderDefinition } from '../../types/mcp.js';\nimport { McpToolError } from './McpToolError.js';\n\nconst MAX_TIMEOUT_MS = 30_000;\n\n/*** Snapshots and validates explicit MCP provider authority before any connection is opened. */\nexport const prepareMcpProviders = (\n  configured: readonly McpProviderDefinition[],\n): ReadonlyMap<string, McpProviderDefinition> => {\n  const providers = new Map(\n    configured.map(cloneProvider).map((provider) => [provider.id, provider]),\n  );\n  if (!providers.size || providers.size !== configured.length)\n    throw new McpToolError('invalid_provider', 'MCP provider identifiers must be unique.');\n  providers.forEach(validateProvider);\n  return providers;\n};\n\n/*** Clones provider data so later workflow-object mutation cannot expand authority. */\nconst cloneProvider = (provider: McpProviderDefinition): McpProviderDefinition => {\n  const common = {\n    id: provider.id,\n    allowedTools: provider.allowedTools.map((item) => ({\n      name: item.name,\n      grantedScopes: [...item.grantedScopes],\n    })),\n    grantedScopes: [...provider.grantedScopes],\n    ...(provider.timeoutMs === undefined ? {} : { timeoutMs: provider.timeoutMs }),\n  };\n  return provider.transport === 'stdio'\n    ? { ...common, transport: 'stdio' }\n    : {\n        ...common,\n        transport: 'remote',\n        endpoint: provider.endpoint,\n        allowedHosts: [...provider.allowedHosts],\n      };\n};\n\n/*** Requires non-empty scopes, unique tool permissions, and safe transport configuration. */\nconst validateProvider = (provider: McpProviderDefinition): void => {\n  if (!provider.id || !uniqueStrings(provider.grantedScopes) || !provider.allowedTools.length)\n    throw new McpToolError(\n      'invalid_provider',\n      'MCP providers need an id, explicit granted scopes, and tool permissions.',\n    );\n  if (!uniqueStrings(provider.allowedTools.map((item) => item.name)))\n    throw new McpToolError('invalid_provider', 'MCP tool permission names must be unique.');\n  if (\n    provider.allowedTools.some(\n      (item) =>\n        !uniqueStrings(item.grantedScopes) ||\n        !item.grantedScopes.every((scope) => provider.grantedScopes.includes(scope)),\n    )\n  )\n    throw new McpToolError(\n      'invalid_provider',\n      'MCP tools require explicitly granted provider scopes.',\n    );\n  if (\n    provider.timeoutMs !== undefined &&\n    (!Number.isSafeInteger(provider.timeoutMs) ||\n      provider.timeoutMs < 100 ||\n      provider.timeoutMs > MAX_TIMEOUT_MS)\n  )\n    throw new McpToolError('invalid_provider', 'MCP timeout must be bounded.');\n  if (provider.transport === 'remote') validateRemote(provider);\n};\n\n/*** Rejects credentials, private literals, and endpoints outside their explicit host allowlist. */\nconst validateRemote = (\n  provider: Extract<McpProviderDefinition, { readonly transport: 'remote' }>,\n): void => {\n  let url: URL;\n  try {\n    url = new URL(provider.endpoint);\n  } catch {\n    throw new McpToolError('unsafe_endpoint', 'Remote MCP endpoint must be an absolute URL.');\n  }\n  const host = url.hostname.replace(/^\\[|\\]$/g, '').toLowerCase();\n  if (url.username || url.password || url.hash)\n    throw new McpToolError(\n      'unsafe_endpoint',\n      'Remote MCP endpoints cannot embed credentials or fragments.',\n    );\n  if (\n    url.protocol !== 'https:' ||\n    privateIpv4(host) ||\n    privateIpv6(host) ||\n    !uniqueStrings(provider.allowedHosts) ||\n    !provider.allowedHosts.includes(host)\n  )\n    throw new McpToolError(\n      'unsafe_endpoint',\n      'Remote MCP endpoints require HTTPS, a public host allowlist, and no private address.',\n    );\n};\n\n/*** Detects loopback, link-local, unique-local, and unspecified IPv6 literals. */\nconst privateIpv6 = (host: string): boolean => {\n  const normalized = host.replace(/^\\[|\\]$/g, '').toLowerCase();\n  return (\n    normalized === '::' ||\n    normalized === '::1' ||\n    normalized.startsWith('fc') ||\n    normalized.startsWith('fd') ||\n    normalized.startsWith('fe8') ||\n    normalized.startsWith('fe9') ||\n    normalized.startsWith('fea') ||\n    normalized.startsWith('feb') ||\n    normalized.startsWith('::ffff:')\n  );\n};\n\n/*** Detects private, reserved, and local IPv4 literals. */\nconst privateIpv4 = (host: string): boolean => {\n  const parts = host.split('.').map(Number);\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))\n    return false;\n  const [first, second] = parts as [number, number, number, number];\n  return (\n    first === 0 ||\n    first === 10 ||\n    first === 127 ||\n    first >= 224 ||\n    (first === 169 && second === 254) ||\n    (first === 172 && second >= 16 && second <= 31) ||\n    (first === 192 && second === 168)\n  );\n};\n\n/*** Checks unique non-empty strings. */\nconst uniqueStrings = (values: readonly unknown[]): values is readonly string[] =>\n  values.every((value) => typeof value === 'string' && value.length > 0) &&\n  new Set(values).size === values.length;\n"]}

package/dist/features/mcp/validateMcpSchema.d.ts

@@ -0,0 +1,6 @@
+/*** Validates a closed supported JSON Schema and returns its stable argument matcher. */
+export declare const validateMcpSchema: (schema: Readonly<Record<string, unknown>>) => {
+    fingerprint: string;
+    matches: (value: unknown) => boolean;
+};
+//# sourceMappingURL=validateMcpSchema.d.ts.map

package/dist/features/mcp/validateMcpSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateMcpSchema.d.ts","sourceRoot":"","sources":["../../../src/features/mcp/validateMcpSchema.ts"],"names":[],"mappings":"AAgCA,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;qBAItD,OAAO,KAAG,OAAO;CAErC,CAAC"}

package/dist/features/mcp/validateMcpSchema.js

@@ -0,0 +1,220 @@
+import { createHash } from 'node:crypto';
+import { McpToolError } from './McpToolError.js';
+const MAX_DEPTH = 16;
+const TYPES = new Set(['null', 'boolean', 'number', 'integer', 'string', 'array', 'object']);
+const KEYS = new Set([
+    '$schema',
+    'title',
+    'description',
+    'type',
+    'const',
+    'enum',
+    'properties',
+    'required',
+    'additionalProperties',
+    'minProperties',
+    'maxProperties',
+    'items',
+    'minItems',
+    'maxItems',
+    'uniqueItems',
+    'minLength',
+    'maxLength',
+    'pattern',
+    'minimum',
+    'maximum',
+    'exclusiveMinimum',
+    'exclusiveMaximum',
+    'multipleOf',
+]);
+/*** Validates a closed supported JSON Schema and returns its stable argument matcher. */
+export const validateMcpSchema = (schema) => {
+    validateSchema(schema, 0);
+    return {
+        fingerprint: createHash('sha256').update(stableStringify(schema)).digest('hex'),
+        matches: (value) => matches(schema, value),
+    };
+};
+/*** Rejects unsupported JSON Schema features instead of weakening validation. */
+const validateSchema = (schema, depth) => {
+    if (depth > MAX_DEPTH)
+        throw new McpToolError('invalid_schema', 'MCP schema exceeds depth limit.');
+    if (Object.keys(schema).some((key) => !KEYS.has(key)))
+        throw new McpToolError('unsupported_schema', 'The MCP tool schema uses unsupported constraints.');
+    const { type } = schema;
+    if (typeof type !== 'string' || !TYPES.has(type))
+        throw new McpToolError('invalid_schema', 'MCP schemas require one supported type.');
+    validateJsonConstraints(schema);
+    if (type === 'object')
+        validateObject(schema, depth);
+    if (type === 'array')
+        validateArray(schema, depth);
+    if (type === 'string')
+        validateString(schema);
+    if (type === 'number' || type === 'integer')
+        validateNumber(schema);
+};
+/*** Validates portable const and enum declarations. */
+const validateJsonConstraints = (schema) => {
+    if ('const' in schema && !isJson(schema.const))
+        throw new McpToolError('invalid_schema', 'MCP schema const must be JSON data.');
+    if ('enum' in schema &&
+        (!Array.isArray(schema.enum) || !schema.enum.length || !schema.enum.every(isJson)))
+        throw new McpToolError('invalid_schema', 'MCP schema enum must contain JSON data.');
+};
+/*** Requires a closed object schema with validated declared properties. */
+const validateObject = (schema, depth) => {
+    const { properties, required, additionalProperties } = schema;
+    if (additionalProperties !== false)
+        throw new McpToolError('unsupported_schema', 'MCP object schemas must set additionalProperties to false.');
+    if (!isRecord(properties))
+        throw new McpToolError('invalid_schema', 'MCP object schemas need property definitions.');
+    Object.values(properties).forEach((property) => {
+        if (!isRecord(property))
+            throw new McpToolError('invalid_schema', 'MCP property schemas must be objects.');
+        validateSchema(property, depth + 1);
+    });
+    if (required !== undefined &&
+        (!isUniqueStrings(required) || required.some((key) => !(key in properties))))
+        throw new McpToolError('invalid_schema', 'MCP required properties must be declared exactly once.');
+    validateBounds(schema.minProperties, schema.maxProperties, 'minProperties', 'maxProperties', true);
+};
+/*** Requires an item schema so every array value is validated. */
+const validateArray = (schema, depth) => {
+    if (!isRecord(schema.items))
+        throw new McpToolError('unsupported_schema', 'MCP array schemas require an item schema.');
+    validateSchema(schema.items, depth + 1);
+    if (schema.uniqueItems !== undefined && typeof schema.uniqueItems !== 'boolean')
+        throw new McpToolError('invalid_schema', 'MCP uniqueItems must be boolean.');
+    validateBounds(schema.minItems, schema.maxItems, 'minItems', 'maxItems', true);
+};
+/*** Validates string bounds and regular-expression patterns. */
+const validateString = (schema) => {
+    validateBounds(schema.minLength, schema.maxLength, 'minLength', 'maxLength', true);
+    if (schema.pattern !== undefined) {
+        if (typeof schema.pattern !== 'string')
+            throw new McpToolError('invalid_schema', 'MCP pattern must be a string.');
+        try {
+            new RegExp(schema.pattern, 'u');
+        }
+        catch {
+            throw new McpToolError('invalid_schema', 'MCP pattern must compile.');
+        }
+    }
+};
+/*** Validates finite numeric constraints. */
+const validateNumber = (schema) => {
+    const values = [
+        schema.minimum,
+        schema.maximum,
+        schema.exclusiveMinimum,
+        schema.exclusiveMaximum,
+        schema.multipleOf,
+    ];
+    if (values.some((value) => value !== undefined && (typeof value !== 'number' || !Number.isFinite(value))))
+        throw new McpToolError('invalid_schema', 'MCP numeric constraints must be finite numbers.');
+    if (typeof schema.multipleOf === 'number' && schema.multipleOf <= 0)
+        throw new McpToolError('invalid_schema', 'MCP multipleOf must be positive.');
+};
+/*** Validates ordered numeric or integer bounds. */
+const validateBounds = (minimum, maximum, minimumKey, maximumKey, integers) => {
+    const valid = (value) => typeof value === 'number' &&
+        Number.isFinite(value) &&
+        (!integers || (Number.isSafeInteger(value) && value >= 0));
+    if (minimum !== undefined && !valid(minimum))
+        throw new McpToolError('invalid_schema', `MCP ${minimumKey} is invalid.`);
+    if (maximum !== undefined && !valid(maximum))
+        throw new McpToolError('invalid_schema', `MCP ${maximumKey} is invalid.`);
+    if (typeof minimum === 'number' && typeof maximum === 'number' && minimum > maximum)
+        throw new McpToolError('invalid_schema', `MCP ${minimumKey} cannot exceed ${maximumKey}.`);
+};
+/*** Matches supported JSON Schema constraints without coercion. */
+const matches = (schema, value) => {
+    const { type } = schema;
+    if (typeof type !== 'string' || !matchesType(type, value))
+        return false;
+    if ('const' in schema && stableStringify(schema.const) !== stableStringify(value))
+        return false;
+    if (Array.isArray(schema.enum) &&
+        !schema.enum.some((item) => stableStringify(item) === stableStringify(value)))
+        return false;
+    if (type === 'object')
+        return matchesObject(schema, value);
+    if (type === 'array')
+        return matchesArray(schema, value);
+    if (type === 'string')
+        return matchesString(schema, value);
+    return (type !== 'number' && type !== 'integer') || matchesNumber(schema, value);
+};
+/*** Matches a closed object and each declared property schema. */
+const matchesObject = (schema, value) => {
+    const { properties, required } = schema;
+    const minProperties = numberOr(schema.minProperties, 0);
+    const maxProperties = numberOr(schema.maxProperties, Infinity);
+    if (!isRecord(value) || !isRecord(properties))
+        return false;
+    const entries = Object.entries(value);
+    return (entries.length >= minProperties &&
+        entries.length <= maxProperties &&
+        (!Array.isArray(required) ||
+            required.every((key) => typeof key === 'string' && key in value)) &&
+        entries.every(([key, item]) => {
+            const property = Object.entries(properties).find(([name]) => name === key)?.[1];
+            return isRecord(property) && matches(property, item);
+        }));
+};
+/*** Matches array items, bounds, and deterministic uniqueness. */
+const matchesArray = (schema, value) => {
+    const { items, uniqueItems = false } = schema;
+    const minItems = numberOr(schema.minItems, 0);
+    const maxItems = numberOr(schema.maxItems, Infinity);
+    return (Array.isArray(value) &&
+        isRecord(items) &&
+        value.length >= minItems &&
+        value.length <= maxItems &&
+        (!uniqueItems || new Set(value.map(stableStringify)).size === value.length) &&
+        value.every((item) => matches(items, item)));
+};
+/*** Matches string constraints. */
+const matchesString = (schema, value) => typeof value === 'string' &&
+    [...value].length >= numberOr(schema.minLength, 0) &&
+    [...value].length <= numberOr(schema.maxLength, Infinity) &&
+    (typeof schema.pattern !== 'string' || new RegExp(schema.pattern, 'u').test(value));
+/*** Matches finite number constraints. */
+const matchesNumber = (schema, value) => (typeof schema.minimum !== 'number' || value >= schema.minimum) &&
+    (typeof schema.maximum !== 'number' || value <= schema.maximum) &&
+    (typeof schema.exclusiveMinimum !== 'number' || value > schema.exclusiveMinimum) &&
+    (typeof schema.exclusiveMaximum !== 'number' || value < schema.exclusiveMaximum) &&
+    (typeof schema.multipleOf !== 'number' || Number.isInteger(value / schema.multipleOf));
+/*** Matches a JSON Schema primitive type. */
+const matchesType = (type, value) => (type === 'null' && value === null) ||
+    (type === 'array' && Array.isArray(value)) ||
+    (type === 'object' && isRecord(value)) ||
+    (type === 'integer' && Number.isSafeInteger(value)) ||
+    (type === 'number' && typeof value === 'number' && Number.isFinite(value)) ||
+    (type === 'string' && typeof value === 'string') ||
+    (type === 'boolean' && typeof value === 'boolean');
+/*** Narrows unknown data to a non-array object. */
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/*** Confirms a value is portable JSON data. */
+const isJson = (value) => value === null ||
+    ['string', 'boolean'].includes(typeof value) ||
+    (typeof value === 'number' && Number.isFinite(value)) ||
+    (Array.isArray(value) && value.every(isJson)) ||
+    (isRecord(value) && Object.values(value).every(isJson));
+/*** Confirms a value is an array of unique non-empty strings. */
+const isUniqueStrings = (value) => Array.isArray(value) &&
+    value.every((item) => typeof item === 'string' && item.length > 0) &&
+    new Set(value).size === value.length;
+/*** Returns a numeric schema value or its validated default. */
+const numberOr = (value, fallback) => typeof value === 'number' ? value : fallback;
+/*** Serializes JSON data deterministically. */
+const stableStringify = (value) => Array.isArray(value)
+    ? `[${value.map(stableStringify).join(',')}]`
+    : isRecord(value)
+        ? `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`)
+            .join(',')}}`
+        : JSON.stringify(value);
+//# sourceMappingURL=validateMcpSchema.js.map

package/dist/features/mcp/validateMcpSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateMcpSchema.js","sourceRoot":"","sources":["../../../src/features/mcp/validateMcpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,SAAS;IACT,OAAO;IACP,aAAa;IACb,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ,UAAU;IACV,sBAAsB;IACtB,eAAe;IACf,eAAe;IACf,OAAO;IACP,UAAU;IACV,UAAU;IACV,aAAa;IACb,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,SAAS;IACT,kBAAkB;IAClB,kBAAkB;IAClB,YAAY;CACb,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAyC,EAAE,EAAE;IAC7E,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1B,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/E,OAAO,EAAE,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;KAC7D,CAAC;AACJ,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,MAAyC,EAAE,KAAa,EAAQ,EAAE;IACxF,IAAI,KAAK,GAAG,SAAS;QACnB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAC9C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;IACtF,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,QAAQ;QAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,OAAO;QAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,QAAQ;QAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,cAAc,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,uBAAuB,GAAG,CAAC,MAAyC,EAAQ,EAAE;IAClF,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAClF,IACE,MAAM,IAAI,MAAM;QAChB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElF,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,cAAc,GAAG,CAAC,MAAyC,EAAE,KAAa,EAAQ,EAAE;IACxF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;IAC9D,IAAI,oBAAoB,KAAK,KAAK;QAChC,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;IAC5F,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QACpF,cAAc,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;QAE5E,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;IACJ,cAAc,CACZ,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,aAAa,EACpB,eAAe,EACf,eAAe,EACf,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,aAAa,GAAG,CAAC,MAAyC,EAAE,KAAa,EAAQ,EAAE;IACvF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC;IAC5F,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS;QAC7E,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IAC/E,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,cAAc,GAAG,CAAC,MAAyC,EAAQ,EAAE;IACzE,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YACpC,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,cAAc,GAAG,CAAC,MAAyC,EAAQ,EAAE;IACzE,MAAM,MAAM,GAAG;QACb,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,UAAU;KAClB,CAAC;IACF,IACE,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACzF;QAED,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC9F,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC;QACjE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,oDAAoD;AACpD,MAAM,cAAc,GAAG,CACrB,OAAgB,EAChB,OAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,QAAiB,EACX,EAAE;IACR,MAAM,KAAK,GAAG,CAAC,KAAc,EAAmB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC1C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,OAAO,UAAU,cAAc,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC1C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,OAAO,UAAU,cAAc,CAAC,CAAC;IAC5E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,OAAO;QACjF,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,OAAO,UAAU,kBAAkB,UAAU,GAAG,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF,mEAAmE;AACnE,MAAM,OAAO,GAAG,CAAC,MAAyC,EAAE,KAAc,EAAW,EAAE;IACrF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC;QAE7E,OAAO,KAAK,CAAC;IACf,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,KAAe,CAAC,CAAC;AAC7F,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,aAAa,GAAG,CAAC,MAAyC,EAAE,KAAc,EAAW,EAAE;IAC3F,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CACL,OAAO,CAAC,MAAM,IAAI,aAAa;QAC/B,OAAO,CAAC,MAAM,IAAI,aAAa;QAC/B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACvB,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,YAAY,GAAG,CAAC,MAAyC,EAAE,KAAc,EAAW,EAAE;IAC1F,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,MAAM,IAAI,QAAQ;QACxB,KAAK,CAAC,MAAM,IAAI,QAAQ;QACxB,CAAC,CAAC,WAAW,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;QAC3E,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,mCAAmC;AACnC,MAAM,aAAa,GAAG,CAAC,MAAyC,EAAE,KAAc,EAAW,EAAE,CAC3F,OAAO,KAAK,KAAK,QAAQ;IACzB,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;IACzD,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,MAAM,aAAa,GAAG,CAAC,MAAyC,EAAE,KAAa,EAAW,EAAE,CAC1F,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC;IAC/D,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC;IAC/D,CAAC,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAChF,CAAC,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAChF,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAEzF,6CAA6C;AAC7C,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAc,EAAW,EAAE,CAC5D,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;IACnC,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAChD,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;AAErD,mDAAmD;AACnD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAA8C,EAAE,CAC9E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,+CAA+C;AAC/C,MAAM,MAAM,GAAG,CAAC,KAAc,EAAW,EAAE,CACzC,KAAK,KAAK,IAAI;IACd,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC;IAC5C,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,iEAAiE;AACjE,MAAM,eAAe,GAAG,CAAC,KAAc,EAA8B,EAAE,CACrE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IACpB,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AACvC,gEAAgE;AAChE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAU,EAAE,CAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,+CAA+C;AAC/C,MAAM,eAAe,GAAG,CAAC,KAAc,EAAU,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClB,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;IAC7C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACtB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;aACvE,IAAI,CAAC,GAAG,CAAC,GAAG;QACjB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { McpToolError } from './McpToolError.js';\n\nconst MAX_DEPTH = 16;\nconst TYPES = new Set(['null', 'boolean', 'number', 'integer', 'string', 'array', 'object']);\nconst KEYS = new Set([\n  '$schema',\n  'title',\n  'description',\n  'type',\n  'const',\n  'enum',\n  'properties',\n  'required',\n  'additionalProperties',\n  'minProperties',\n  'maxProperties',\n  'items',\n  'minItems',\n  'maxItems',\n  'uniqueItems',\n  'minLength',\n  'maxLength',\n  'pattern',\n  'minimum',\n  'maximum',\n  'exclusiveMinimum',\n  'exclusiveMaximum',\n  'multipleOf',\n]);\n\n/*** Validates a closed supported JSON Schema and returns its stable argument matcher. */\nexport const validateMcpSchema = (schema: Readonly<Record<string, unknown>>) => {\n  validateSchema(schema, 0);\n  return {\n    fingerprint: createHash('sha256').update(stableStringify(schema)).digest('hex'),\n    matches: (value: unknown): boolean => matches(schema, value),\n  };\n};\n\n/*** Rejects unsupported JSON Schema features instead of weakening validation. */\nconst validateSchema = (schema: Readonly<Record<string, unknown>>, depth: number): void => {\n  if (depth > MAX_DEPTH)\n    throw new McpToolError('invalid_schema', 'MCP schema exceeds depth limit.');\n  if (Object.keys(schema).some((key) => !KEYS.has(key)))\n    throw new McpToolError(\n      'unsupported_schema',\n      'The MCP tool schema uses unsupported constraints.',\n    );\n  const { type } = schema;\n  if (typeof type !== 'string' || !TYPES.has(type))\n    throw new McpToolError('invalid_schema', 'MCP schemas require one supported type.');\n  validateJsonConstraints(schema);\n  if (type === 'object') validateObject(schema, depth);\n  if (type === 'array') validateArray(schema, depth);\n  if (type === 'string') validateString(schema);\n  if (type === 'number' || type === 'integer') validateNumber(schema);\n};\n\n/*** Validates portable const and enum declarations. */\nconst validateJsonConstraints = (schema: Readonly<Record<string, unknown>>): void => {\n  if ('const' in schema && !isJson(schema.const))\n    throw new McpToolError('invalid_schema', 'MCP schema const must be JSON data.');\n  if (\n    'enum' in schema &&\n    (!Array.isArray(schema.enum) || !schema.enum.length || !schema.enum.every(isJson))\n  )\n    throw new McpToolError('invalid_schema', 'MCP schema enum must contain JSON data.');\n};\n\n/*** Requires a closed object schema with validated declared properties. */\nconst validateObject = (schema: Readonly<Record<string, unknown>>, depth: number): void => {\n  const { properties, required, additionalProperties } = schema;\n  if (additionalProperties !== false)\n    throw new McpToolError(\n      'unsupported_schema',\n      'MCP object schemas must set additionalProperties to false.',\n    );\n  if (!isRecord(properties))\n    throw new McpToolError('invalid_schema', 'MCP object schemas need property definitions.');\n  Object.values(properties).forEach((property) => {\n    if (!isRecord(property))\n      throw new McpToolError('invalid_schema', 'MCP property schemas must be objects.');\n    validateSchema(property, depth + 1);\n  });\n  if (\n    required !== undefined &&\n    (!isUniqueStrings(required) || required.some((key) => !(key in properties)))\n  )\n    throw new McpToolError(\n      'invalid_schema',\n      'MCP required properties must be declared exactly once.',\n    );\n  validateBounds(\n    schema.minProperties,\n    schema.maxProperties,\n    'minProperties',\n    'maxProperties',\n    true,\n  );\n};\n\n/*** Requires an item schema so every array value is validated. */\nconst validateArray = (schema: Readonly<Record<string, unknown>>, depth: number): void => {\n  if (!isRecord(schema.items))\n    throw new McpToolError('unsupported_schema', 'MCP array schemas require an item schema.');\n  validateSchema(schema.items, depth + 1);\n  if (schema.uniqueItems !== undefined && typeof schema.uniqueItems !== 'boolean')\n    throw new McpToolError('invalid_schema', 'MCP uniqueItems must be boolean.');\n  validateBounds(schema.minItems, schema.maxItems, 'minItems', 'maxItems', true);\n};\n\n/*** Validates string bounds and regular-expression patterns. */\nconst validateString = (schema: Readonly<Record<string, unknown>>): void => {\n  validateBounds(schema.minLength, schema.maxLength, 'minLength', 'maxLength', true);\n  if (schema.pattern !== undefined) {\n    if (typeof schema.pattern !== 'string')\n      throw new McpToolError('invalid_schema', 'MCP pattern must be a string.');\n    try {\n      new RegExp(schema.pattern, 'u');\n    } catch {\n      throw new McpToolError('invalid_schema', 'MCP pattern must compile.');\n    }\n  }\n};\n\n/*** Validates finite numeric constraints. */\nconst validateNumber = (schema: Readonly<Record<string, unknown>>): void => {\n  const values = [\n    schema.minimum,\n    schema.maximum,\n    schema.exclusiveMinimum,\n    schema.exclusiveMaximum,\n    schema.multipleOf,\n  ];\n  if (\n    values.some(\n      (value) => value !== undefined && (typeof value !== 'number' || !Number.isFinite(value)),\n    )\n  )\n    throw new McpToolError('invalid_schema', 'MCP numeric constraints must be finite numbers.');\n  if (typeof schema.multipleOf === 'number' && schema.multipleOf <= 0)\n    throw new McpToolError('invalid_schema', 'MCP multipleOf must be positive.');\n};\n\n/*** Validates ordered numeric or integer bounds. */\nconst validateBounds = (\n  minimum: unknown,\n  maximum: unknown,\n  minimumKey: string,\n  maximumKey: string,\n  integers: boolean,\n): void => {\n  const valid = (value: unknown): value is number =>\n    typeof value === 'number' &&\n    Number.isFinite(value) &&\n    (!integers || (Number.isSafeInteger(value) && value >= 0));\n  if (minimum !== undefined && !valid(minimum))\n    throw new McpToolError('invalid_schema', `MCP ${minimumKey} is invalid.`);\n  if (maximum !== undefined && !valid(maximum))\n    throw new McpToolError('invalid_schema', `MCP ${maximumKey} is invalid.`);\n  if (typeof minimum === 'number' && typeof maximum === 'number' && minimum > maximum)\n    throw new McpToolError('invalid_schema', `MCP ${minimumKey} cannot exceed ${maximumKey}.`);\n};\n\n/*** Matches supported JSON Schema constraints without coercion. */\nconst matches = (schema: Readonly<Record<string, unknown>>, value: unknown): boolean => {\n  const { type } = schema;\n  if (typeof type !== 'string' || !matchesType(type, value)) return false;\n  if ('const' in schema && stableStringify(schema.const) !== stableStringify(value)) return false;\n  if (\n    Array.isArray(schema.enum) &&\n    !schema.enum.some((item) => stableStringify(item) === stableStringify(value))\n  )\n    return false;\n  if (type === 'object') return matchesObject(schema, value);\n  if (type === 'array') return matchesArray(schema, value);\n  if (type === 'string') return matchesString(schema, value);\n  return (type !== 'number' && type !== 'integer') || matchesNumber(schema, value as number);\n};\n\n/*** Matches a closed object and each declared property schema. */\nconst matchesObject = (schema: Readonly<Record<string, unknown>>, value: unknown): boolean => {\n  const { properties, required } = schema;\n  const minProperties = numberOr(schema.minProperties, 0);\n  const maxProperties = numberOr(schema.maxProperties, Infinity);\n  if (!isRecord(value) || !isRecord(properties)) return false;\n  const entries = Object.entries(value);\n  return (\n    entries.length >= minProperties &&\n    entries.length <= maxProperties &&\n    (!Array.isArray(required) ||\n      required.every((key) => typeof key === 'string' && key in value)) &&\n    entries.every(([key, item]) => {\n      const property = Object.entries(properties).find(([name]) => name === key)?.[1];\n      return isRecord(property) && matches(property, item);\n    })\n  );\n};\n\n/*** Matches array items, bounds, and deterministic uniqueness. */\nconst matchesArray = (schema: Readonly<Record<string, unknown>>, value: unknown): boolean => {\n  const { items, uniqueItems = false } = schema;\n  const minItems = numberOr(schema.minItems, 0);\n  const maxItems = numberOr(schema.maxItems, Infinity);\n  return (\n    Array.isArray(value) &&\n    isRecord(items) &&\n    value.length >= minItems &&\n    value.length <= maxItems &&\n    (!uniqueItems || new Set(value.map(stableStringify)).size === value.length) &&\n    value.every((item) => matches(items, item))\n  );\n};\n\n/*** Matches string constraints. */\nconst matchesString = (schema: Readonly<Record<string, unknown>>, value: unknown): boolean =>\n  typeof value === 'string' &&\n  [...value].length >= numberOr(schema.minLength, 0) &&\n  [...value].length <= numberOr(schema.maxLength, Infinity) &&\n  (typeof schema.pattern !== 'string' || new RegExp(schema.pattern, 'u').test(value));\n\n/*** Matches finite number constraints. */\nconst matchesNumber = (schema: Readonly<Record<string, unknown>>, value: number): boolean =>\n  (typeof schema.minimum !== 'number' || value >= schema.minimum) &&\n  (typeof schema.maximum !== 'number' || value <= schema.maximum) &&\n  (typeof schema.exclusiveMinimum !== 'number' || value > schema.exclusiveMinimum) &&\n  (typeof schema.exclusiveMaximum !== 'number' || value < schema.exclusiveMaximum) &&\n  (typeof schema.multipleOf !== 'number' || Number.isInteger(value / schema.multipleOf));\n\n/*** Matches a JSON Schema primitive type. */\nconst matchesType = (type: string, value: unknown): boolean =>\n  (type === 'null' && value === null) ||\n  (type === 'array' && Array.isArray(value)) ||\n  (type === 'object' && isRecord(value)) ||\n  (type === 'integer' && Number.isSafeInteger(value)) ||\n  (type === 'number' && typeof value === 'number' && Number.isFinite(value)) ||\n  (type === 'string' && typeof value === 'string') ||\n  (type === 'boolean' && typeof value === 'boolean');\n\n/*** Narrows unknown data to a non-array object. */\nconst isRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value);\n/*** Confirms a value is portable JSON data. */\nconst isJson = (value: unknown): boolean =>\n  value === null ||\n  ['string', 'boolean'].includes(typeof value) ||\n  (typeof value === 'number' && Number.isFinite(value)) ||\n  (Array.isArray(value) && value.every(isJson)) ||\n  (isRecord(value) && Object.values(value).every(isJson));\n/*** Confirms a value is an array of unique non-empty strings. */\nconst isUniqueStrings = (value: unknown): value is readonly string[] =>\n  Array.isArray(value) &&\n  value.every((item) => typeof item === 'string' && item.length > 0) &&\n  new Set(value).size === value.length;\n/*** Returns a numeric schema value or its validated default. */\nconst numberOr = (value: unknown, fallback: number): number =>\n  typeof value === 'number' ? value : fallback;\n/*** Serializes JSON data deterministically. */\nconst stableStringify = (value: unknown): string =>\n  Array.isArray(value)\n    ? `[${value.map(stableStringify).join(',')}]`\n    : isRecord(value)\n      ? `{${Object.entries(value)\n          .sort(([left], [right]) => left.localeCompare(right))\n          .map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`)\n          .join(',')}}`\n      : JSON.stringify(value);\n"]}

package/dist/features/security/FlowSecurityError.d.ts

@@ -0,0 +1,6 @@
+/*** Represents a stable, payload-redacted Flow security denial. */
+export declare class FlowSecurityError extends Error {
+    readonly code: 'approval_pending' | 'approval_rejected' | 'idempotency_conflict' | 'invalid_target' | 'permission_denied' | 'rate_limited' | 'secret_unavailable';
+    constructor(code: 'approval_pending' | 'approval_rejected' | 'idempotency_conflict' | 'invalid_target' | 'permission_denied' | 'rate_limited' | 'secret_unavailable', message: string);
+}
+//# sourceMappingURL=FlowSecurityError.d.ts.map

package/dist/features/security/FlowSecurityError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FlowSecurityError.d.ts","sourceRoot":"","sources":["../../../src/features/security/FlowSecurityError.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAChB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,oBAAoB;gBAPR,IAAI,EAChB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,oBAAoB,EACxB,OAAO,EAAE,MAAM;CAKlB"}

package/dist/features/security/FlowSecurityError.js

@@ -0,0 +1,10 @@
+/*** Represents a stable, payload-redacted Flow security denial. */
+export class FlowSecurityError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'FlowSecurityError';
+    }
+}
+//# sourceMappingURL=FlowSecurityError.js.map

package/dist/features/security/FlowSecurityError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FlowSecurityError.js","sourceRoot":"","sources":["../../../src/features/security/FlowSecurityError.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IADlB,YACkB,IAOQ,EACxB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAVC,SAAI,GAAJ,IAAI,CAOI;QAIxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF","sourcesContent":["/*** Represents a stable, payload-redacted Flow security denial. */\nexport class FlowSecurityError extends Error {\n  public constructor(\n    public readonly code:\n      | 'approval_pending'\n      | 'approval_rejected'\n      | 'idempotency_conflict'\n      | 'invalid_target'\n      | 'permission_denied'\n      | 'rate_limited'\n      | 'secret_unavailable',\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FlowSecurityError';\n  }\n}\n"]}

package/dist/features/security/application/createFlowSecurityPort.d.ts

@@ -0,0 +1,12 @@
+import type { SecretStoreAdapter } from '@ankhorage/contracts/secrets';
+import type { FlowApprovalStorePort, FlowOperationStorePort, FlowRateLimitPort, FlowSecurityAuditPort, FlowSecurityGrant, FlowSecurityPort } from '../../../types/security.js';
+/*** Creates the provider-neutral server-side authorization, approval, audit, and secret boundary. */
+export declare const createFlowSecurityPort: (input: {
+    readonly approvalStore: FlowApprovalStorePort;
+    readonly audit: FlowSecurityAuditPort;
+    readonly grants: readonly FlowSecurityGrant[];
+    readonly operationStore: FlowOperationStorePort;
+    readonly rateLimit: FlowRateLimitPort;
+    readonly secretStore: SecretStoreAdapter;
+}) => FlowSecurityPort;
+//# sourceMappingURL=createFlowSecurityPort.d.ts.map

package/dist/features/security/application/createFlowSecurityPort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createFlowSecurityPort.d.ts","sourceRoot":"","sources":["../../../../src/features/security/application/createFlowSecurityPort.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElF,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EAOjB,qBAAqB,EACrB,iBAAiB,EAIjB,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAYpC,qGAAqG;AACrG,eAAO,MAAM,sBAAsB,GAAI,OAAO;IAC5C,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;CAC1C,KAAG,gBAKF,CAAC"}