@creezio/mcp-facade 0.22.0

package/dist/admin/mcp-admin.d.ts

@@ -0,0 +1,165 @@
+import type { McpToolDefinition } from "./types.js";
+export type { McpToolDefinition } from "./types.js";
+export declare function ensureMcpAdminSchema(): void;
+/**
+ * Seed permissif (INSERT OR IGNORE) de policies pour des tools hors registre
+ * adapters — ex. tools de `facade.listTools()` quand la garde M2 est activée
+ * sur une façade marque. Ne modifie JAMAIS une policy existante.
+ */
+export declare function seedMcpToolPolicies(tools: Array<Pick<McpToolDefinition, "name"> & Partial<Pick<McpToolDefinition, "requiredScope" | "defaultRoles" | "mcpPublishDefault">>>): void;
+export type McpToolPolicy = McpToolDefinition & {
+    enabled: boolean;
+    allowedRoles: string[];
+    allowedScopes: string[];
+    updatedAt: string | null;
+};
+export declare function listMcpToolPolicies(): McpToolPolicy[];
+export declare function getMcpToolPolicy(name: string): McpToolPolicy | null;
+/**
+ * Noms désactivés PAR L'ADMIN (`enabled=0` ET `admin_override=1`).
+ *
+ * Les lignes `enabled=0` seedées par défaut (`mcpPublishDefault=false` —
+ * ex. toute op module sans opt-in publish, cf.
+ * `generateModuleToolsFromOperations`) ne comptent PAS : elles signifient
+ * « non publié par défaut aux clients MCP externes », pas « désactivé » —
+ * les masquer vidait `listTools`/`GET /mcp` des tools métier (régression
+ * 0.17.1, vue par les gates module des marques). Admin non câblé / erreur
+ * DB → ensemble vide (pas de filtre).
+ */
+export declare function disabledMcpToolPolicyNames(): Set<string>;
+/** Retire de `listTools` les tools (et alias) désactivés en admin MCP. */
+export declare function filterListedToolsByEnabledPolicy<T extends {
+    name: string;
+    aliasOf?: string;
+}>(tools: T[], aliases?: Record<string, string>): T[];
+export declare function updateMcpToolPolicy(name: string, input: {
+    enabled?: boolean;
+    allowedRoles?: string[];
+    allowedScopes?: string[];
+}): McpToolPolicy | null;
+export type McpAdminClient = {
+    client_id: string;
+    client_name: string | null;
+    redirect_uris: string[];
+    token_endpoint_auth_method: string;
+    scope: string | null;
+    created_at: string;
+    enabled: boolean;
+    revoked_at: string | null;
+    last_used_at: string | null;
+    active_refresh_tokens: number;
+};
+export declare function listMcpClients(): McpAdminClient[];
+export declare function setMcpClientEnabled(clientId: string, enabled: boolean): boolean;
+export declare function revokeMcpClient(clientId: string): boolean;
+export declare function rotateMcpClientSecret(clientId: string): {
+    clientSecret: string;
+} | null;
+export declare function clientCanAuthenticate(clientId: string): boolean;
+export declare function touchMcpClient(clientId: string): void;
+export declare function mcpAdminStatus(): {
+    ready: boolean;
+    publicUrl: string | null;
+    mcpUrl: string | null;
+    oauthReady: boolean;
+    jwtConfigured: boolean;
+    toolCount: number;
+    enabledToolCount: number;
+    clientCount: number;
+    enabledClientCount: number;
+};
+export declare function mcpDiagnostics(): {
+    status: {
+        ready: boolean;
+        publicUrl: string | null;
+        mcpUrl: string | null;
+        oauthReady: boolean;
+        jwtConfigured: boolean;
+        toolCount: number;
+        enabledToolCount: number;
+        clientCount: number;
+        enabledClientCount: number;
+    };
+    checks: {
+        id: string;
+        ok: boolean;
+        message: string;
+    }[];
+    healthy: boolean;
+};
+export declare function mcpMetrics(): {
+    window: string;
+    requests: number;
+    errors: number;
+    errorRate: number;
+    averageDurationMs: number;
+    p95DurationMs: number | undefined;
+    byTool: {
+        [k: string]: number;
+    };
+};
+export declare function auditMcpAdmin(event: string, options?: {
+    actor?: string | null;
+    clientId?: string | null;
+    toolName?: string | null;
+    outcome?: string;
+    detail?: unknown;
+}): void;
+export declare function listMcpAuditLogs(limit?: number): unknown[];
+export declare function pruneMcpAuditLogs(retentionDays?: number): number;
+export declare function exportMcpDiagnostics(): {
+    generatedAt: string;
+    diagnostics: {
+        status: {
+            ready: boolean;
+            publicUrl: string | null;
+            mcpUrl: string | null;
+            oauthReady: boolean;
+            jwtConfigured: boolean;
+            toolCount: number;
+            enabledToolCount: number;
+            clientCount: number;
+            enabledClientCount: number;
+        };
+        checks: {
+            id: string;
+            ok: boolean;
+            message: string;
+        }[];
+        healthy: boolean;
+    };
+    metrics: {
+        window: string;
+        requests: number;
+        errors: number;
+        errorRate: number;
+        averageDurationMs: number;
+        p95DurationMs: number | undefined;
+        byTool: {
+            [k: string]: number;
+        };
+    };
+    tools: {
+        name: string;
+        enabled: boolean;
+        requiredScope: string;
+        allowedRoles: string[];
+        allowedScopes: string[];
+    }[];
+    clients: {
+        idPrefix: string;
+        name: string | null;
+        redirectHosts: string[];
+        scope: string | null;
+        enabled: boolean;
+        revoked: boolean;
+        lastUsedAt: string | null;
+    }[];
+    auditRetentionDays: number;
+    configuration: {
+        corsConfigured: boolean;
+        publicUrlConfigured: boolean;
+        jwtConfigured: boolean;
+    };
+};
+//# sourceMappingURL=mcp-admin.d.ts.map

package/dist/admin/mcp-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-admin.d.ts","sourceRoot":"","sources":["../../src/admin/mcp-admin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAqDpD,wBAAgB,oBAAoB,IAAI,IAAI,CA8D3C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,KAAK,CACV,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAC7B,OAAO,CACL,IAAI,CACF,iBAAiB,EACjB,eAAe,GAAG,cAAc,GAAG,mBAAmB,CACvD,CACF,CACJ,GACA,IAAI,CAkBN;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,aAAa,EAAE,CA4BrD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAEnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,GAAG,CAAC,MAAM,CAAC,CAaxD;AAED,0EAA0E;AAC1E,wBAAgB,gCAAgC,CAC9C,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5C,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,CAAC,EAAE,CAYvD;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9E,aAAa,GAAG,IAAI,CAmCtB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0BAA0B,EAAE,MAAM,CAAC;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAgB,cAAc,IAAI,cAAc,EAAE,CAyBjD;AAWD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAU/E;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GACf;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBjC;AAYD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAKrD;AAED,wBAAgB,cAAc;;;;;;;;;;EAe7B;AAED,wBAAgB,cAAc;;;;;;;;;;;;;;;;;;EAS7B;AAED,wBAAgB,UAAU;;;;;;;;;;EAsBzB;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CACb,GACL,IAAI,CAgBN;AAED,wBAAgB,gBAAgB,CAAC,KAAK,SAAM,aAQ3C;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,SAAqD,GACjE,MAAM,CAQR;AAED,wBAAgB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCnC"}

package/dist/admin/mcp-admin.js

@@ -0,0 +1,419 @@
+import { createHash, randomBytes } from "node:crypto";
+import { getMcpAdminAdapters } from "./adapters.js";
+function getDb() {
+    return getMcpAdminAdapters().getDb();
+}
+function getWriteDb() {
+    return getMcpAdminAdapters().getWriteDb();
+}
+function tableExists(name) {
+    return getMcpAdminAdapters().tableExists(name);
+}
+function MCP_TOOL_REGISTRY() {
+    return getMcpAdminAdapters().listTools();
+}
+function mcpOauthReady() {
+    return getMcpAdminAdapters().mcpOauthReady();
+}
+function resolveMcpPublicUrl() {
+    return getMcpAdminAdapters().resolveMcpPublicUrl();
+}
+function listRequestLogs(opts) {
+    const fn = getMcpAdminAdapters().listRequestLogs;
+    return fn ? fn(opts) : { logs: [] };
+}
+let schemaEnsured = false;
+/** Rôles acceptés dans les policies (adapters, défaut historique). */
+function policyRoleNames() {
+    return getMcpAdminAdapters().policyRoleNames || ["owner", "collaborator"];
+}
+/** Scopes acceptés dans les policies (adapters, défaut historique). */
+function policyScopeNames() {
+    return (getMcpAdminAdapters().policyScopeNames || [
+        "crm",
+        "crm:read",
+        "crm:write",
+        "full",
+    ]);
+}
+function hasColumn(table, column) {
+    if (!tableExists(table))
+        return false;
+    return getDb()
+        .prepare(`PRAGMA table_info("${table.replaceAll('"', '""')}")`)
+        .all().some((item) => item.name === column);
+}
+export function ensureMcpAdminSchema() {
+    if (schemaEnsured)
+        return;
+    const db = getWriteDb();
+    if (tableExists("mcp_oauth_clients")) {
+        if (!hasColumn("mcp_oauth_clients", "enabled")) {
+            db.exec(`ALTER TABLE mcp_oauth_clients ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1`);
+        }
+        if (!hasColumn("mcp_oauth_clients", "revoked_at")) {
+            db.exec(`ALTER TABLE mcp_oauth_clients ADD COLUMN revoked_at TEXT`);
+        }
+        if (!hasColumn("mcp_oauth_clients", "last_used_at")) {
+            db.exec(`ALTER TABLE mcp_oauth_clients ADD COLUMN last_used_at TEXT`);
+        }
+    }
+    if (tableExists("mcp_tool_policies") &&
+        !hasColumn("mcp_tool_policies", "admin_override")) {
+        db.exec(`ALTER TABLE mcp_tool_policies ADD COLUMN admin_override INTEGER NOT NULL DEFAULT 0`);
+    }
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS mcp_tool_policies (
+      tool_name TEXT PRIMARY KEY,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      allowed_roles TEXT NOT NULL DEFAULT 'owner,collaborator',
+      allowed_scopes TEXT NOT NULL DEFAULT '',
+      -- 1 si l'admin a explicitement fixé enabled (updateMcpToolPolicy) —
+      -- distingue une désactivation admin du seed par défaut
+      -- (mcpPublishDefault=false → enabled=0 « non publié par défaut »).
+      admin_override INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE TABLE IF NOT EXISTS mcp_audit_logs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      event TEXT NOT NULL,
+      actor TEXT,
+      client_id TEXT,
+      tool_name TEXT,
+      outcome TEXT NOT NULL DEFAULT 'ok',
+      detail_json TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_mcp_audit_created ON mcp_audit_logs(created_at);
+  `);
+    const insert = db.prepare(`INSERT OR IGNORE INTO mcp_tool_policies
+       (tool_name, enabled, allowed_roles, allowed_scopes)
+     VALUES (?, ?, ?, ?)`);
+    const seedFn = () => {
+        for (const tool of MCP_TOOL_REGISTRY()) {
+            const roles = (tool.defaultRoles || policyRoleNames()).join(",");
+            const enabled = tool.mcpPublishDefault === false ? 0 : 1;
+            insert.run(tool.name, enabled, roles, tool.requiredScope);
+        }
+    };
+    if (db.transaction)
+        db.transaction(seedFn)();
+    else
+        seedFn();
+    pruneMcpAuditLogs();
+    schemaEnsured = true;
+}
+/**
+ * Seed permissif (INSERT OR IGNORE) de policies pour des tools hors registre
+ * adapters — ex. tools de `facade.listTools()` quand la garde M2 est activée
+ * sur une façade marque. Ne modifie JAMAIS une policy existante.
+ */
+export function seedMcpToolPolicies(tools) {
+    ensureMcpAdminSchema();
+    const db = getWriteDb();
+    const insert = db.prepare(`INSERT OR IGNORE INTO mcp_tool_policies
+       (tool_name, enabled, allowed_roles, allowed_scopes)
+     VALUES (?, ?, ?, ?)`);
+    const run = () => {
+        for (const tool of tools) {
+            if (!tool?.name)
+                continue;
+            const roles = (tool.defaultRoles || policyRoleNames()).join(",");
+            const enabled = tool.mcpPublishDefault === false ? 0 : 1;
+            insert.run(tool.name, enabled, roles, tool.requiredScope || "");
+        }
+    };
+    if (db.transaction)
+        db.transaction(run)();
+    else
+        run();
+}
+export function listMcpToolPolicies() {
+    ensureMcpAdminSchema();
+    const rows = getDb()
+        .prepare(`SELECT tool_name, enabled, allowed_roles, allowed_scopes, updated_at
+       FROM mcp_tool_policies`)
+        .all();
+    const policy = new Map(rows.map((row) => [row.tool_name, row]));
+    return MCP_TOOL_REGISTRY().map((tool) => {
+        const row = policy.get(tool.name);
+        const defaultEnabled = tool.mcpPublishDefault !== false;
+        return {
+            ...tool,
+            enabled: row ? row.enabled !== 0 : defaultEnabled,
+            allowedRoles: (row?.allowed_roles || policyRoleNames().join(","))
+                .split(",")
+                .filter(Boolean),
+            allowedScopes: (row?.allowed_scopes || tool.requiredScope).split(/[\s,]+/).filter(Boolean),
+            updatedAt: row?.updated_at || null,
+        };
+    });
+}
+export function getMcpToolPolicy(name) {
+    return listMcpToolPolicies().find((tool) => tool.name === name) || null;
+}
+/**
+ * Noms désactivés PAR L'ADMIN (`enabled=0` ET `admin_override=1`).
+ *
+ * Les lignes `enabled=0` seedées par défaut (`mcpPublishDefault=false` —
+ * ex. toute op module sans opt-in publish, cf.
+ * `generateModuleToolsFromOperations`) ne comptent PAS : elles signifient
+ * « non publié par défaut aux clients MCP externes », pas « désactivé » —
+ * les masquer vidait `listTools`/`GET /mcp` des tools métier (régression
+ * 0.17.1, vue par les gates module des marques). Admin non câblé / erreur
+ * DB → ensemble vide (pas de filtre).
+ */
+export function disabledMcpToolPolicyNames() {
+    try {
+        ensureMcpAdminSchema();
+        const rows = getDb()
+            .prepare(`SELECT tool_name FROM mcp_tool_policies
+         WHERE enabled = 0 AND admin_override = 1`)
+            .all();
+        return new Set(rows.map((row) => row.tool_name));
+    }
+    catch {
+        return new Set();
+    }
+}
+/** Retire de `listTools` les tools (et alias) désactivés en admin MCP. */
+export function filterListedToolsByEnabledPolicy(tools, aliases = {}) {
+    const disabled = disabledMcpToolPolicyNames();
+    if (disabled.size === 0)
+        return tools;
+    for (const [alias, canonical] of Object.entries(aliases)) {
+        if (disabled.has(alias))
+            disabled.add(canonical);
+        if (disabled.has(canonical))
+            disabled.add(alias);
+    }
+    return tools.filter((tool) => !disabled.has(tool.name) &&
+        !(tool.aliasOf && disabled.has(tool.aliasOf)));
+}
+export function updateMcpToolPolicy(name, input) {
+    ensureMcpAdminSchema();
+    if (!MCP_TOOL_REGISTRY().some((tool) => tool.name === name))
+        return null;
+    const current = getMcpToolPolicy(name);
+    // Rôles/scopes acceptés : injectés par la marque via les adapters
+    // (défauts = comportement historique TempoFlow, zéro breaking change).
+    const roles = (input.allowedRoles || current.allowedRoles).filter((role) => policyRoleNames().includes(role));
+    const scopes = (input.allowedScopes || current.allowedScopes).filter((scope) => policyScopeNames().includes(scope));
+    // `admin_override` ne se pose QUE sur une action explicite sur `enabled`
+    // (une édition rôles/scopes ne requalifie pas un seed par défaut en
+    // désactivation admin) — consommé par disabledMcpToolPolicyNames().
+    getWriteDb()
+        .prepare(`UPDATE mcp_tool_policies
+       SET enabled = ?, allowed_roles = ?, allowed_scopes = ?,
+           admin_override = MAX(admin_override, ?),
+           updated_at = datetime('now')
+       WHERE tool_name = ?`)
+        .run((input.enabled ?? current.enabled) ? 1 : 0, roles.join(","), scopes.join(","), input.enabled === undefined ? 0 : 1, name);
+    auditMcpAdmin("tool_policy_updated", {
+        toolName: name,
+        detail: { enabled: input.enabled ?? current.enabled, roles, scopes },
+    });
+    return getMcpToolPolicy(name);
+}
+export function listMcpClients() {
+    ensureMcpAdminSchema();
+    if (!mcpOauthReady())
+        return [];
+    const rows = getDb()
+        .prepare(`SELECT c.client_id, c.client_name, c.redirect_uris,
+              c.token_endpoint_auth_method, c.scope, c.created_at,
+              c.enabled, c.revoked_at, c.last_used_at,
+              SUM(CASE WHEN r.revoked_at IS NULL AND r.expires_at > unixepoch() THEN 1 ELSE 0 END)
+                AS active_refresh_tokens
+       FROM mcp_oauth_clients c
+       LEFT JOIN mcp_oauth_refresh_tokens r ON r.client_id = c.client_id
+       GROUP BY c.client_id
+       ORDER BY c.created_at DESC`)
+        .all();
+    return rows.map((row) => ({
+        ...row,
+        enabled: row.enabled !== 0 && !row.revoked_at,
+        redirect_uris: safeStringArray(row.redirect_uris),
+        active_refresh_tokens: Number(row.active_refresh_tokens || 0),
+    }));
+}
+function safeStringArray(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed.map(String) : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function setMcpClientEnabled(clientId, enabled) {
+    ensureMcpAdminSchema();
+    const result = getWriteDb()
+        .prepare(`UPDATE mcp_oauth_clients SET enabled = ? WHERE client_id = ? AND revoked_at IS NULL`)
+        .run(enabled ? 1 : 0, clientId);
+    if (result.changes) {
+        if (!enabled)
+            revokeClientTokens(clientId);
+        auditMcpAdmin(enabled ? "client_enabled" : "client_disabled", { clientId });
+    }
+    return result.changes > 0;
+}
+export function revokeMcpClient(clientId) {
+    ensureMcpAdminSchema();
+    const result = getWriteDb()
+        .prepare(`UPDATE mcp_oauth_clients
+       SET enabled = 0, revoked_at = COALESCE(revoked_at, datetime('now'))
+       WHERE client_id = ?`)
+        .run(clientId);
+    revokeClientTokens(clientId);
+    if (result.changes)
+        auditMcpAdmin("client_revoked", { clientId });
+    return result.changes > 0;
+}
+export function rotateMcpClientSecret(clientId) {
+    ensureMcpAdminSchema();
+    const client = getDb()
+        .prepare(`SELECT token_endpoint_auth_method, revoked_at
+       FROM mcp_oauth_clients WHERE client_id = ?`)
+        .get(clientId);
+    if (!client || client.revoked_at || client.token_endpoint_auth_method === "none")
+        return null;
+    const clientSecret = randomBytes(32).toString("base64url");
+    const hash = createHash("sha256").update(clientSecret, "utf8").digest("hex");
+    getWriteDb()
+        .prepare(`UPDATE mcp_oauth_clients SET client_secret_hash = ? WHERE client_id = ?`)
+        .run(hash, clientId);
+    revokeClientTokens(clientId);
+    auditMcpAdmin("client_secret_rotated", { clientId });
+    return { clientSecret };
+}
+function revokeClientTokens(clientId) {
+    getWriteDb()
+        .prepare(`UPDATE mcp_oauth_refresh_tokens
+       SET revoked_at = COALESCE(revoked_at, unixepoch())
+       WHERE client_id = ?`)
+        .run(clientId);
+}
+export function clientCanAuthenticate(clientId) {
+    ensureMcpAdminSchema();
+    const row = getDb()
+        .prepare(`SELECT enabled, revoked_at FROM mcp_oauth_clients WHERE client_id = ?`)
+        .get(clientId);
+    return Boolean(row && row.enabled !== 0 && !row.revoked_at);
+}
+export function touchMcpClient(clientId) {
+    ensureMcpAdminSchema();
+    getWriteDb()
+        .prepare(`UPDATE mcp_oauth_clients SET last_used_at = datetime('now') WHERE client_id = ?`)
+        .run(clientId);
+}
+export function mcpAdminStatus() {
+    const publicUrl = resolveMcpPublicUrl();
+    const clients = listMcpClients();
+    const tools = listMcpToolPolicies();
+    return {
+        ready: mcpOauthReady(),
+        publicUrl,
+        mcpUrl: publicUrl ? `${publicUrl}/mcp` : null,
+        oauthReady: mcpOauthReady(),
+        jwtConfigured: Boolean(process.env.MCP_JWT_SECRET),
+        toolCount: tools.length,
+        enabledToolCount: tools.filter((tool) => tool.enabled).length,
+        clientCount: clients.length,
+        enabledClientCount: clients.filter((client) => client.enabled).length,
+    };
+}
+export function mcpDiagnostics() {
+    const status = mcpAdminStatus();
+    const checks = [
+        { id: "oauth_schema", ok: status.oauthReady, message: "Tables OAuth MCP" },
+        { id: "jwt_secret", ok: status.jwtConfigured, message: "Secret JWT MCP configuré" },
+        { id: "public_url", ok: Boolean(status.publicUrl), message: "URL publique / tunnel" },
+        { id: "tools", ok: status.enabledToolCount > 0, message: "Au moins un tool actif" },
+    ];
+    return { status, checks, healthy: checks.every((check) => check.ok) };
+}
+export function mcpMetrics() {
+    const logs = listRequestLogs({ source: "mcp", limit: 1000 }).logs;
+    const errors = logs.filter((log) => log.status >= 400 || log.detail.ok === false);
+    const durations = logs.map((log) => log.durationMs).sort((a, b) => a - b);
+    return {
+        window: "process",
+        requests: logs.length,
+        errors: errors.length,
+        errorRate: logs.length ? errors.length / logs.length : 0,
+        averageDurationMs: logs.length
+            ? Math.round(logs.reduce((sum, log) => sum + log.durationMs, 0) / logs.length)
+            : 0,
+        p95DurationMs: durations.length
+            ? durations[Math.min(durations.length - 1, Math.floor(durations.length * 0.95))]
+            : 0,
+        byTool: Object.fromEntries(MCP_TOOL_REGISTRY().map((tool) => [
+            tool.name,
+            logs.filter((log) => log.detail.tool === tool.name).length,
+        ])),
+    };
+}
+export function auditMcpAdmin(event, options = {}) {
+    ensureMcpAdminSchema();
+    getWriteDb()
+        .prepare(`INSERT INTO mcp_audit_logs
+       (event, actor, client_id, tool_name, outcome, detail_json)
+       VALUES (?, ?, ?, ?, ?, ?)`)
+        .run(event, options.actor || null, options.clientId || null, options.toolName || null, options.outcome || "ok", options.detail == null ? null : JSON.stringify(options.detail));
+}
+export function listMcpAuditLogs(limit = 200) {
+    ensureMcpAdminSchema();
+    return getDb()
+        .prepare(`SELECT id, created_at, event, actor, client_id, tool_name, outcome, detail_json
+       FROM mcp_audit_logs ORDER BY id DESC LIMIT ?`)
+        .all(Math.min(1000, Math.max(1, limit)));
+}
+export function pruneMcpAuditLogs(retentionDays = Number(process.env.MCP_AUDIT_RETENTION_DAYS || 30)) {
+    if (!tableExists("mcp_audit_logs"))
+        return 0;
+    const days = Number.isFinite(retentionDays)
+        ? Math.min(365, Math.max(1, Math.floor(retentionDays)))
+        : 30;
+    return getWriteDb()
+        .prepare(`DELETE FROM mcp_audit_logs WHERE created_at < datetime('now', ?)`)
+        .run(`-${days} days`).changes;
+}
+export function exportMcpDiagnostics() {
+    const clients = listMcpClients().map((client) => ({
+        idPrefix: client.client_id.slice(0, 12),
+        name: client.client_name,
+        redirectHosts: client.redirect_uris.map((uri) => {
+            try {
+                return new URL(uri).host;
+            }
+            catch {
+                return "invalid";
+            }
+        }),
+        scope: client.scope,
+        enabled: client.enabled,
+        revoked: Boolean(client.revoked_at),
+        lastUsedAt: client.last_used_at,
+    }));
+    return {
+        generatedAt: new Date().toISOString(),
+        diagnostics: mcpDiagnostics(),
+        metrics: mcpMetrics(),
+        tools: listMcpToolPolicies().map((tool) => ({
+            name: tool.name,
+            enabled: tool.enabled,
+            requiredScope: tool.requiredScope,
+            allowedRoles: tool.allowedRoles,
+            allowedScopes: tool.allowedScopes,
+        })),
+        clients,
+        auditRetentionDays: Number(process.env.MCP_AUDIT_RETENTION_DAYS || 30),
+        configuration: {
+            corsConfigured: Boolean(process.env.MCP_CORS_ORIGINS?.trim()),
+            publicUrlConfigured: Boolean(resolveMcpPublicUrl()),
+            jwtConfigured: Boolean(process.env.MCP_JWT_SECRET),
+        },
+    };
+}
+//# sourceMappingURL=mcp-admin.js.map

package/dist/admin/mcp-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-admin.js","sourceRoot":"","sources":["../../src/admin/mcp-admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAKpD,SAAS,KAAK;IACZ,OAAO,mBAAmB,EAAE,CAAC,KAAK,EAAE,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,mBAAmB,EAAE,CAAC,UAAU,EAAE,CAAC;AAC5C,CAAC;AACD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,mBAAmB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AACD,SAAS,iBAAiB;IACxB,OAAO,mBAAmB,EAAE,CAAC,SAAS,EAAE,CAAC;AAC3C,CAAC;AACD,SAAS,aAAa;IACpB,OAAO,mBAAmB,EAAE,CAAC,aAAa,EAAE,CAAC;AAC/C,CAAC;AACD,SAAS,mBAAmB;IAC1B,OAAO,mBAAmB,EAAE,CAAC,mBAAmB,EAAE,CAAC;AACrD,CAAC;AACD,SAAS,eAAe,CAAC,IAAuC;IAC9D,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC,eAAe,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAoF,EAAE,CAAC;AACxH,CAAC;AAED,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,sEAAsE;AACtE,SAAS,eAAe;IACtB,OAAO,mBAAmB,EAAE,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,SAAS,gBAAgB;IACvB,OAAO,CACL,mBAAmB,EAAE,CAAC,gBAAgB,IAAI;QACxC,KAAK;QACL,UAAU;QACV,WAAW;QACX,MAAM;KACP,CACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAc;IAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OACE,KAAK,EAAE;SACJ,OAAO,CAAC,sBAAsB,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;SAC9D,GAAG,EACP,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,IAAI,aAAa;QAAE,OAAO;IAC1B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,EAAE,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,cAAc,CAAC,EAAE,CAAC;YACpD,EAAE,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IACE,WAAW,CAAC,mBAAmB,CAAC;QAChC,CAAC,SAAS,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,EACjD,CAAC;QACD,EAAE,CAAC,IAAI,CACL,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;GAuBP,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;;yBAEqB,CACtB,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,CAAC,WAAW;QAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;;QACxC,MAAM,EAAE,CAAC;IACd,iBAAiB,EAAE,CAAC;IACpB,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAQC;IAED,oBAAoB,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;;yBAEqB,CACtB,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,IAAI;gBAAE,SAAS;YAC1B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,CAAC,WAAW;QAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;;QACrC,GAAG,EAAE,CAAC;AACb,CAAC;AASD,MAAM,UAAU,mBAAmB;IACjC,oBAAoB,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,EAAE;SACjB,OAAO,CACN;8BACwB,CACzB;SACA,GAAG,EAMJ,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC;QACxD,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc;YACjD,YAAY,EAAE,CAAC,GAAG,EAAE,aAAa,IAAI,eAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;iBAC9D,KAAK,CAAC,GAAG,CAAC;iBACV,MAAM,CAAC,OAAO,CAAC;YAClB,aAAa,EAAE,CAAC,GAAG,EAAE,cAAc,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1F,SAAS,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC;QACH,oBAAoB,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,EAAE;aACjB,OAAO,CACN;kDAC0C,CAC3C;aACA,GAAG,EAAkC,CAAC;QACzC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gCAAgC,CAE9C,KAAU,EAAE,UAAkC,EAAE;IAChD,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC;IAC9C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,KAA+E;IAE/E,oBAAoB,EAAE,CAAC;IACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAE,CAAC;IACxC,kEAAkE;IAClE,uEAAuE;IACvE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACzE,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7E,gBAAgB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CACnC,CAAC;IACF,yEAAyE;IACzE,oEAAoE;IACpE,oEAAoE;IACpE,UAAU,EAAE;SACT,OAAO,CACN;;;;2BAIqB,CACtB;SACA,GAAG,CACF,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EACf,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAChB,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnC,IAAI,CACL,CAAC;IACJ,aAAa,CAAC,qBAAqB,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE;KACrE,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAeD,MAAM,UAAU,cAAc;IAC5B,oBAAoB,EAAE,CAAC;IACvB,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,EAAE;SACjB,OAAO,CACN;;;;;;;;kCAQ4B,CAC7B;SACA,GAAG,EAGJ,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,GAAG;QACN,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU;QAC7C,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC;QACjD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,CAAC;KAC9D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAgB;IACpE,oBAAoB,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,UAAU,EAAE;SACxB,OAAO,CAAC,qFAAqF,CAAC;SAC9F,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO;YAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC3C,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,oBAAoB,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,UAAU,EAAE;SACxB,OAAO,CACN;;2BAEqB,CACtB;SACA,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,OAAO;QAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB;IAEhB,oBAAoB,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,EAAE;SACnB,OAAO,CACN;kDAC4C,CAC7C;SACA,GAAG,CAAC,QAAQ,CAEF,CAAC;IACd,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,0BAA0B,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,UAAU,EAAE;SACT,OAAO,CAAC,yEAAyE,CAAC;SAClF,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,aAAa,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,UAAU,EAAE;SACT,OAAO,CACN;;2BAEqB,CACtB;SACA,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,oBAAoB,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,EAAE;SAChB,OAAO,CACN,uEAAuE,CACxE;SACA,GAAG,CAAC,QAAQ,CAA+D,CAAC;IAC/E,OAAO,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,oBAAoB,EAAE,CAAC;IACvB,UAAU,EAAE;SACT,OAAO,CAAC,iFAAiF,CAAC;SAC1F,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,aAAa,EAAE;QACtB,SAAS;QACT,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI;QAC7C,UAAU,EAAE,aAAa,EAAE;QAC3B,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;QAC7D,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,kBAAkB,EAAE;QAC1E,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE;QACnF,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE;QACrF,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE;KACpF,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,iBAAiB,EAAE,IAAI,CAAC,MAAM;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YAC9E,CAAC,CAAC,CAAC;QACL,aAAa,EAAE,SAAS,CAAC,MAAM;YAC7B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC,CAAC,CAAC;QACL,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;SAC3D,CAAC,CACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAMI,EAAE;IAEN,oBAAoB,EAAE,CAAC;IACvB,UAAU,EAAE;SACT,OAAO,CACN;;iCAE2B,CAC5B;SACA,GAAG,CACF,KAAK,EACL,OAAO,CAAC,KAAK,IAAI,IAAI,EACrB,OAAO,CAAC,QAAQ,IAAI,IAAI,EACxB,OAAO,CAAC,QAAQ,IAAI,IAAI,EACxB,OAAO,CAAC,OAAO,IAAI,IAAI,EACvB,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAC/D,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAAG,GAAG;IAC1C,oBAAoB,EAAE,CAAC;IACvB,OAAO,KAAK,EAAE;SACX,OAAO,CACN;oDAC8C,CAC/C;SACA,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAElE,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,UAAU,EAAE;SAChB,OAAO,CAAC,kEAAkE,CAAC;SAC3E,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,WAAW;QACxB,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC9C,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,UAAU,EAAE,MAAM,CAAC,YAAY;KAChC,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,WAAW,EAAE,cAAc,EAAE;QAC7B,OAAO,EAAE,UAAU,EAAE;QACrB,KAAK,EAAE,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,OAAO;QACP,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACtE,aAAa,EAAE;YACb,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAC7D,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACnD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;SACnD;KACF,CAAC;AACJ,CAAC"}