@burdenoff/mcp-libs 2026.511.1

package/dist/modules/security/index.js

@@ -0,0 +1,480 @@
+import { mcpToolName, errorResult, jsonResult } from '../../chunk-H2OYWLOA.js';
+import { z } from 'zod';
+
+// src/modules/security/operations.ts
+var GET_VAULTS = `
+  query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {
+    getVaults(filter: $filter, pagination: $pagination) {
+      items { id name description scope status createdAt }
+      total hasMore
+    }
+  }
+`;
+var GET_VAULT = `
+  query GetVault($id: ID!) {
+    getVault(id: $id) {
+      id name description scope scopeId status lockAfterMinutes createdAt updatedAt
+    }
+  }
+`;
+var CREATE_VAULT = `
+  mutation CreateVault($input: CreateVaultInput!) {
+    createVault(input: $input) {
+      id name scope scopeId status
+    }
+  }
+`;
+var DELETE_VAULT = `
+  mutation DeleteVault($id: ID!) {
+    deleteVault(id: $id)
+  }
+`;
+var ARCHIVE_VAULT = `
+  mutation ArchiveVault($id: ID!) {
+    archiveVault(id: $id) { id status }
+  }
+`;
+var GET_SECRETS = `
+  query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {
+    getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {
+      items { id key name description type status isEphemeral createdAt }
+      total hasMore
+    }
+  }
+`;
+var GET_SECRET = `
+  query GetSecret($id: ID!) {
+    getSecret(id: $id) {
+      id key name description type status isEphemeral expiresAt createdAt updatedAt
+    }
+  }
+`;
+var DECRYPT_SECRET = `
+  query DecryptSecret($id: ID!) {
+    decryptSecret(id: $id) {
+      id key value
+    }
+  }
+`;
+var CREATE_SECRET = `
+  mutation CreateSecret($input: CreateSecretInput!) {
+    createSecret(input: $input) {
+      id key name type status
+    }
+  }
+`;
+var UPDATE_SECRET = `
+  mutation UpdateSecret($id: ID!, $input: UpdateSecretInput!) {
+    updateSecret(id: $id, input: $input) {
+      id key name status updatedAt
+    }
+  }
+`;
+var DELETE_SECRET = `
+  mutation DeleteSecret($id: ID!) {
+    deleteSecret(id: $id)
+  }
+`;
+var ROTATE_SECRET = `
+  mutation RotateSecret($id: ID!, $newValue: String!) {
+    rotateSecret(id: $id, newValue: $newValue) {
+      id key updatedAt
+    }
+  }
+`;
+
+// src/modules/security/tools.ts
+var VaultScopeEnum = z.enum(["WORKSPACE", "GLOBAL", "VIBE"]);
+var VaultStatusEnum = z.enum(["ACTIVE", "LOCKED", "ARCHIVED"]);
+var SecretTypeEnum = z.enum(["API_KEY", "PASSWORD", "CERTIFICATE", "TOKEN", "OTHER"]);
+var SecretStatusEnum = z.enum(["ACTIVE", "EXPIRED", "REVOKED"]);
+function readWorkspaceContext(ctx) {
+  const auth = ctx.auth.read();
+  if (!auth?.workspaceId) return null;
+  return { workspaceId: auth.workspaceId };
+}
+function registerSecurityTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_vaults_list")),
+    {
+      title: "List Vaults",
+      description: "List vaults in the current workspace with optional filters and pagination.",
+      inputSchema: {
+        scope: VaultScopeEnum.optional().describe("Filter by vault scope"),
+        status: VaultStatusEnum.optional().describe("Filter by status"),
+        search: z.string().optional().describe("Free-text search"),
+        limit: z.number().optional().describe("Page size (default 50)"),
+        offset: z.number().optional().describe("Skip results")
+      }
+    },
+    async ({ scope, status, search, limit, offset }) => {
+      try {
+        const workspaceCtx = readWorkspaceContext(ctx);
+        if (!workspaceCtx) {
+          return errorResult(
+            "No active workspace. Bind a workspace via the auth login flow first."
+          );
+        }
+        const filter = { context: workspaceCtx };
+        if (scope !== void 0) filter.scope = scope;
+        if (status !== void 0) filter.status = status;
+        if (search !== void 0) filter.search = search;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(GET_VAULTS, {
+          filter,
+          pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+        });
+        return jsonResult(data.getVaults);
+      } catch (error) {
+        ctx.logger.error("security_vaults_list failed", { error });
+        return errorResult(
+          `Failed to list vaults: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_vaults_get")),
+    {
+      title: "Get Vault",
+      description: "Get a vault by ID.",
+      inputSchema: {
+        id: z.string().describe("Vault ID")
+      }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_VAULT, {
+          id
+        });
+        if (!data.getVault) {
+          return errorResult(`Vault ${id} not found`);
+        }
+        return jsonResult(data.getVault);
+      } catch (error) {
+        ctx.logger.error("security_vaults_get failed", { error });
+        return errorResult(
+          `Failed to get vault: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_vaults_create")),
+    {
+      title: "Create Vault",
+      description: "Create a new vault scoped to the current workspace.",
+      inputSchema: {
+        name: z.string().describe("Vault name"),
+        description: z.string().optional().describe("Vault description"),
+        scope: VaultScopeEnum.optional().describe("Vault scope (default: WORKSPACE)"),
+        scopeId: z.string().optional().describe("Scope ID (defaults to current workspace ID when scope is WORKSPACE)"),
+        lockAfterMinutes: z.number().optional().describe("Auto-lock after N minutes of inactivity")
+      }
+    },
+    async ({ name, description, scope, scopeId, lockAfterMinutes }) => {
+      try {
+        const workspaceCtx = readWorkspaceContext(ctx);
+        if (!workspaceCtx) {
+          return errorResult(
+            "No active workspace. Bind a workspace via the auth login flow first."
+          );
+        }
+        const resolvedScope = scope ?? "WORKSPACE";
+        const input = {
+          context: workspaceCtx,
+          name,
+          scope: resolvedScope,
+          scopeId: scopeId ?? workspaceCtx.workspaceId
+        };
+        if (description !== void 0) input.description = description;
+        if (lockAfterMinutes !== void 0) input.lockAfterMinutes = lockAfterMinutes;
+        const data = await ctx.gql.workspace.request(CREATE_VAULT, {
+          input
+        });
+        return jsonResult(data.createVault);
+      } catch (error) {
+        ctx.logger.error("security_vaults_create failed", { error });
+        return errorResult(
+          `Failed to create vault: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_vaults_delete")),
+    {
+      title: "Delete Vault",
+      description: "Delete a vault. Set archive=true to soft-archive instead of permanently deleting.",
+      inputSchema: {
+        id: z.string().describe("Vault ID"),
+        archive: z.boolean().optional().describe("Archive instead of hard delete")
+      }
+    },
+    async ({ id, archive }) => {
+      try {
+        if (archive === true) {
+          const data2 = await ctx.gql.workspace.request(ARCHIVE_VAULT, { id });
+          return jsonResult({ archived: true, vault: data2.archiveVault });
+        }
+        const data = await ctx.gql.workspace.request(DELETE_VAULT, {
+          id
+        });
+        return jsonResult({ deleted: data.deleteVault, vaultId: id });
+      } catch (error) {
+        ctx.logger.error("security_vaults_delete failed", { error });
+        return errorResult(
+          `Failed to delete vault: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_list")),
+    {
+      title: "List Secrets",
+      description: "List secrets in a vault with optional filters and pagination.",
+      inputSchema: {
+        vaultId: z.string().describe("Vault ID"),
+        type: SecretTypeEnum.optional().describe("Filter by secret type"),
+        search: z.string().optional().describe("Free-text search"),
+        limit: z.number().optional().describe("Page size (default 100)"),
+        offset: z.number().optional().describe("Skip results")
+      }
+    },
+    async ({ vaultId, type, search, limit, offset }) => {
+      try {
+        const workspaceCtx = readWorkspaceContext(ctx);
+        if (!workspaceCtx) {
+          return errorResult(
+            "No active workspace. Bind a workspace via the auth login flow first."
+          );
+        }
+        const filter = { context: workspaceCtx };
+        if (type !== void 0) filter.type = type;
+        if (search !== void 0) filter.search = search;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(GET_SECRETS, {
+          vaultId,
+          filter,
+          pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+        });
+        return jsonResult(data.getSecrets);
+      } catch (error) {
+        ctx.logger.error("security_secrets_list failed", { error });
+        return errorResult(
+          `Failed to list secrets: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_get")),
+    {
+      title: "Get Secret Metadata",
+      description: "Get a secret's metadata. Does NOT decrypt the value \u2014 use security_secrets_reveal for that.",
+      inputSchema: {
+        id: z.string().describe("Secret ID")
+      }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_SECRET, {
+          id
+        });
+        if (!data.getSecret) {
+          return errorResult(`Secret ${id} not found`);
+        }
+        return jsonResult(data.getSecret);
+      } catch (error) {
+        ctx.logger.error("security_secrets_get failed", { error });
+        return errorResult(
+          `Failed to get secret: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_reveal")),
+    {
+      title: "Reveal Secret Value",
+      description: "Decrypt and return the secret value. This action is audited server-side. Treat the result as sensitive and avoid persisting it.",
+      inputSchema: {
+        id: z.string().describe("Secret ID")
+      }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(DECRYPT_SECRET, { id });
+        return jsonResult(data.decryptSecret);
+      } catch (error) {
+        ctx.logger.error("security_secrets_reveal failed", { error });
+        return errorResult(
+          `Failed to reveal secret: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_set")),
+    {
+      title: "Create Secret",
+      description: "Create a new secret in a vault. The value is encrypted server-side.",
+      inputSchema: {
+        vaultId: z.string().describe("Vault ID"),
+        key: z.string().describe("Secret key (unique within the vault)"),
+        name: z.string().describe("Human-readable secret name"),
+        value: z.string().describe("Secret value (will be encrypted server-side)"),
+        description: z.string().optional().describe("Secret description"),
+        type: SecretTypeEnum.optional().describe("Secret type (default: OTHER)"),
+        isEphemeral: z.boolean().optional().describe("Mark as ephemeral"),
+        expiresAt: z.string().optional().describe("Expiry timestamp in ISO 8601")
+      }
+    },
+    async ({ vaultId, key, name, value, description, type, isEphemeral, expiresAt }) => {
+      try {
+        const workspaceCtx = readWorkspaceContext(ctx);
+        if (!workspaceCtx) {
+          return errorResult(
+            "No active workspace. Bind a workspace via the auth login flow first."
+          );
+        }
+        const input = {
+          context: workspaceCtx,
+          vaultId,
+          key,
+          name,
+          value,
+          type: type ?? "OTHER",
+          isEphemeral: isEphemeral === true
+        };
+        if (description !== void 0) input.description = description;
+        if (expiresAt !== void 0) input.expiresAt = expiresAt;
+        const data = await ctx.gql.workspace.request(CREATE_SECRET, {
+          input
+        });
+        return jsonResult(data.createSecret);
+      } catch (error) {
+        ctx.logger.error("security_secrets_set failed", { error });
+        return errorResult(
+          `Failed to create secret: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_update")),
+    {
+      title: "Update Secret Metadata",
+      description: "Update secret metadata (name, description, status). To rotate the value, use security_secrets_rotate.",
+      inputSchema: {
+        id: z.string().describe("Secret ID"),
+        name: z.string().optional().describe("Updated name"),
+        description: z.string().optional().describe("Updated description"),
+        status: SecretStatusEnum.optional().describe("Updated status")
+      }
+    },
+    async ({ id, name, description, status }) => {
+      try {
+        const workspaceCtx = readWorkspaceContext(ctx);
+        if (!workspaceCtx) {
+          return errorResult(
+            "No active workspace. Bind a workspace via the auth login flow first."
+          );
+        }
+        const input = { context: workspaceCtx };
+        if (name !== void 0) input.name = name;
+        if (description !== void 0) input.description = description;
+        if (status !== void 0) input.status = status;
+        if (Object.keys(input).length === 1) {
+          return errorResult("No updates specified");
+        }
+        const data = await ctx.gql.workspace.request(UPDATE_SECRET, {
+          id,
+          input
+        });
+        return jsonResult(data.updateSecret);
+      } catch (error) {
+        ctx.logger.error("security_secrets_update failed", { error });
+        return errorResult(
+          `Failed to update secret: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_rotate")),
+    {
+      title: "Rotate Secret Value",
+      description: "Replace a secret's encrypted value with a new one.",
+      inputSchema: {
+        id: z.string().describe("Secret ID"),
+        newValue: z.string().describe("New secret value")
+      }
+    },
+    async ({ id, newValue }) => {
+      try {
+        const data = await ctx.gql.workspace.request(ROTATE_SECRET, {
+          id,
+          newValue
+        });
+        return jsonResult(data.rotateSecret);
+      } catch (error) {
+        ctx.logger.error("security_secrets_rotate failed", { error });
+        return errorResult(
+          `Failed to rotate secret: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "security_secrets_delete")),
+    {
+      title: "Delete Secret",
+      description: "Delete a secret by ID.",
+      inputSchema: {
+        id: z.string().describe("Secret ID")
+      }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(DELETE_SECRET, {
+          id
+        });
+        return jsonResult({ deleted: data.deleteSecret, secretId: id });
+      } catch (error) {
+        ctx.logger.error("security_secrets_delete failed", { error });
+        return errorResult(
+          `Failed to delete secret: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+
+// src/modules/security/index.ts
+var securityModule = {
+  id: "security",
+  version: "0.0.1",
+  displayName: "Security",
+  dependsOn: ["auth"],
+  capabilities: { tools: {} },
+  register(server, ctx) {
+    const tools = [];
+    const track = (n) => {
+      tools.push(n);
+      return n;
+    };
+    registerSecurityTools(server, ctx, track);
+    return { tools, resources: [], prompts: [] };
+  }
+};
+var security_default = securityModule;
+
+export { security_default as default };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/modules/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/modules/security/operations.ts","../../../src/modules/security/tools.ts","../../../src/modules/security/index.ts"],"names":["data"],"mappings":";;;;AAAO,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASnB,IAAM,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQlB,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQrB,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA,CAAA;AAMrB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMtB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASpB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQnB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQvB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQtB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQtB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMtB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;;;AClE7B,IAAM,iBAAiB,CAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC7D,IAAM,kBAAkB,CAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,QAAA,EAAU,UAAU,CAAC,CAAA;AAC/D,IAAM,cAAA,GAAiB,EAAE,IAAA,CAAK,CAAC,WAAW,UAAA,EAAY,aAAA,EAAe,OAAA,EAAS,OAAO,CAAC,CAAA;AACtF,IAAM,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AA2BhE,SAAS,qBAAqB,GAAA,EAAiD;AAC7E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,EAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,OAAO,IAAA;AAC/B,EAAA,OAAO,EAAE,WAAA,EAAa,IAAA,CAAK,WAAA,EAAY;AACzC;AAEO,SAAS,qBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAEN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,4EAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,cAAA,CAAe,QAAA,EAAS,CAAE,SAAS,uBAAuB,CAAA;AAAA,QACjE,MAAA,EAAQ,eAAA,CAAgB,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9D,QAAQ,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QACzD,OAAO,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,QAAQ,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc;AAAA;AACvD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,QAAQ,MAAA,EAAQ,KAAA,EAAO,QAAO,KAAM;AAClD,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAkC,EAAE,OAAA,EAAS,YAAA,EAAa;AAChE,QAAA,IAAI,KAAA,KAAU,KAAA,CAAA,EAAW,MAAA,CAAO,KAAA,GAAQ,KAAA;AACxC,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAE1C,QAAA,MAAM,aAAsC,EAAC;AAC7C,QAAA,IAAI,KAAA,KAAU,KAAA,CAAA,EAAW,UAAA,CAAW,KAAA,GAAQ,KAAA;AAC5C,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,UAAA,CAAW,MAAA,GAAS,MAAA;AAE9C,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAElC,UAAA,EAAY;AAAA,UACb,MAAA;AAAA,UACA,YAAY,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,GAAS,IAAI,UAAA,GAAa,KAAA;AAAA,SAC/D,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,SAAS,CAAA;AAAA,MAClC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,6BAAA,EAA+B,EAAE,OAAO,CAAA;AACzD,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,qBAAqB,CAAC,CAAA;AAAA,IACzD;AAAA,MACE,KAAA,EAAO,WAAA;AAAA,MACP,WAAA,EAAa,oBAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU;AAAA;AACpC,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAuC,SAAA,EAAW;AAAA,UACrF;AAAA,SACD,CAAA;AACD,QAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,UAAA,OAAO,WAAA,CAAY,CAAA,MAAA,EAAS,EAAE,CAAA,UAAA,CAAY,CAAA;AAAA,QAC5C;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,QAAQ,CAAA;AAAA,MACjC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,4BAAA,EAA8B,EAAE,OAAO,CAAA;AACxD,QAAA,OAAO,WAAA;AAAA,UACL,wBAAwB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAChF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,wBAAwB,CAAC,CAAA;AAAA,IAC5D;AAAA,MACE,KAAA,EAAO,cAAA;AAAA,MACP,WAAA,EAAa,qDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,YAAY,CAAA;AAAA,QACtC,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mBAAmB,CAAA;AAAA,QAC/D,KAAA,EAAO,cAAA,CAAe,QAAA,EAAS,CAAE,SAAS,kCAAkC,CAAA;AAAA,QAC5E,SAAS,CAAA,CACN,MAAA,GACA,QAAA,EAAS,CACT,SAAS,qEAAqE,CAAA;AAAA,QACjF,kBAAkB,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC;AAAA;AAC5F,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,aAAa,KAAA,EAAO,OAAA,EAAS,kBAAiB,KAAM;AACjE,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,gBAAgB,KAAA,IAAS,WAAA;AAC/B,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,OAAA,EAAS,YAAA;AAAA,UACT,IAAA;AAAA,UACA,KAAA,EAAO,aAAA;AAAA,UACP,OAAA,EAAS,WAAW,YAAA,CAAa;AAAA,SACnC;AACA,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,gBAAA,KAAqB,KAAA,CAAA,EAAW,KAAA,CAAM,gBAAA,GAAmB,gBAAA;AAE7D,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAmC,YAAA,EAAc;AAAA,UACpF;AAAA,SACD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,WAAW,CAAA;AAAA,MACpC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,+BAAA,EAAiC,EAAE,OAAO,CAAA;AAC3D,QAAA,OAAO,WAAA;AAAA,UACL,2BAA2B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACnF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,wBAAwB,CAAC,CAAA;AAAA,IAC5D;AAAA,MACE,KAAA,EAAO,cAAA;AAAA,MACP,WAAA,EACE,mFAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU,CAAA;AAAA,QAClC,SAAS,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,gCAAgC;AAAA;AAC3E,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAQ,KAAM;AACzB,MAAA,IAAI;AACF,QAAA,IAAI,YAAY,IAAA,EAAM;AACpB,UAAA,MAAMA,KAAAA,GAAO,MAAM,GAAA,CAAI,GAAA,CAAI,UAAU,OAAA,CAElC,aAAA,EAAe,EAAE,EAAA,EAAI,CAAA;AACxB,UAAA,OAAO,WAAW,EAAE,QAAA,EAAU,MAAM,KAAA,EAAOA,KAAAA,CAAK,cAAc,CAAA;AAAA,QAChE;AACA,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAkC,YAAA,EAAc;AAAA,UACnF;AAAA,SACD,CAAA;AACD,QAAA,OAAO,WAAW,EAAE,OAAA,EAAS,KAAK,WAAA,EAAa,OAAA,EAAS,IAAI,CAAA;AAAA,MAC9D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,+BAAA,EAAiC,EAAE,OAAO,CAAA;AAC3D,QAAA,OAAO,WAAA;AAAA,UACL,2BAA2B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACnF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,cAAA;AAAA,MACP,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU,CAAA;AAAA,QACvC,IAAA,EAAM,cAAA,CAAe,QAAA,EAAS,CAAE,SAAS,uBAAuB,CAAA;AAAA,QAChE,QAAQ,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QACzD,OAAO,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yBAAyB,CAAA;AAAA,QAC/D,QAAQ,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc;AAAA;AACvD,KACF;AAAA,IACA,OAAO,EAAE,OAAA,EAAS,MAAM,MAAA,EAAQ,KAAA,EAAO,QAAO,KAAM;AAClD,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAkC,EAAE,OAAA,EAAS,YAAA,EAAa;AAChE,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,MAAA,CAAO,IAAA,GAAO,IAAA;AACtC,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAE1C,QAAA,MAAM,aAAsC,EAAC;AAC7C,QAAA,IAAI,KAAA,KAAU,KAAA,CAAA,EAAW,UAAA,CAAW,KAAA,GAAQ,KAAA;AAC5C,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,UAAA,CAAW,MAAA,GAAS,MAAA;AAE9C,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAElC,WAAA,EAAa;AAAA,UACd,OAAA;AAAA,UACA,MAAA;AAAA,UACA,YAAY,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,GAAS,IAAI,UAAA,GAAa,KAAA;AAAA,SAC/D,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,8BAAA,EAAgC,EAAE,OAAO,CAAA;AAC1D,QAAA,OAAO,WAAA;AAAA,UACL,2BAA2B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACnF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,kGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW;AAAA;AACrC,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAyC,UAAA,EAAY;AAAA,UACxF;AAAA,SACD,CAAA;AACD,QAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,UAAA,OAAO,WAAA,CAAY,CAAA,OAAA,EAAU,EAAE,CAAA,UAAA,CAAY,CAAA;AAAA,QAC7C;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,SAAS,CAAA;AAAA,MAClC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,6BAAA,EAA+B,EAAE,OAAO,CAAA;AACzD,QAAA,OAAO,WAAA;AAAA,UACL,yBAAyB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACjF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,iIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW;AAAA;AACrC,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,GAAA,CAAI,UAAU,OAAA,CAElC,cAAA,EAAgB,EAAE,EAAA,EAAI,CAAA;AACzB,QAAA,OAAO,UAAA,CAAW,KAAK,aAAa,CAAA;AAAA,MACtC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EAAa,qEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU,CAAA;AAAA,QACvC,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,QAC/D,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,4BAA4B,CAAA;AAAA,QACtD,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,8CAA8C,CAAA;AAAA,QACzE,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAChE,IAAA,EAAM,cAAA,CAAe,QAAA,EAAS,CAAE,SAAS,8BAA8B,CAAA;AAAA,QACvE,aAAa,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,mBAAmB,CAAA;AAAA,QAChE,WAAW,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,8BAA8B;AAAA;AAC1E,KACF;AAAA,IACA,OAAO,EAAE,OAAA,EAAS,GAAA,EAAK,IAAA,EAAM,OAAO,WAAA,EAAa,IAAA,EAAM,WAAA,EAAa,SAAA,EAAU,KAAM;AAClF,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,OAAA,EAAS,YAAA;AAAA,UACT,OAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA;AAAA,UACA,KAAA;AAAA,UACA,MAAM,IAAA,IAAQ,OAAA;AAAA,UACd,aAAa,WAAA,KAAgB;AAAA,SAC/B;AACA,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAE/C,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAqC,aAAA,EAAe;AAAA,UACvF;AAAA,SACD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,YAAY,CAAA;AAAA,MACrC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,6BAAA,EAA+B,EAAE,OAAO,CAAA;AACzD,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,uGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACnC,MAAM,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc,CAAA;AAAA,QACnD,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QACjE,MAAA,EAAQ,gBAAA,CAAiB,QAAA,EAAS,CAAE,SAAS,gBAAgB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,QAAO,KAAM;AAC3C,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,GAAe,qBAAqB,GAAG,CAAA;AAC7C,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC,EAAE,OAAA,EAAS,YAAA,EAAa;AAC/D,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,sBAAsB,CAAA;AAAA,QAC3C;AACA,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAqC,aAAA,EAAe;AAAA,UACvF,EAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,YAAY,CAAA;AAAA,MACrC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EAAa,oDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACnC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB;AAAA;AAClD,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,QAAA,EAAS,KAAM;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAqC,aAAA,EAAe;AAAA,UACvF,EAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,YAAY,CAAA;AAAA,MACrC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EAAa,wBAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW;AAAA;AACrC,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,SAAA,CAAU,QAAmC,aAAA,EAAe;AAAA,UACrF;AAAA,SACD,CAAA;AACD,QAAA,OAAO,WAAW,EAAE,OAAA,EAAS,KAAK,YAAA,EAAc,QAAA,EAAU,IAAI,CAAA;AAAA,MAChE,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACtbA,IAAM,cAAA,GAA4B;AAAA,EAChC,EAAA,EAAI,UAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,UAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,qBAAA,CAAsB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAExC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,gBAAA,GAAQ","file":"index.js","sourcesContent":["export const GET_VAULTS = `\n  query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {\n    getVaults(filter: $filter, pagination: $pagination) {\n      items { id name description scope status createdAt }\n      total hasMore\n    }\n  }\n`;\n\nexport const GET_VAULT = `\n  query GetVault($id: ID!) {\n    getVault(id: $id) {\n      id name description scope scopeId status lockAfterMinutes createdAt updatedAt\n    }\n  }\n`;\n\nexport const CREATE_VAULT = `\n  mutation CreateVault($input: CreateVaultInput!) {\n    createVault(input: $input) {\n      id name scope scopeId status\n    }\n  }\n`;\n\nexport const DELETE_VAULT = `\n  mutation DeleteVault($id: ID!) {\n    deleteVault(id: $id)\n  }\n`;\n\nexport const ARCHIVE_VAULT = `\n  mutation ArchiveVault($id: ID!) {\n    archiveVault(id: $id) { id status }\n  }\n`;\n\nexport const GET_SECRETS = `\n  query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {\n    getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {\n      items { id key name description type status isEphemeral createdAt }\n      total hasMore\n    }\n  }\n`;\n\nexport const GET_SECRET = `\n  query GetSecret($id: ID!) {\n    getSecret(id: $id) {\n      id key name description type status isEphemeral expiresAt createdAt updatedAt\n    }\n  }\n`;\n\nexport const DECRYPT_SECRET = `\n  query DecryptSecret($id: ID!) {\n    decryptSecret(id: $id) {\n      id key value\n    }\n  }\n`;\n\nexport const CREATE_SECRET = `\n  mutation CreateSecret($input: CreateSecretInput!) {\n    createSecret(input: $input) {\n      id key name type status\n    }\n  }\n`;\n\nexport const UPDATE_SECRET = `\n  mutation UpdateSecret($id: ID!, $input: UpdateSecretInput!) {\n    updateSecret(id: $id, input: $input) {\n      id key name status updatedAt\n    }\n  }\n`;\n\nexport const DELETE_SECRET = `\n  mutation DeleteSecret($id: ID!) {\n    deleteSecret(id: $id)\n  }\n`;\n\nexport const ROTATE_SECRET = `\n  mutation RotateSecret($id: ID!, $newValue: String!) {\n    rotateSecret(id: $id, newValue: $newValue) {\n      id key updatedAt\n    }\n  }\n`;\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport {\n  GET_VAULTS,\n  GET_VAULT,\n  CREATE_VAULT,\n  DELETE_VAULT,\n  ARCHIVE_VAULT,\n  GET_SECRETS,\n  GET_SECRET,\n  DECRYPT_SECRET,\n  CREATE_SECRET,\n  UPDATE_SECRET,\n  DELETE_SECRET,\n  ROTATE_SECRET,\n} from './operations.js';\n\nconst VaultScopeEnum = z.enum(['WORKSPACE', 'GLOBAL', 'VIBE']);\nconst VaultStatusEnum = z.enum(['ACTIVE', 'LOCKED', 'ARCHIVED']);\nconst SecretTypeEnum = z.enum(['API_KEY', 'PASSWORD', 'CERTIFICATE', 'TOKEN', 'OTHER']);\nconst SecretStatusEnum = z.enum(['ACTIVE', 'EXPIRED', 'REVOKED']);\n\ninterface VaultRow {\n  id: string;\n  name: string;\n  description?: string | null;\n  scope?: string;\n  scopeId?: string;\n  status?: string;\n  createdAt?: string;\n  updatedAt?: string;\n  lockAfterMinutes?: number;\n}\n\ninterface SecretRow {\n  id: string;\n  key: string;\n  name: string;\n  description?: string | null;\n  type?: string;\n  status?: string;\n  isEphemeral?: boolean;\n  expiresAt?: string;\n  createdAt?: string;\n  updatedAt?: string;\n}\n\nfunction readWorkspaceContext(ctx: McpContext): { workspaceId: string } | null {\n  const auth = ctx.auth.read();\n  if (!auth?.workspaceId) return null;\n  return { workspaceId: auth.workspaceId };\n}\n\nexport function registerSecurityTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  // ── Vaults ─────────────────────────────────────────────────────────────\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_vaults_list')),\n    {\n      title: 'List Vaults',\n      description: 'List vaults in the current workspace with optional filters and pagination.',\n      inputSchema: {\n        scope: VaultScopeEnum.optional().describe('Filter by vault scope'),\n        status: VaultStatusEnum.optional().describe('Filter by status'),\n        search: z.string().optional().describe('Free-text search'),\n        limit: z.number().optional().describe('Page size (default 50)'),\n        offset: z.number().optional().describe('Skip results'),\n      },\n    },\n    async ({ scope, status, search, limit, offset }) => {\n      try {\n        const workspaceCtx = readWorkspaceContext(ctx);\n        if (!workspaceCtx) {\n          return errorResult(\n            'No active workspace. Bind a workspace via the auth login flow first.',\n          );\n        }\n        const filter: Record<string, unknown> = { context: workspaceCtx };\n        if (scope !== undefined) filter.scope = scope;\n        if (status !== undefined) filter.status = status;\n        if (search !== undefined) filter.search = search;\n\n        const pagination: Record<string, unknown> = {};\n        if (limit !== undefined) pagination.limit = limit;\n        if (offset !== undefined) pagination.offset = offset;\n\n        const data = await ctx.gql.workspace.request<{\n          getVaults: { items: VaultRow[]; total: number; hasMore: boolean };\n        }>(GET_VAULTS, {\n          filter,\n          pagination: Object.keys(pagination).length > 0 ? pagination : undefined,\n        });\n        return jsonResult(data.getVaults);\n      } catch (error) {\n        ctx.logger.error('security_vaults_list failed', { error });\n        return errorResult(\n          `Failed to list vaults: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_vaults_get')),\n    {\n      title: 'Get Vault',\n      description: 'Get a vault by ID.',\n      inputSchema: {\n        id: z.string().describe('Vault ID'),\n      },\n    },\n    async ({ id }) => {\n      try {\n        const data = await ctx.gql.workspace.request<{ getVault: VaultRow | null }>(GET_VAULT, {\n          id,\n        });\n        if (!data.getVault) {\n          return errorResult(`Vault ${id} not found`);\n        }\n        return jsonResult(data.getVault);\n      } catch (error) {\n        ctx.logger.error('security_vaults_get failed', { error });\n        return errorResult(\n          `Failed to get vault: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_vaults_create')),\n    {\n      title: 'Create Vault',\n      description: 'Create a new vault scoped to the current workspace.',\n      inputSchema: {\n        name: z.string().describe('Vault name'),\n        description: z.string().optional().describe('Vault description'),\n        scope: VaultScopeEnum.optional().describe('Vault scope (default: WORKSPACE)'),\n        scopeId: z\n          .string()\n          .optional()\n          .describe('Scope ID (defaults to current workspace ID when scope is WORKSPACE)'),\n        lockAfterMinutes: z.number().optional().describe('Auto-lock after N minutes of inactivity'),\n      },\n    },\n    async ({ name, description, scope, scopeId, lockAfterMinutes }) => {\n      try {\n        const workspaceCtx = readWorkspaceContext(ctx);\n        if (!workspaceCtx) {\n          return errorResult(\n            'No active workspace. Bind a workspace via the auth login flow first.',\n          );\n        }\n        const resolvedScope = scope ?? 'WORKSPACE';\n        const input: Record<string, unknown> = {\n          context: workspaceCtx,\n          name,\n          scope: resolvedScope,\n          scopeId: scopeId ?? workspaceCtx.workspaceId,\n        };\n        if (description !== undefined) input.description = description;\n        if (lockAfterMinutes !== undefined) input.lockAfterMinutes = lockAfterMinutes;\n\n        const data = await ctx.gql.workspace.request<{ createVault: VaultRow }>(CREATE_VAULT, {\n          input,\n        });\n        return jsonResult(data.createVault);\n      } catch (error) {\n        ctx.logger.error('security_vaults_create failed', { error });\n        return errorResult(\n          `Failed to create vault: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_vaults_delete')),\n    {\n      title: 'Delete Vault',\n      description:\n        'Delete a vault. Set archive=true to soft-archive instead of permanently deleting.',\n      inputSchema: {\n        id: z.string().describe('Vault ID'),\n        archive: z.boolean().optional().describe('Archive instead of hard delete'),\n      },\n    },\n    async ({ id, archive }) => {\n      try {\n        if (archive === true) {\n          const data = await ctx.gql.workspace.request<{\n            archiveVault: { id: string; status: string };\n          }>(ARCHIVE_VAULT, { id });\n          return jsonResult({ archived: true, vault: data.archiveVault });\n        }\n        const data = await ctx.gql.workspace.request<{ deleteVault: boolean }>(DELETE_VAULT, {\n          id,\n        });\n        return jsonResult({ deleted: data.deleteVault, vaultId: id });\n      } catch (error) {\n        ctx.logger.error('security_vaults_delete failed', { error });\n        return errorResult(\n          `Failed to delete vault: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  // ── Secrets ────────────────────────────────────────────────────────────\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_list')),\n    {\n      title: 'List Secrets',\n      description: 'List secrets in a vault with optional filters and pagination.',\n      inputSchema: {\n        vaultId: z.string().describe('Vault ID'),\n        type: SecretTypeEnum.optional().describe('Filter by secret type'),\n        search: z.string().optional().describe('Free-text search'),\n        limit: z.number().optional().describe('Page size (default 100)'),\n        offset: z.number().optional().describe('Skip results'),\n      },\n    },\n    async ({ vaultId, type, search, limit, offset }) => {\n      try {\n        const workspaceCtx = readWorkspaceContext(ctx);\n        if (!workspaceCtx) {\n          return errorResult(\n            'No active workspace. Bind a workspace via the auth login flow first.',\n          );\n        }\n        const filter: Record<string, unknown> = { context: workspaceCtx };\n        if (type !== undefined) filter.type = type;\n        if (search !== undefined) filter.search = search;\n\n        const pagination: Record<string, unknown> = {};\n        if (limit !== undefined) pagination.limit = limit;\n        if (offset !== undefined) pagination.offset = offset;\n\n        const data = await ctx.gql.workspace.request<{\n          getSecrets: { items: SecretRow[]; total: number; hasMore: boolean };\n        }>(GET_SECRETS, {\n          vaultId,\n          filter,\n          pagination: Object.keys(pagination).length > 0 ? pagination : undefined,\n        });\n        return jsonResult(data.getSecrets);\n      } catch (error) {\n        ctx.logger.error('security_secrets_list failed', { error });\n        return errorResult(\n          `Failed to list secrets: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_get')),\n    {\n      title: 'Get Secret Metadata',\n      description:\n        \"Get a secret's metadata. Does NOT decrypt the value — use security_secrets_reveal for that.\",\n      inputSchema: {\n        id: z.string().describe('Secret ID'),\n      },\n    },\n    async ({ id }) => {\n      try {\n        const data = await ctx.gql.workspace.request<{ getSecret: SecretRow | null }>(GET_SECRET, {\n          id,\n        });\n        if (!data.getSecret) {\n          return errorResult(`Secret ${id} not found`);\n        }\n        return jsonResult(data.getSecret);\n      } catch (error) {\n        ctx.logger.error('security_secrets_get failed', { error });\n        return errorResult(\n          `Failed to get secret: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_reveal')),\n    {\n      title: 'Reveal Secret Value',\n      description:\n        'Decrypt and return the secret value. This action is audited server-side. Treat the result as sensitive and avoid persisting it.',\n      inputSchema: {\n        id: z.string().describe('Secret ID'),\n      },\n    },\n    async ({ id }) => {\n      try {\n        const data = await ctx.gql.workspace.request<{\n          decryptSecret: { id: string; key: string; value: string };\n        }>(DECRYPT_SECRET, { id });\n        return jsonResult(data.decryptSecret);\n      } catch (error) {\n        ctx.logger.error('security_secrets_reveal failed', { error });\n        return errorResult(\n          `Failed to reveal secret: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_set')),\n    {\n      title: 'Create Secret',\n      description: 'Create a new secret in a vault. The value is encrypted server-side.',\n      inputSchema: {\n        vaultId: z.string().describe('Vault ID'),\n        key: z.string().describe('Secret key (unique within the vault)'),\n        name: z.string().describe('Human-readable secret name'),\n        value: z.string().describe('Secret value (will be encrypted server-side)'),\n        description: z.string().optional().describe('Secret description'),\n        type: SecretTypeEnum.optional().describe('Secret type (default: OTHER)'),\n        isEphemeral: z.boolean().optional().describe('Mark as ephemeral'),\n        expiresAt: z.string().optional().describe('Expiry timestamp in ISO 8601'),\n      },\n    },\n    async ({ vaultId, key, name, value, description, type, isEphemeral, expiresAt }) => {\n      try {\n        const workspaceCtx = readWorkspaceContext(ctx);\n        if (!workspaceCtx) {\n          return errorResult(\n            'No active workspace. Bind a workspace via the auth login flow first.',\n          );\n        }\n        const input: Record<string, unknown> = {\n          context: workspaceCtx,\n          vaultId,\n          key,\n          name,\n          value,\n          type: type ?? 'OTHER',\n          isEphemeral: isEphemeral === true,\n        };\n        if (description !== undefined) input.description = description;\n        if (expiresAt !== undefined) input.expiresAt = expiresAt;\n\n        const data = await ctx.gql.workspace.request<{ createSecret: SecretRow }>(CREATE_SECRET, {\n          input,\n        });\n        return jsonResult(data.createSecret);\n      } catch (error) {\n        ctx.logger.error('security_secrets_set failed', { error });\n        return errorResult(\n          `Failed to create secret: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_update')),\n    {\n      title: 'Update Secret Metadata',\n      description:\n        'Update secret metadata (name, description, status). To rotate the value, use security_secrets_rotate.',\n      inputSchema: {\n        id: z.string().describe('Secret ID'),\n        name: z.string().optional().describe('Updated name'),\n        description: z.string().optional().describe('Updated description'),\n        status: SecretStatusEnum.optional().describe('Updated status'),\n      },\n    },\n    async ({ id, name, description, status }) => {\n      try {\n        const workspaceCtx = readWorkspaceContext(ctx);\n        if (!workspaceCtx) {\n          return errorResult(\n            'No active workspace. Bind a workspace via the auth login flow first.',\n          );\n        }\n        const input: Record<string, unknown> = { context: workspaceCtx };\n        if (name !== undefined) input.name = name;\n        if (description !== undefined) input.description = description;\n        if (status !== undefined) input.status = status;\n        if (Object.keys(input).length === 1) {\n          return errorResult('No updates specified');\n        }\n        const data = await ctx.gql.workspace.request<{ updateSecret: SecretRow }>(UPDATE_SECRET, {\n          id,\n          input,\n        });\n        return jsonResult(data.updateSecret);\n      } catch (error) {\n        ctx.logger.error('security_secrets_update failed', { error });\n        return errorResult(\n          `Failed to update secret: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_rotate')),\n    {\n      title: 'Rotate Secret Value',\n      description: \"Replace a secret's encrypted value with a new one.\",\n      inputSchema: {\n        id: z.string().describe('Secret ID'),\n        newValue: z.string().describe('New secret value'),\n      },\n    },\n    async ({ id, newValue }) => {\n      try {\n        const data = await ctx.gql.workspace.request<{ rotateSecret: SecretRow }>(ROTATE_SECRET, {\n          id,\n          newValue,\n        });\n        return jsonResult(data.rotateSecret);\n      } catch (error) {\n        ctx.logger.error('security_secrets_rotate failed', { error });\n        return errorResult(\n          `Failed to rotate secret: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'security_secrets_delete')),\n    {\n      title: 'Delete Secret',\n      description: 'Delete a secret by ID.',\n      inputSchema: {\n        id: z.string().describe('Secret ID'),\n      },\n    },\n    async ({ id }) => {\n      try {\n        const data = await ctx.gql.workspace.request<{ deleteSecret: boolean }>(DELETE_SECRET, {\n          id,\n        });\n        return jsonResult({ deleted: data.deleteSecret, secretId: id });\n      } catch (error) {\n        ctx.logger.error('security_secrets_delete failed', { error });\n        return errorResult(\n          `Failed to delete secret: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n}\n","/**\n * Security module — workspace vaults & secrets\n * (<product>_security_vaults_{list,get,create,delete},\n *  <product>_security_secrets_{list,get,reveal,set,update,rotate,delete}).\n *\n * Backend: ~/products/wspace/security/wspace-security-svc/.\n * Ported from cli-sdk/src/modules/security/. The CLI reads secret values from\n * stdin; in MCP they come in as the `value` / `newValue` tool arguments.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerSecurityTools } from './tools.js';\n\nconst securityModule: McpModule = {\n  id: 'security',\n  version: '0.0.1',\n  displayName: 'Security',\n  dependsOn: ['auth'],\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerSecurityTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default securityModule;\n"]}