@frontmcp/adapters 1.1.2 → 1.2.0

package/skills/audit/audit-writer.d.ts

@@ -0,0 +1,175 @@
+import type { SkillAuditSubjectMode } from './audit-config';
+import { SKILL_AUDIT_GENESIS_PREV_HASH } from './audit-record.types';
+import type { SkillAuditSigner } from './audit-signer';
+import type { SkillAuditStore } from './audit-store';
+/**
+ * Minimal logger surface — matches `FrontMcpLogger` but we don't import it
+ * here to keep the audit module shippable without an SDK dependency.
+ */
+export interface SkillAuditLogger {
+    warn(...args: unknown[]): void;
+    debug?(...args: unknown[]): void;
+}
+/**
+ * Optional metrics counter. When wired (e.g. by the telemetry agent) a
+ * failed audit write increments
+ * `frontmcp_skills_audit_write_failures_total{reason}` and a dropped record
+ * (queue overflow) increments
+ * `frontmcp_skills_audit_dropped_total{reason}`. Left as a callback so the
+ * audit module doesn't take a metrics dependency.
+ */
+export interface SkillAuditMetrics {
+    incrementWriteFailure(reason: 'sign' | 'append' | 'unexpected'): void;
+    incrementDropped?(reason: 'queue-overflow' | 'background-failure'): void;
+}
+/**
+ * Context the tool passes to each write call. Contains everything needed
+ * to fully describe the invocation without leaking the raw input/output
+ * payloads into the audit record.
+ */
+export interface SkillAuditWriteContext {
+    subject: string;
+    skillId: string;
+    actionId: string;
+    bundleId: string;
+    bundleVersion: string;
+    /** Raw input — hashed via JCS before storage. Never persisted verbatim. */
+    input: unknown;
+}
+/** Extra fields for the http-call-success path. */
+export interface SkillAuditSuccessExtras {
+    status: number;
+    /** Response body — hashed via JCS before storage. */
+    output: unknown;
+}
+/** Extra fields for the http-call-failure path. */
+export interface SkillAuditFailureExtras {
+    status: number;
+    /** Free-form error description — truncated/redacted into `errorMessage`. */
+    error: unknown;
+}
+/** Extra fields for the authority-check-fail path. */
+export interface SkillAuditAuthorityFailExtras {
+    /** Reason from the AuthorityGuard (e.g. `'roles missing: admin'`). */
+    reason: string;
+}
+/**
+ * Maximum length of the truncated error message persisted in the record.
+ * Picked to fit comfortably in any storage backend's value-size budget while
+ * still being long enough to identify the failure mode.
+ */
+export declare const SKILL_AUDIT_ERROR_MESSAGE_MAX = 500;
+/**
+ * Maximum number of pending audit writes queued in-process. When the queue
+ * is full new writes are dropped (with a metrics increment + warn log)
+ * instead of blocking the tool. Picked to absorb a few seconds of slow-store
+ * latency at the project's expected QPS without becoming a memory landmine
+ * during sustained backend outage.
+ */
+export declare const SKILL_AUDIT_QUEUE_MAX = 1000;
+/**
+ * Options accepted by {@link SkillAuditWriter}. All fields optional — sane
+ * defaults match the previous behavior except for `subjectMode`, which
+ * defaults to `'hash'` for GDPR friendliness.
+ */
+export interface SkillAuditWriterOptions {
+    /** See {@link SkillAuditSubjectMode}. Default: `'hash'`. */
+    subjectMode?: SkillAuditSubjectMode;
+    /**
+     * Secret used for the subject HMAC when `subjectMode: 'hash'`. Hosts
+     * SHOULD pass a stable, host-managed key (typically the same audit
+     * secret you use for HS256 signing). When omitted, a deterministic key
+     * is derived from the signer's keyId so subject hashes are stable
+     * within the process — but NOT across restarts unless the signer keyId
+     * is also stable.
+     */
+    subjectHashSecret?: Uint8Array;
+    /** See {@link SKILL_AUDIT_QUEUE_MAX}. Default: 1000. */
+    maxQueueDepth?: number;
+}
+/**
+ * Audit writer service. Constructed once per scope and resolved out of DI
+ * by the ExecuteActionTool. Calls return a promise that resolves after the
+ * chained store work completes — but the tool detaches that promise so a
+ * slow audit backend never directly slows every skill invocation.
+ */
+export declare class SkillAuditWriter {
+    private readonly store;
+    private readonly signer;
+    private readonly logger;
+    private readonly metrics?;
+    /**
+     * Single-flight queue: every append() chains onto this promise so the
+     * read-tail-then-append-with-prevHash sequence stays atomic per process.
+     * This is the mate to the storage adapter's `incr` for cross-pod safety.
+     */
+    private chainHeadLock;
+    /** Current in-flight queue depth (records awaiting the chain head lock). */
+    private queueDepth;
+    private readonly subjectMode;
+    private readonly subjectHashSecret;
+    private readonly maxQueueDepth;
+    constructor(store: SkillAuditStore, signer: SkillAuditSigner, logger: SkillAuditLogger, metrics?: SkillAuditMetrics | undefined, options?: SkillAuditWriterOptions);
+    /**
+     * Phase 2 in the tool: authority check just passed. We log the inputHash
+     * here so even invocations that fail at the network layer still leave a
+     * forensic breadcrumb tying the input to the policy decision.
+     */
+    writeAuthorityPass(ctx: SkillAuditWriteContext): Promise<void>;
+    /**
+     * Phase 2 in the tool: authority check denied. Writing this record is
+     * security-relevant — without it, denied invocations would not appear in
+     * the audit log at all, and the most security-relevant events (someone
+     * trying to invoke an action they're not authorized for) would silently
+     * disappear. The tool MUST call this before returning the denial envelope.
+     */
+    writeAuthorityFail(ctx: SkillAuditWriteContext, extras: SkillAuditAuthorityFailExtras): Promise<void>;
+    /** Phase 4 in the tool, success path. */
+    writeHttpCallSuccess(ctx: SkillAuditWriteContext, extras: SkillAuditSuccessExtras): Promise<void>;
+    /** Phase 4 in the tool, failure path. */
+    writeHttpCallFailure(ctx: SkillAuditWriteContext, extras: SkillAuditFailureExtras): Promise<void>;
+    /**
+     * Wait for all pending writes to complete. Useful for tests and graceful
+     * shutdown — the chain head lock resolves once every queued write has
+     * finished (success or swallowed-failure). Never throws.
+     */
+    flush(): Promise<void>;
+    private write;
+    private doWrite;
+    /**
+     * Best-effort sequence rollback. Storage adapters that support `decr` will
+     * close the gap; ones that don't are no-ops. We never throw out of this
+     * helper — a failed rollback is strictly worse than a permanent gap.
+     *
+     * Detection is duck-typed (we look at `.adapter.decr` and `.options.sequenceKey`)
+     * because the SkillAuditStore interface intentionally doesn't expose
+     * sequence-mutation methods — those are storage-specific implementation
+     * detail, and forcing every implementation to expose them would push the
+     * complexity onto every adapter even when the underlying store can't
+     * support transactional rollback.
+     */
+    private tryDecrementSequence;
+    /** Apply the configured subject-mode redaction. */
+    private applySubjectMode;
+    /**
+     * Default subject-hash secret derivation when the host doesn't supply one.
+     * Returns a deterministic 32-byte key seeded from the signer's keyId so
+     * two SkillAuditWriter instances configured against the same signer
+     * produce stable subject hashes — useful for joining records across
+     * writer reconfigurations within the same logical deployment. NOT a
+     * cryptographic key in its own right — the host SHOULD override via
+     * constructor options for production deployments.
+     */
+    private deriveDefaultSubjectSecret;
+    /**
+     * Hash arbitrary output. Falls back to a sentinel if canonicalization
+     * fails (circular references, non-serializable values) — the verifier
+     * will treat it as a hash like any other.
+     */
+    private safeHash;
+    /** Truncate + sanitize an error to fit in the record. */
+    private formatError;
+}
+/** Sentinel for the very first record's prevHash. Re-exported for ergonomics. */
+export { SKILL_AUDIT_GENESIS_PREV_HASH };
+//# sourceMappingURL=audit-writer.d.ts.map

package/skills/audit/audit-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-writer.d.ts","sourceRoot":"","sources":["../../../src/skills/audit/audit-writer.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAA+C,MAAM,sBAAsB,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IACtE,gBAAgB,CAAC,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAAC;CAC1E;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,UAAU,CAAC;IAC/B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAgBzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAlB3B;;;;OAIG;IACH,OAAO,CAAC,aAAa,CAAoC;IAEzD,4EAA4E;IAC5E,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAa;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAGpB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,iBAAiB,YAAA,EAC5C,OAAO,GAAE,uBAA4B;IAOvC;;;;OAIG;IACH,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D;;;;;;OAMG;IACH,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrG,yCAAyC;IACzC,oBAAoB,CAAC,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IASjG,yCAAyC;IACzC,oBAAoB,CAAC,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IASjG;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAW5B,OAAO,CAAC,KAAK;YAqCC,OAAO;IAsGrB;;;;;;;;;;;OAWG;YACW,oBAAoB;IAelC,mDAAmD;IACnD,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAQhB,yDAAyD;IACzD,OAAO,CAAC,WAAW;CAoBpB;AAED,iFAAiF;AACjF,OAAO,EAAE,6BAA6B,EAAE,CAAC"}

package/skills/audit/index.d.ts

@@ -0,0 +1,7 @@
+export { SKILL_AUDIT_GENESIS_PREV_HASH, SKILL_AUDIT_KEYS, type SkillAuditPhase, type SkillAuditRecord, type SkillAuditSignatureAlg, } from './audit-record.types';
+export { canonicalizeRecordForSigning, linkRecord, nextPrevHash, verifyChain, type AuditChainVerifyResult, type AuditSignatureVerifier, type AuditTrustedKey, type SkillAuditPartialRecord, } from './audit-chain';
+export { defaultAuditSignatureVerifier, Hs256AuditSigner, Rs256AuditSigner, type SkillAuditSignResult, type SkillAuditSigner, } from './audit-signer';
+export { MemoryAuditStore, StorageAdapterAuditStore, type SkillAuditReadOptions, type SkillAuditStore, } from './audit-store';
+export { SkillAuditWriter, SKILL_AUDIT_ERROR_MESSAGE_MAX, SKILL_AUDIT_QUEUE_MAX, type SkillAuditAuthorityFailExtras, type SkillAuditFailureExtras, type SkillAuditLogger, type SkillAuditMetrics, type SkillAuditSuccessExtras, type SkillAuditWriteContext, type SkillAuditWriterOptions, } from './audit-writer';
+export { SkillAuditWriterToken, type SkillAuditConfig, type SkillAuditSubjectMode } from './audit-config';
+//# sourceMappingURL=index.d.ts.map

package/skills/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/audit/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,4BAA4B,EAC5B,UAAU,EACV,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC"}

package/skills/bundle/bundle-diff.d.ts

@@ -0,0 +1,30 @@
+import type { ResolvedBundle } from './bundle.types';
+export interface BundleDiff {
+    /** Skill ids added by the new bundle (not present in old). */
+    addedSkillIds: string[];
+    /** Skill ids removed (present in old, not in new). */
+    removedSkillIds: string[];
+    /** Skill ids whose content changed (registered in both, differing fields). */
+    changedSkillIds: string[];
+    /** Operation ids added. */
+    addedOperationIds: string[];
+    /** Operation ids removed. */
+    removedOperationIds: string[];
+    /** Operation ids whose descriptor changed. */
+    changedOperationIds: string[];
+    /** True if the diff is structurally a no-op (same version + same content). */
+    isNoOp: boolean;
+}
+/**
+ * Compute the structural diff between two bundles.
+ *
+ * `oldBundle === undefined` means "no previous bundle" — every skill / op is
+ * treated as added. Identity is by `id` for skills and by `operationId` for ops.
+ */
+export declare function diffBundles(oldBundle: ResolvedBundle | undefined, newBundle: ResolvedBundle): BundleDiff;
+/**
+ * Render a one-line audit-friendly summary of a diff.
+ * Used by the bundle-swap log line that operators tail for rug-pull detection.
+ */
+export declare function formatDiffSummary(diff: BundleDiff): string;
+//# sourceMappingURL=bundle-diff.d.ts.map

package/skills/bundle/bundle-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-diff.d.ts","sourceRoot":"","sources":["../../../src/skills/bundle/bundle-diff.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAuB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,sDAAsD;IACtD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8EAA8E;IAC9E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,2BAA2B;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,8CAA8C;IAC9C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC;CACjB;AAwBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,EAAE,SAAS,EAAE,cAAc,GAAG,UAAU,CAoDxG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAM1D"}

package/skills/bundle/bundle.schema.d.ts

@@ -0,0 +1,101 @@
+import { z } from '@frontmcp/lazy-zod';
+export declare const resolvedBundleSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    schemaVersion: import("@frontmcp/lazy-zod").ZodLiteral<1>;
+    bundleId: import("@frontmcp/lazy-zod").ZodString;
+    version: import("@frontmcp/lazy-zod").ZodString;
+    generatedAt: import("@frontmcp/lazy-zod").ZodString;
+    sourceDigest: import("@frontmcp/lazy-zod").ZodString;
+    services: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        id: import("@frontmcp/lazy-zod").ZodString;
+        baseUrl: import("@frontmcp/lazy-zod").ZodString;
+        description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strict>>;
+    authBindings: import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodDiscriminatedUnion<[import("@frontmcp/lazy-zod").ZodObject<{
+        kind: import("@frontmcp/lazy-zod").ZodLiteral<"none">;
+    }, import("zod/v4/core").$strict>, import("@frontmcp/lazy-zod").ZodObject<{
+        kind: import("@frontmcp/lazy-zod").ZodLiteral<"bearer">;
+        vaultRef: import("@frontmcp/lazy-zod").ZodString;
+        passthroughCallerToken: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    }, import("zod/v4/core").$strict>, import("@frontmcp/lazy-zod").ZodObject<{
+        kind: import("@frontmcp/lazy-zod").ZodLiteral<"apiKey">;
+        in: import("@frontmcp/lazy-zod").ZodEnum<{
+            query: "query";
+            header: "header";
+        }>;
+        name: import("@frontmcp/lazy-zod").ZodString;
+        vaultRef: import("@frontmcp/lazy-zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("@frontmcp/lazy-zod").ZodObject<{
+        kind: import("@frontmcp/lazy-zod").ZodLiteral<"oauth2">;
+        flow: import("@frontmcp/lazy-zod").ZodLiteral<"client_credentials">;
+        vaultRef: import("@frontmcp/lazy-zod").ZodString;
+    }, import("zod/v4/core").$strict>], "kind">>;
+    skills: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        id: import("@frontmcp/lazy-zod").ZodString;
+        name: import("@frontmcp/lazy-zod").ZodString;
+        description: import("@frontmcp/lazy-zod").ZodString;
+        instructions: import("@frontmcp/lazy-zod").ZodString;
+        tags: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+        operationIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        requiredAuthorities: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
+        requires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    }, import("zod/v4/core").$strict>>;
+    operations: import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodObject<{
+        operationId: import("@frontmcp/lazy-zod").ZodString;
+        serviceId: import("@frontmcp/lazy-zod").ZodString;
+        httpMethod: import("@frontmcp/lazy-zod").ZodEnum<{
+            GET: "GET";
+            POST: "POST";
+            PUT: "PUT";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+            HEAD: "HEAD";
+        }>;
+        pathTemplate: import("@frontmcp/lazy-zod").ZodString;
+        inputSchema: import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>;
+        outputSchema: import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>;
+        mapper: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+            inputKey: import("@frontmcp/lazy-zod").ZodString;
+            type: import("@frontmcp/lazy-zod").ZodEnum<{
+                query: "query";
+                cookie: "cookie";
+                path: "path";
+                header: "header";
+                body: "body";
+            }>;
+            key: import("@frontmcp/lazy-zod").ZodString;
+            required: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+            style: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            explode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+            serialization: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
+            security: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
+        }, import("zod/v4/core").$loose>>;
+        authBindingRef: import("@frontmcp/lazy-zod").ZodString;
+        requiredAuthorities: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
+        maxResponseBytes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        timeoutMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        summary: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strict>>;
+    integrity: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        alg: import("@frontmcp/lazy-zod").ZodEnum<{
+            RS256: "RS256";
+            EdDSA: "EdDSA";
+        }>;
+        keyId: import("@frontmcp/lazy-zod").ZodString;
+        signature: import("@frontmcp/lazy-zod").ZodString;
+        digest: import("@frontmcp/lazy-zod").ZodString;
+    }, import("zod/v4/core").$strict>>;
+}, import("zod/v4/core").$strict>;
+export type ParsedBundle = z.infer<typeof resolvedBundleSchema>;
+/**
+ * Cross-field validation: every operation's serviceId must reference a known
+ * service, every operation's authBindingRef must reference a known binding,
+ * every skill's operationIds must reference known operations.
+ */
+export declare function crossValidate(bundle: ParsedBundle): {
+    ok: true;
+} | {
+    ok: false;
+    errors: string[];
+};
+//# sourceMappingURL=bundle.schema.d.ts.map

package/skills/bundle/bundle.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.schema.d.ts","sourceRoot":"","sources":["../../../src/skills/bundle/bundle.schema.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AA8IvC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwBtB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAgClG"}

package/skills/bundle/bundle.store.d.ts

@@ -0,0 +1,143 @@
+import { type BundleDiff } from './bundle-diff';
+import type { ResolvedBundle } from './bundle.types';
+export type BundleSwapListener = (event: {
+    previous: ResolvedBundle | undefined;
+    current: ResolvedBundle;
+    diff: BundleDiff;
+    /** Marker that the swap was triggered by `pin(version)` or `rollback()`. */
+    reason?: 'normal' | 'pin' | 'rollback';
+}) => void;
+/**
+ * Minimal telemetry surface the BundleStore needs. Modeled to be a structural
+ * subset of `@frontmcp/observability`'s `TelemetryAccessor` so callers can
+ * pass that directly, but defined here to keep `@frontmcp/adapters` from
+ * picking up a hard dependency on the observability package.
+ */
+export interface BundleStoreCounter {
+    inc(by?: number, attributes?: Record<string, string>): void;
+}
+export interface BundleStoreSpan {
+    setAttributes(attrs: Record<string, string | number | boolean>): void;
+    addEvent(name: string, attrs?: Record<string, string | number | boolean>): void;
+    recordError?(error: Error): void;
+    end(): void;
+    endWithError?(error: Error | string): void;
+}
+export interface BundleStoreTelemetry {
+    /** Create (or fetch cached) named counter, e.g. `frontmcp_skills_bundle_pulls_total`. */
+    createCounter(name: string, description?: string): BundleStoreCounter;
+    /**
+     * Start a span. Caller is responsible for `end()` / `endWithError()`.
+     * Synchronous — matches the current sync semantics of `swap()`.
+     */
+    startSpan(name: string, attributes?: Record<string, string | number | boolean>): BundleStoreSpan;
+}
+/**
+ * Options that control the store's history ring buffer and pin behavior.
+ */
+export interface BundleStoreOptions {
+    /**
+     * Number of past bundles to retain in memory (in addition to the active one).
+     * Used by `pin(version)` and `rollback()`. Default: 3. Must be >= 1.
+     */
+    historySize?: number;
+    /**
+     * Optional telemetry hook. When provided, `swap()` is wrapped in a
+     * `skill.bundle.swap` span and the bundle-pulls counter is incremented
+     * with `{ status, source, reason? }` attributes. When omitted, the store
+     * emits no telemetry (zero overhead — no span, no counter).
+     */
+    telemetry?: BundleStoreTelemetry;
+}
+/**
+ * In-memory holder for the active bundle plus a small history ring buffer.
+ *
+ * Atomic swap semantics: `swap()` either fully transitions to the new bundle
+ * (and returns the diff) or throws and leaves the previous bundle untouched.
+ *
+ * Versioning + rollback (v1.2):
+ *   - Every successful `swap()` pushes the prior bundle into a fixed-size
+ *     history ring (`historySize`). The ring stores entries by version so
+ *     `pin(version)` can re-activate any of the last N bundles.
+ *   - `pin(version)` snaps the active bundle to a previously-known version,
+ *     refuses if the version isn't in history, and marks the store pinned.
+ *   - While pinned, `swap()` is rejected (caller decides whether to log/skip
+ *     or throw); the existing source listeners keep running so the host
+ *     observes new versions arriving but never auto-applies them.
+ *   - `rollback()` is sugar for `pin(previousActiveVersion)`.
+ *
+ * Listeners run synchronously after a successful swap/pin/rollback — keep
+ * them cheap.
+ */
+export declare class BundleStore {
+    private active;
+    private listeners;
+    private history;
+    private pinnedVersion;
+    private readonly historySize;
+    private readonly telemetry;
+    private readonly pullsCounter;
+    constructor(options?: BundleStoreOptions);
+    current(): ResolvedBundle | undefined;
+    /**
+     * Swap to a new bundle. Returns the structural diff (no-op = same version
+     * with no field changes; the swap itself still fires listeners with isNoOp=true
+     * so observers can record the heartbeat).
+     *
+     * Throws when the store is pinned. The caller should check `isPinned()` first
+     * if it wants to skip silently rather than throw.
+     *
+     * @param next   - new bundle to activate
+     * @param source - optional source label (e.g. `npm`, `saas-pull`, `webhook`)
+     *                 used as a counter / span attribute. When omitted, `unknown`
+     *                 is reported.
+     */
+    swap(next: ResolvedBundle, source?: string): BundleDiff;
+    /**
+     * Pin the active bundle to a specific historical version. Pinned stores
+     * reject `swap()` so source-driven updates accumulate elsewhere without
+     * activating. Returns the diff of the swap that activated the pinned
+     * version, or undefined if the pinned version was already active.
+     *
+     * Throws when `version` is unknown to the store's history.
+     */
+    pin(version: string): BundleDiff | undefined;
+    /**
+     * Re-activate the most recent bundle in history (the bundle that was
+     * active before the current one). Useful after a bad swap is detected.
+     * Returns the diff. Throws when no prior bundle is available.
+     *
+     * Rollback does NOT pin — sources can resume auto-swapping after rollback.
+     */
+    rollback(): BundleDiff;
+    /** Lift the pin so `swap()` accepts new bundles again. */
+    unpin(): void;
+    /** True when the store is currently pinned. */
+    isPinned(): boolean;
+    /** Pinned version string, or undefined when unpinned. */
+    pinned(): string | undefined;
+    /**
+     * Snapshot of the history ring (oldest first; does not include the active
+     * bundle). Returned array is a shallow copy — safe to inspect.
+     */
+    historySnapshot(): {
+        version: string;
+        bundleId: string;
+        validatedAt: number;
+    }[];
+    /** Subscribe to swap events. Returns an unsubscribe function. */
+    subscribe(fn: BundleSwapListener): () => void;
+    /** Reset to empty state. Used by tests. Does NOT fire listeners. */
+    reset(): void;
+    /** Commit a new active bundle (shared by swap / pin / rollback). */
+    private commit;
+}
+/**
+ * Thrown by `BundleStore.swap()` when the store is pinned. Callers that prefer
+ * to skip silently should check `isPinned()` before calling swap.
+ */
+export declare class BundlePinnedError extends Error {
+    readonly pinnedVersion: string;
+    constructor(pinnedVersion: string);
+}
+//# sourceMappingURL=bundle.store.d.ts.map

package/skills/bundle/bundle.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.store.d.ts","sourceRoot":"","sources":["../../../src/skills/bundle/bundle.store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAqCrD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,UAAU,CAAC;CACxC,KAAK,IAAI,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;IAChF,WAAW,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACjC,GAAG,IAAI,IAAI,CAAC;IACZ,YAAY,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,yFAAyF;IACzF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;IACtE;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,eAAe,CAAC;CAClG;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAQD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;gBAElD,OAAO,GAAE,kBAAuB;IAa5C,OAAO,IAAI,cAAc,GAAG,SAAS;IAIrC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU;IAkDvD;;;;;;;OAOG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAc5C;;;;;;OAMG;IACH,QAAQ,IAAI,UAAU;IAWtB,0DAA0D;IAC1D,KAAK,IAAI,IAAI;IAIb,+CAA+C;IAC/C,QAAQ,IAAI,OAAO;IAInB,yDAAyD;IACzD,MAAM,IAAI,MAAM,GAAG,SAAS;IAI5B;;;OAGG;IACH,eAAe,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE;IAQ/E,iEAAiE;IACjE,SAAS,CAAC,EAAE,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAO7C,oEAAoE;IACpE,KAAK,IAAI,IAAI;IAMb,oEAAoE;IACpE,OAAO,CAAC,MAAM;CA4Bf;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aACd,aAAa,EAAE,MAAM;gBAArB,aAAa,EAAE,MAAM;CAIlD"}

package/skills/bundle/bundle.types.d.ts

@@ -0,0 +1,143 @@
+import type { SkillAction } from '@frontmcp/sdk';
+import type { ParameterMapper } from '../../openapi';
+/** HTTP methods we accept in v1.2. Multipart, SSE, websockets are out of scope. */
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD';
+/** ABAC/RBAC policy carried by skills/ops. Loose at the boundary; libs/auth interprets. */
+export type AuthoritiesPolicy = Record<string, unknown>;
+/** Auth binding that the executor resolves to a real credential at call time. */
+export type AuthBinding = {
+    kind: 'none';
+} | {
+    kind: 'bearer';
+    vaultRef: string;
+    passthroughCallerToken?: boolean;
+} | {
+    kind: 'apiKey';
+    in: 'header' | 'query';
+    name: string;
+    vaultRef: string;
+} | {
+    kind: 'oauth2';
+    flow: 'client_credentials';
+    vaultRef: string;
+};
+/** Service descriptor — one per microservice referenced by the bundle. */
+export interface ServiceDescriptor {
+    /** Stable id (e.g. "billing"). Referenced by `OperationDescriptor.serviceId`. */
+    id: string;
+    /** Resolved server URL (no trailing slash). */
+    baseUrl: string;
+    /** Optional human-readable description. */
+    description?: string;
+}
+/**
+ * One executable operation derived from an OpenAPI `operationId`. The MCP client
+ * never sees these directly — they are invokable only through the plugin's
+ * `execute_action` meta-tool, which resolves `(skillId, actionId)` to one of these.
+ *
+ * The descriptor is shaped so it can be projected onto an `McpOpenAPITool` for
+ * reuse of `@frontmcp/adapters/openapi`'s `buildRequest` / `parseResponse`
+ * runtime helpers — the SaaS analyzer ships the `mapper` array so the plugin
+ * doesn't need to re-derive parameter locations from a raw OpenAPI spec.
+ */
+export interface OperationDescriptor {
+    /** Stable identifier within the bundle (matches OpenAPI operationId). */
+    operationId: string;
+    /** Service this op lives in. Must match a `ServiceDescriptor.id`. */
+    serviceId: string;
+    /** HTTP method. */
+    httpMethod: HttpMethod;
+    /** Path template, e.g. "/v1/customers/{id}/invoices". */
+    pathTemplate: string;
+    /**
+     * JSON Schema (Draft 2020-12) for the action's input — flat key/value map
+     * matching the inputs that `mapper[].inputKey` references.
+     */
+    inputSchema: Record<string, unknown>;
+    /** JSON Schema for the response body. */
+    outputSchema: Record<string, unknown>;
+    /**
+     * Parameter mapper produced by the SaaS analyzer at OpenAPI parse time —
+     * tells the executor which input keys land in path / query / header / cookie /
+     * body slots. Reused verbatim by `@frontmcp/adapters/openapi`'s buildRequest.
+     */
+    mapper: ParameterMapper[];
+    /** AuthBinding key (`bundle.authBindings[ref]`). */
+    authBindingRef: string;
+    /** Optional ABAC policy required to invoke this op. */
+    requiredAuthorities?: AuthoritiesPolicy;
+    /** Optional override of the response cap (bytes). */
+    maxResponseBytes?: number;
+    /** Optional override of the per-op timeout (ms). */
+    timeoutMs?: number;
+    /** Human-readable summary surfaced in `load_skill` content. */
+    summary?: string;
+    description?: string;
+}
+/** A skill bundles a curated set of operations. */
+export interface BundledSkill {
+    /** Stable skill id (must be unique within the bundle). */
+    id: string;
+    /** Display name for the skill. */
+    name: string;
+    /** Short description. */
+    description: string;
+    /** Markdown instructions surfaced by `load_skill`. */
+    instructions: string;
+    /** Optional tags for filtering. */
+    tags?: string[];
+    /** Operation ids this skill exposes (must exist in `bundle.operations`). */
+    operationIds: string[];
+    /** Optional skill-level authorities (in addition to per-op). */
+    requiredAuthorities?: AuthoritiesPolicy;
+    /**
+     * Other skill ids this skill depends on. Same field name as the
+     * agentskills Skill Package Manifest. Resolved at apply time via
+     * `resolveSkillLoadOrder` (libs/adapters/src/skills/dependency).
+     */
+    requires?: string[];
+}
+/** Detached signature envelope for the bundle. */
+export interface BundleIntegrity {
+    alg: 'RS256' | 'EdDSA';
+    /** Stable id of the signing key, matched against `trustedKeys[].keyId`. */
+    keyId: string;
+    /** Base64url-encoded detached signature. */
+    signature: string;
+    /** Base64url-encoded canonical-bytes hash that was signed (sha256). */
+    digest: string;
+}
+/** A fully-resolved, validated bundle ready to project into the registry. */
+export interface ResolvedBundle {
+    /** Wire-format version (currently 1). */
+    schemaVersion: 1;
+    /** Stable bundle identifier (customer slug + env). */
+    bundleId: string;
+    /** Monotonic version string used by clients to detect bundle swaps. */
+    version: string;
+    /** ISO timestamp the SaaS produced this bundle. */
+    generatedAt: string;
+    /** sha256 of the canonical OpenAPI source spec. */
+    sourceDigest: string;
+    /** All services this bundle covers. */
+    services: ServiceDescriptor[];
+    /** Reusable auth bindings keyed by ref string. */
+    authBindings: Record<string, AuthBinding>;
+    /** Skills declared by the bundle. */
+    skills: BundledSkill[];
+    /** All operations referenced by skills, keyed by `operationId`. */
+    operations: Record<string, OperationDescriptor>;
+    /** Optional integrity envelope. Required when plugin's requireSignature=true. */
+    integrity?: BundleIntegrity;
+}
+/**
+ * Convenience projection of a single skill's executable actions.
+ *
+ * Throws if any of the skill's `operationIds` is missing from `ops`. Silently
+ * dropping unknown ids would let a malformed bundle apply with the skill's
+ * advertised action list out of sync with what `execute_action` can actually
+ * resolve, so the bundle apply path treats this as a hard failure that trips
+ * the rollback.
+ */
+export declare function bundleSkillToActions(skill: BundledSkill, ops: Record<string, OperationDescriptor>): SkillAction[];
+//# sourceMappingURL=bundle.types.d.ts.map

package/skills/bundle/bundle.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.types.d.ts","sourceRoot":"","sources":["../../../src/skills/bundle/bundle.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9E,2FAA2F;AAC3F,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAExD,iFAAiF;AACjF,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,EAAE,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC;;;;OAIG;IACH,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,iBAAiB,CAAC;IACxC,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IACvB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,aAAa,EAAE,CAAC,CAAC;IACjB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,qCAAqC;IACrC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChD,iFAAiF;IACjF,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,WAAW,EAAE,CAgBjH"}