@gaunt-sloth/core 2.0.0-alpha.8 → 2.0.0-beta.0

package/dist/core/approvals/matcher.d.ts

@@ -0,0 +1,202 @@
+/**
+ * @module core/approvals/matcher
+ *
+ * EXT-71 (spec §3.1, §3.2, §3.3) — **the one comparison engine** over {@link ApprovalEntry}, and
+ * the three-list resolution built on top of it. Every approvals decision that is not the rung's own
+ * default runs through {@link resolveApprovalRules}; there is no second matcher anywhere.
+ *
+ * ## What an entry compares against
+ *
+ * `exact` / `glob` / `regexp` compare against the **normalized command** for a `shell` entry and
+ * against the **tool name** for `tool` / `mcpTool`. The normalization is
+ * {@link import('../shell/normalize.js').normalizeCommand} — the same one the command classifier and
+ * the §8 floor already use, never a second one of this module's own, because a second normalization
+ * is how a matcher and a floor come to disagree about what a command is.
+ *
+ * `hint` is valid only on tool subjects and reads the call's **effective** annotations through
+ * {@link EffectiveToolAnnotationSource}, which `core/approvals/annotations.ts` builds from the user's
+ * per-server trust (§4.7.1). A caller that wires no source gets {@link failClosedToolAnnotations}:
+ * the MCP fail-closed defaults, which describe a tool that writes, destroys, is not idempotent and
+ * reaches the open world.
+ *
+ * ## The asymmetry (§3.1 "Compound commands"), which is the whole point of this module
+ *
+ * **No allow entry of any matcher matches a command that does not statically resolve.** If
+ * {@link classifyCommand} cannot resolve it — composition, substitution, redirection — it is a
+ * non-match for `exact`, `glob` and `regexp` alike, so a glob can never span a command separator and
+ * `git *` never grants `git status && curl x | sh`.
+ *
+ * **A deny (or escalate) entry MAY match a compound command**, and is matched against every segment
+ * a shell would run as well as against the whole string, because a prohibition that catches
+ * something unresolvable errs in the direction that costs nothing.
+ *
+ * The same split governs a match the engine cannot decide (a regexp over its run-time budget, or an
+ * annotation set nothing can supply): **undecidable is a non-match on the allow side and a match on
+ * the restrictive side.** Each fails toward a prompt, never toward an execution.
+ *
+ * ## Resolution
+ *
+ * `deny` > `escalate` > `allow`, most-restrictive-wins: every deny entry is consulted before any
+ * escalate entry and every escalate entry before any allow entry, so **author order and merge order
+ * cannot change the outcome** and an appended entry can never perturb an existing one. Within a
+ * list the first match is reported, which decides only the provenance shown to the user.
+ *
+ * ## Case
+ *
+ * Shell `exact` / `glob` comparisons on the restrictive lists fold case, matching the established
+ * deny behaviour (`core/shell/denylist.ts`) — broader on a list whose breadth is fail-safe. Allow
+ * comparisons, tool names, and **every `regexp` on every list** are compared as written: silently
+ * adding an `i` flag to a pattern the user authored would make it mean something they did not write.
+ */
+import { type ApprovalEntry, type ShellApprovalGateNotice } from '#src/config/shell-policy.js';
+/** A gated `run_shell_command` call: the command exactly as the model proposed it. */
+export interface ShellApprovalSubject {
+    kind: 'shell';
+    /** RAW command. Normalization happens here so no caller can normalize differently. */
+    command: string;
+}
+/** A gated built-in / custom in-process tool call. */
+export interface ToolApprovalSubject {
+    kind: 'tool';
+    name: string;
+    /** §4.7.4 — the host this call reaches, where it has one. */
+    host?: string;
+}
+/**
+ * A gated MCP tool call. `server` is the user's own key in `mcpServers` (§4.7.5) — the only identity
+ * a server has that is stable, unique and user-authored, and the key its trust and its rule entries
+ * are both written against. Nothing a server declares about its own name ever participates.
+ */
+export interface McpToolApprovalSubject {
+    kind: 'mcpTool';
+    server: string;
+    name: string;
+    host?: string;
+}
+/** Any subject the matcher can be asked about. */
+export type ApprovalSubject = ShellApprovalSubject | ToolApprovalSubject | McpToolApprovalSubject;
+/**
+ * §4.7.1 — the four MCP `ToolAnnotations` booleans, as they **effectively** hold for a call after
+ * provenance and trust have been applied. All four are present: a hint entry asks a yes/no question
+ * of each name it uses, so "unknown" is expressed by the source returning `undefined` for the whole
+ * set, never by a missing key.
+ */
+export interface EffectiveToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+}
+/**
+ * Resolves the effective annotations of a tool call, or `undefined` when they cannot be determined
+ * — which the matcher treats as undecidable (non-match on allow, match on deny/escalate).
+ *
+ * This function type is the whole contract between the matcher and the trust model:
+ * `createEffectiveToolAnnotationSource` (`core/approvals/annotations.ts`) is the one implementation
+ * that applies per-server, per-hint trust (§4.7.1), and it is the ONLY place an effective set is
+ * derived. Nothing in this module knows how trust is decided, which is what lets the two evolve
+ * independently.
+ */
+export type EffectiveToolAnnotationSource = (subject: ToolApprovalSubject | McpToolApprovalSubject) => EffectiveToolAnnotations | undefined;
+/**
+ * The MCP fail-closed defaults (spec §4.7.2): a tool that has said nothing about itself is assumed
+ * to write, to destroy, to be non-idempotent and to reach the open world. These are the values the
+ * MCP specification itself defines for absent annotations, so an entry written against them is
+ * written against the protocol's own conservative reading.
+ *
+ * **Frozen**, and read-only to the type system, because it is shared: an effective set is something
+ * callers snapshot (§4.7.4 records one on a sticky grant), so a source that handed this object out
+ * instead of a copy would let one caller's snapshot rewrite the fail-closed floor for every other.
+ * Freezing turns that aliasing bug into an immediate throw rather than a silent, global loosening.
+ */
+export declare const MCP_FAIL_CLOSED_ANNOTATIONS: Readonly<EffectiveToolAnnotations>;
+/**
+ * The {@link EffectiveToolAnnotationSource} a caller gets when it wires none: every tool reads as
+ * {@link MCP_FAIL_CLOSED_ANNOTATIONS}.
+ *
+ * It is the safe default and not a stub — it is what a fully distrustful configuration computes
+ * anyway (§4.7.1: an untrusted server's effective set IS this constant), so a call site that has no
+ * annotations to offer behaves exactly like one whose user believes nothing. Deliberately NOT a
+ * trust model: trust needs config, and config belongs to `core/approvals/annotations.ts`.
+ *
+ * It answers with a **fresh object per call**, matching `createEffectiveToolAnnotationSource`, so
+ * the whole contract — not merely its configured half — is safe to snapshot.
+ */
+export declare const failClosedToolAnnotations: EffectiveToolAnnotationSource;
+/**
+ * §3.1 — the run-time budget for ONE `regexp` entry evaluation, in milliseconds.
+ *
+ * It is a **backstop reported rather than swallowed**, not the primary defence: a pattern is
+ * length-capped and compile-checked when the config loads (`approvalEntrySchema`), and a short
+ * pattern can still backtrack catastrophically. What this bounds is the damage — and, more
+ * importantly, it makes a pattern that stopped deciding *visible*, so a session in which one quietly
+ * fell out of use cannot be mistaken for one in which it works.
+ */
+export declare const REGEXP_MATCH_BUDGET_MS = 50;
+/** Tuning + seams for {@link resolveApprovalRules}. All optional; the defaults are the product's. */
+export interface ApprovalMatcherOptions {
+    /**
+     * Where a `hint` entry reads its effective values (§4.7.1). Build it with
+     * `createEffectiveToolAnnotationSource`; defaults to {@link failClosedToolAnnotations}.
+     */
+    annotations?: EffectiveToolAnnotationSource;
+    /**
+     * Where a run-time report goes — the established {@link ShellApprovalGateNotice} shape, which the
+     * runner forwards to `statusUpdate`. Absent means the report is dropped, which is why the runner
+     * always passes one.
+     */
+    onNotice?: (notice: ShellApprovalGateNotice) => void;
+    /** Override {@link REGEXP_MATCH_BUDGET_MS}. */
+    regexpBudgetMs?: number;
+    /** Clock, injectable so the budget backstop is testable without a pathological pattern. */
+    now?: () => number;
+}
+/**
+ * §3.2 — whether the rater still reviews a call this entry matched. Honored at the rater rungs and
+ * inert at the deterministic ones; a per-entry `rate` wins in **both** directions.
+ *
+ * The default derives from one principle: *an entry skips the rater only to the extent that it
+ * recorded what the rater would have seen.* A `shell` + `exact` entry recorded the whole command, so
+ * it needs no rating; a pattern recorded a shape, and a tool entry recorded identity (never
+ * arguments), so both keep the rater.
+ */
+export declare function approvalEntryRatesCall(entry: ApprovalEntry): boolean;
+/** The three declared lists, as one argument. */
+export interface ApprovalRuleLists {
+    allow: readonly ApprovalEntry[];
+    deny: readonly ApprovalEntry[];
+    escalate: readonly ApprovalEntry[];
+}
+/** What the rule lists decided about a call, or `null` when no entry matched. */
+export interface ApprovalRuleDecision {
+    /** §3 — most-restrictive-wins: `deny` over `escalate` over `allow`. */
+    action: 'deny' | 'escalate' | 'allow';
+    /** The entry that fired, for the provenance the prompt and the refusal message must show. */
+    entry: ApprovalEntry;
+    /**
+     * §3.2 — for an `allow` action, whether the rater still reviews the call as a **tripwire**.
+     * Always `false` for `deny` (nothing to rate) and for `escalate` (which goes straight to the
+     * human with no rating call, because the user pre-decided that a human answers).
+     */
+    rate: boolean;
+}
+/**
+ * §3.3 — resolve a call against all three lists, most-restrictive-wins.
+ *
+ * **Every** deny entry is consulted before **any** escalate entry, and every escalate entry before
+ * any allow entry. That ordering is the whole property: author order within a list, and the order
+ * in which lists were concatenated, cannot change the outcome, and appending an entry can never
+ * perturb an existing one. The first match inside a list decides only which entry is reported.
+ *
+ * Returns `null` when nothing matched — the rung then decides on its own.
+ */
+export declare function resolveApprovalRules(subject: ApprovalSubject, lists: ApprovalRuleLists, options?: ApprovalMatcherOptions): ApprovalRuleDecision | null;
+/**
+ * A one-line rendering of an entry, for the provenance a refusal message and an escalation prompt
+ * must carry (§3, §3.2) and for the `/approvals` list display.
+ *
+ * A `shell` + `exact` entry renders as its bare pattern — that is the command the user wrote, and
+ * decorating it would only get between them and the line they are looking for. Everything else says
+ * what kind of thing it is, because a pattern that is not the command needs to be readable as one.
+ */
+export declare function describeApprovalEntry(entry: ApprovalEntry): string;

package/dist/core/approvals/matcher.js

@@ -0,0 +1,267 @@
+import { classifyCommand } from '#src/core/shell/arity.js';
+import { normalizeCommand } from '#src/core/shell/normalize.js';
+import { commandSegments } from '#src/core/shell/denylist.js';
+import { StatusLevel } from '#src/core/types.js';
+/**
+ * The MCP fail-closed defaults (spec §4.7.2): a tool that has said nothing about itself is assumed
+ * to write, to destroy, to be non-idempotent and to reach the open world. These are the values the
+ * MCP specification itself defines for absent annotations, so an entry written against them is
+ * written against the protocol's own conservative reading.
+ *
+ * **Frozen**, and read-only to the type system, because it is shared: an effective set is something
+ * callers snapshot (§4.7.4 records one on a sticky grant), so a source that handed this object out
+ * instead of a copy would let one caller's snapshot rewrite the fail-closed floor for every other.
+ * Freezing turns that aliasing bug into an immediate throw rather than a silent, global loosening.
+ */
+export const MCP_FAIL_CLOSED_ANNOTATIONS = Object.freeze({
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+});
+/**
+ * The {@link EffectiveToolAnnotationSource} a caller gets when it wires none: every tool reads as
+ * {@link MCP_FAIL_CLOSED_ANNOTATIONS}.
+ *
+ * It is the safe default and not a stub — it is what a fully distrustful configuration computes
+ * anyway (§4.7.1: an untrusted server's effective set IS this constant), so a call site that has no
+ * annotations to offer behaves exactly like one whose user believes nothing. Deliberately NOT a
+ * trust model: trust needs config, and config belongs to `core/approvals/annotations.ts`.
+ *
+ * It answers with a **fresh object per call**, matching `createEffectiveToolAnnotationSource`, so
+ * the whole contract — not merely its configured half — is safe to snapshot.
+ */
+export const failClosedToolAnnotations = () => ({
+    ...MCP_FAIL_CLOSED_ANNOTATIONS,
+});
+/* -------------------------------------------------------------------------------------------- *
+ * The engine.
+ * -------------------------------------------------------------------------------------------- */
+/**
+ * §3.1 — the run-time budget for ONE `regexp` entry evaluation, in milliseconds.
+ *
+ * It is a **backstop reported rather than swallowed**, not the primary defence: a pattern is
+ * length-capped and compile-checked when the config loads (`approvalEntrySchema`), and a short
+ * pattern can still backtrack catastrophically. What this bounds is the damage — and, more
+ * importantly, it makes a pattern that stopped deciding *visible*, so a session in which one quietly
+ * fell out of use cannot be mistaken for one in which it works.
+ */
+export const REGEXP_MATCH_BUDGET_MS = 50;
+function contextFrom(options) {
+    return {
+        annotations: options?.annotations ?? failClosedToolAnnotations,
+        onNotice: options?.onNotice,
+        regexpBudgetMs: options?.regexpBudgetMs ?? REGEXP_MATCH_BUDGET_MS,
+        now: options?.now ?? Date.now,
+    };
+}
+/** Every regexp metacharacter EXCEPT `*`, which the glob translation owns. */
+const GLOB_METACHARACTERS = /[.+?^${}()|[\]\\]/g;
+/**
+ * §3.1 — compile a glob pattern. `*` matches any run of characters **including none**, matched
+ * against the **whole** string rather than token by token; everything else is literal.
+ *
+ * The consequence worth stating, because it is the first thing anyone gets wrong: `npm publish *`
+ * does NOT match a bare `npm publish` — the space before the `*` is part of the pattern.
+ * `npm publish*` matches both, and is almost always what was meant.
+ *
+ * The `s` flag is deliberate: a normalized compound command contains real line breaks (EXT-55 keeps
+ * them, because a line break is a command separator), and on the restrictive lists a `*` must be
+ * able to cross one. It can never do so on the allow side, where a command containing a separator
+ * has already been refused as unresolvable.
+ */
+function globToRegExp(pattern) {
+    const escaped = pattern.replace(GLOB_METACHARACTERS, '\\$&').replace(/\*/g, '.*');
+    return new RegExp(`^${escaped}$`, 's');
+}
+/**
+ * Evaluate a `regexp` entry against one candidate string, under the run-time budget.
+ *
+ * The pattern compiles as written — no flags are added. Silently making a user's pattern
+ * case-insensitive would make it mean something they did not write, on a list where breadth has
+ * consequences in both directions.
+ */
+function testRegexpPattern(pattern, candidate, ctx) {
+    let compiled;
+    try {
+        compiled = new RegExp(pattern);
+    }
+    catch {
+        // Unreachable via config (the schema compile-checks every pattern at load) and deliberately not
+        // an exception: a pattern that cannot be compiled cannot be decided, which the caller already
+        // knows how to fail safely on.
+        return 'undecidable';
+    }
+    const started = ctx.now();
+    const matched = compiled.test(candidate);
+    const elapsed = ctx.now() - started;
+    if (elapsed > ctx.regexpBudgetMs) {
+        ctx.onNotice?.({
+            level: StatusLevel.WARNING,
+            message: `An approvals regexp entry took ${elapsed}ms to evaluate, over its ${ctx.regexpBudgetMs}ms ` +
+                `budget, so it was treated as undecided for this call: ${pattern}. An allow entry that ` +
+                'cannot be decided does not approve, and a deny or escalate entry that cannot be decided ' +
+                'still applies. Simplify the pattern if this repeats.',
+        });
+        return 'undecidable';
+    }
+    return matched ? 'match' : 'no-match';
+}
+/** Compare one candidate string against a string-patterned entry. */
+function comparePattern(matcher, pattern, candidate, foldCase, ctx) {
+    if (matcher === 'regexp')
+        return testRegexpPattern(pattern, candidate, ctx);
+    const left = foldCase ? candidate.toLowerCase() : candidate;
+    const right = foldCase ? pattern.toLowerCase() : pattern;
+    if (matcher === 'exact')
+        return left === right ? 'match' : 'no-match';
+    return globToRegExp(right).test(left) ? 'match' : 'no-match';
+}
+/** Fold several candidate results: any match wins; otherwise any undecidable wins. */
+function foldMatches(results) {
+    if (results.includes('match'))
+        return 'match';
+    if (results.includes('undecidable'))
+        return 'undecidable';
+    return 'no-match';
+}
+/**
+ * A `shell` entry against a shell subject.
+ *
+ * On the **allow** side the command must statically resolve (§3.1) — that check comes FIRST and
+ * applies to every matcher, which is what stops a glob spanning a command separator — and the
+ * comparison is against the whole normalized command, as written.
+ *
+ * On the **restrictive** side the entry is compared against the whole normalized command AND
+ * against every segment a shell would run (`a; b`, `a && b`, the body of a `$(…)`), with case
+ * folded for `exact`/`glob`.
+ */
+function matchShellEntry(entry, command, mode, ctx) {
+    if (mode === 'allow') {
+        // §3.1 — no allow entry of ANY matcher matches a command that does not statically resolve.
+        if (classifyCommand(command, normalizeCommand) === null)
+            return 'no-match';
+        return comparePattern(entry.matcher, entry.pattern, normalizeCommand(command), false, ctx);
+    }
+    const candidates = [normalizeCommand(command), ...commandSegments(command)];
+    const foldCase = entry.matcher !== 'regexp';
+    return foldMatches(candidates.map((candidate) => comparePattern(entry.matcher, entry.pattern, candidate, foldCase, ctx)));
+}
+/**
+ * §3.1 — a `hint` pattern holds when **every** annotation it names holds effectively (AND within
+ * the entry; alternatives are separate entries). Hints it does not name are unconstrained. An empty
+ * pattern is a config error, so it cannot reach here as a match-everything.
+ */
+function matchHintPattern(pattern, subject, ctx) {
+    const effective = ctx.annotations(subject);
+    if (!effective)
+        return 'undecidable';
+    for (const [name, required] of Object.entries(pattern)) {
+        if (required === undefined)
+            continue;
+        if (effective[name] !== required)
+            return 'no-match';
+    }
+    return 'match';
+}
+/** One entry against one subject, in one list's fail-direction. */
+function matchEntry(entry, subject, mode, ctx) {
+    if (entry.type === 'shell') {
+        // A `shell` entry is about a command, so it says nothing about a tool call. `run_shell_command`
+        // is deliberately NOT also matchable as a `tool` subject — see `approvalSubjectFor` in the
+        // runner and [[EXT-30]].
+        return subject.kind === 'shell'
+            ? matchShellEntry(entry, subject.command, mode, ctx)
+            : 'no-match';
+    }
+    if (subject.kind === 'shell')
+        return 'no-match';
+    if (entry.type !== subject.kind)
+        return 'no-match';
+    if (entry.type === 'mcpTool' && subject.kind === 'mcpTool') {
+        // §3.1 — `*` is the reserved literal meaning every server, and a configured server may not be
+        // named it (validated at load).
+        if (entry.server !== '*' && entry.server !== subject.server)
+            return 'no-match';
+    }
+    // §4.7.4 — `host`, where present, is an additional exact-match condition. A call with no host
+    // never matches an entry that specifies one.
+    if (entry.host !== undefined) {
+        if (subject.host === undefined || subject.host !== entry.host)
+            return 'no-match';
+    }
+    if (entry.matcher === 'hint') {
+        return matchHintPattern(entry.pattern, subject, ctx);
+    }
+    return comparePattern(entry.matcher, entry.pattern, subject.name, false, ctx);
+}
+/**
+ * §3.2 — whether the rater still reviews a call this entry matched. Honored at the rater rungs and
+ * inert at the deterministic ones; a per-entry `rate` wins in **both** directions.
+ *
+ * The default derives from one principle: *an entry skips the rater only to the extent that it
+ * recorded what the rater would have seen.* A `shell` + `exact` entry recorded the whole command, so
+ * it needs no rating; a pattern recorded a shape, and a tool entry recorded identity (never
+ * arguments), so both keep the rater.
+ */
+export function approvalEntryRatesCall(entry) {
+    if (entry.rate !== undefined)
+        return entry.rate;
+    return !(entry.type === 'shell' && entry.matcher === 'exact');
+}
+/** The first entry of a list that matches, honoring the list's fail-direction. */
+function firstMatch(entries, subject, mode, ctx) {
+    for (const entry of entries) {
+        const result = matchEntry(entry, subject, mode, ctx);
+        if (result === 'match')
+            return entry;
+        // §3.1 — an allow match that cannot be decided is NOT a match (escalate); a deny match that
+        // cannot be decided IS one (refuse). Escalate follows deny: it fails toward a prompt, which is
+        // never an execution.
+        if (result === 'undecidable' && mode === 'restrictive')
+            return entry;
+    }
+    return null;
+}
+/**
+ * §3.3 — resolve a call against all three lists, most-restrictive-wins.
+ *
+ * **Every** deny entry is consulted before **any** escalate entry, and every escalate entry before
+ * any allow entry. That ordering is the whole property: author order within a list, and the order
+ * in which lists were concatenated, cannot change the outcome, and appending an entry can never
+ * perturb an existing one. The first match inside a list decides only which entry is reported.
+ *
+ * Returns `null` when nothing matched — the rung then decides on its own.
+ */
+export function resolveApprovalRules(subject, lists, options) {
+    const ctx = contextFrom(options);
+    const denied = firstMatch(lists.deny, subject, 'restrictive', ctx);
+    if (denied)
+        return { action: 'deny', entry: denied, rate: false };
+    const escalated = firstMatch(lists.escalate, subject, 'restrictive', ctx);
+    if (escalated)
+        return { action: 'escalate', entry: escalated, rate: false };
+    const allowed = firstMatch(lists.allow, subject, 'allow', ctx);
+    if (allowed)
+        return { action: 'allow', entry: allowed, rate: approvalEntryRatesCall(allowed) };
+    return null;
+}
+/**
+ * A one-line rendering of an entry, for the provenance a refusal message and an escalation prompt
+ * must carry (§3, §3.2) and for the `/approvals` list display.
+ *
+ * A `shell` + `exact` entry renders as its bare pattern — that is the command the user wrote, and
+ * decorating it would only get between them and the line they are looking for. Everything else says
+ * what kind of thing it is, because a pattern that is not the command needs to be readable as one.
+ */
+export function describeApprovalEntry(entry) {
+    const pattern = typeof entry.pattern === 'string' ? entry.pattern : JSON.stringify(entry.pattern);
+    const host = entry.type !== 'shell' && entry.host ? ` (host ${entry.host})` : '';
+    if (entry.type === 'shell') {
+        return entry.matcher === 'exact' ? pattern : `${pattern} (${entry.matcher})`;
+    }
+    const matcher = entry.matcher === 'exact' ? '' : ` (${entry.matcher})`;
+    const subject = entry.type === 'mcpTool' ? `mcpTool ${entry.server}/${pattern}` : `tool ${pattern}`;
+    return `${subject}${matcher}${host}`;
+}
+//# sourceMappingURL=matcher.js.map

package/dist/core/approvals/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../../src/core/approvals/matcher.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAuC,MAAM,CAAC,MAAM,CAAC;IAC3F,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAkC,GAAG,EAAE,CAAC,CAAC;IAC7E,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AAEH;;kGAEkG;AAElG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAuCzC,SAAS,WAAW,CAAC,OAA2C;IAC9D,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,yBAAyB;QAC9D,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,sBAAsB;QACjE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG;KAC9B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAiB,EAAE,GAAiB;IAC9E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,8FAA8F;QAC9F,+BAA+B;QAC/B,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACb,KAAK,EAAE,WAAW,CAAC,OAAO;YAC1B,OAAO,EACL,kCAAkC,OAAO,4BAA4B,GAAG,CAAC,cAAc,KAAK;gBAC5F,yDAAyD,OAAO,wBAAwB;gBACxF,0FAA0F;gBAC1F,sDAAsD;SACzD,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AACxC,CAAC;AAED,qEAAqE;AACrE,SAAS,cAAc,CACrB,OAAoC,EACpC,OAAe,EACf,SAAiB,EACjB,QAAiB,EACjB,GAAiB;IAEjB,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/D,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,OAA8B;IACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAC1D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,KAAyB,EACzB,OAAe,EACf,IAAe,EACf,GAAiB;IAEjB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,2FAA2F;QAC3F,IAAI,eAAe,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3E,OAAO,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC5C,OAAO,WAAW,CAChB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CACvE,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,OAA4B,EAC5B,OAAqD,EACrD,GAAiB;IAEjB,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAGlD,EAAE,CAAC;QACJ,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CACjB,KAAoB,EACpB,OAAwB,EACxB,IAAe,EACf,GAAiB;IAEjB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,gGAAgG;QAChG,2FAA2F;QAC3F,yBAAyB;QACzB,OAAO,OAAO,CAAC,IAAI,KAAK,OAAO;YAC7B,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;YACpD,CAAC,CAAC,UAAU,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IACnD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3D,8FAA8F;QAC9F,gCAAgC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC;IACjF,CAAC;IACD,8FAA8F;IAC9F,6CAA6C;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,UAAU,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAChD,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;AAChE,CAAC;AAuBD,kFAAkF;AAClF,SAAS,UAAU,CACjB,OAAiC,EACjC,OAAwB,EACxB,IAAe,EACf,GAAiB;IAEjB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACrC,4FAA4F;QAC5F,+FAA+F;QAC/F,sBAAsB;QACtB,IAAI,MAAM,KAAK,aAAa,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,KAAwB,EACxB,OAAgC;IAEhC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAElE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAE5E,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC;IACvE,MAAM,OAAO,GACX,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;IACtF,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/core/approvals/mcpSubjects.d.ts

@@ -0,0 +1,40 @@
+import type { McpToolApprovalSubject, ToolApprovalSubject } from '#src/core/approvals/matcher.js';
+/**
+ * The server identity an MCP tool call gets when its name does not resolve to exactly one
+ * configured `mcpServers` key — nothing matched, or two nested keys both did.
+ *
+ * **The empty string, and that is load-bearing rather than arbitrary.** A server key is
+ * `z.string().min(1)` both under `approvals.mcp.servers` (§9) and on an `mcpTool` rule entry
+ * (§3.1), so this value is the one identity a user *cannot spell in config*: no entry can name it.
+ * An unresolvable call is therefore matchable only by the reserved `server: "*"` (which means every
+ * server and is correct here).
+ *
+ * Being unspellable is what makes it unnameable; it is **not** by itself what makes it untrusted,
+ * because a lookup that misses under `servers` falls through to `approvals.mcp.defaults`. That
+ * second half is enforced in `trustedAnnotationHints`, which refuses this value outright, and in
+ * `mcpDeclaredAnnotationLookup`, which will not look a declaration up under it. Both are required:
+ * the first stops a permissive `defaults` reaching an unattributable call, the second stops one
+ * being found by string arithmetic on the sentinel.
+ */
+export declare const UNRESOLVED_MCP_SERVER = "";
+/** Does this registered tool name sit in the MCP namespace? */
+export declare function isMcpNamespacedToolName(toolName: string): boolean;
+/**
+ * The registered tool name mcp-adapters emits for one server's tool — the inverse of
+ * {@link approvalSubjectForToolName}'s split, single-sourced so a declared-annotation lookup keyed
+ * by registered name round-trips exactly instead of re-deriving the separator.
+ */
+export declare function mcpToolRegisteredName(server: string, toolName: string): string;
+/**
+ * §4.7.1/§4.7.5 — the subject a gated call on `toolName` presents to the rule matcher.
+ *
+ * A name outside the MCP namespace is one of ours (a built-in, or a tool the user wired into their
+ * own config): `kind: 'tool'`, the trusted provenance. A name inside it is `kind: 'mcpTool'`
+ * **always** — with its resolved server where the configured keys name exactly one, and with
+ * {@link UNRESOLVED_MCP_SERVER} otherwise.
+ *
+ * @param toolName The registered tool name, exactly as the model called it.
+ * @param configuredMcpServers `Object.keys(config.mcpServers)` — the user's own keys, and the only
+ *   thing consulted. Nothing a server declares about its own name ever participates (§4.7.5).
+ */
+export declare function approvalSubjectForToolName(toolName: string, configuredMcpServers: Iterable<string>): ToolApprovalSubject | McpToolApprovalSubject;

package/dist/core/approvals/mcpSubjects.js

@@ -0,0 +1,99 @@
+/**
+ * @module core/approvals/mcpSubjects
+ *
+ * EXT-70 (spec §4.7.5) — **which approval subject a registered tool name presents**.
+ *
+ * The distinction this module exists to make is the one §4.7.1 rests on: a `tool` subject's
+ * annotations are read **verbatim**, an `mcpTool` subject's are believed only per hint and only
+ * where the user said so. So a tool that reaches a third-party server while presenting as
+ * `kind: 'tool'` is a gate that server can opt itself out of — the exact failure §4.7.1 names.
+ * Every name carrying the MCP namespace therefore becomes an `mcpTool` subject, and there is no
+ * path back to `kind: 'tool'` for one.
+ *
+ * ## The server is resolved against the configured keys, never by splitting
+ *
+ * An MCP tool is named `mcp__<server>__<tool>` (the mcp-adapters convention, single-sourced from
+ * {@link MCP_TOOL_NAME_PREFIX}), where `<server>` is the user's own `mcpServers` key — the identity
+ * §4.7.5 requires. **A key may itself contain `__`**, so splitting on the separator attributes such
+ * a tool to a shorter key that also happens to be configured, and the wrong server means the wrong
+ * TRUST lookup: one server's tool wearing another server's belief. Resolution is therefore a scan
+ * of the configured key set for the keys that actually prefix this name.
+ *
+ * Where that does not yield **exactly one** key — no configured server matches, or two nested keys
+ * both do — the call resolves to {@link UNRESOLVED_MCP_SERVER}, which is still an `mcpTool`
+ * subject. Failing closed to "an MCP tool under a server we cannot name" is the only safe answer;
+ * falling back to `kind: 'tool'` would hand an unidentifiable tool the trusted provenance.
+ */
+import { MCP_TOOL_NAME_PREFIX } from '#src/constants.js';
+/** The separator mcp-adapters puts between the prefix, the server key and the tool name. */
+const NAME_SEPARATOR = '__';
+/** The `mcp__` namespace every MCP tool name carries. */
+const MCP_NAME_PREFIX = `${MCP_TOOL_NAME_PREFIX}${NAME_SEPARATOR}`;
+/**
+ * The server identity an MCP tool call gets when its name does not resolve to exactly one
+ * configured `mcpServers` key — nothing matched, or two nested keys both did.
+ *
+ * **The empty string, and that is load-bearing rather than arbitrary.** A server key is
+ * `z.string().min(1)` both under `approvals.mcp.servers` (§9) and on an `mcpTool` rule entry
+ * (§3.1), so this value is the one identity a user *cannot spell in config*: no entry can name it.
+ * An unresolvable call is therefore matchable only by the reserved `server: "*"` (which means every
+ * server and is correct here).
+ *
+ * Being unspellable is what makes it unnameable; it is **not** by itself what makes it untrusted,
+ * because a lookup that misses under `servers` falls through to `approvals.mcp.defaults`. That
+ * second half is enforced in `trustedAnnotationHints`, which refuses this value outright, and in
+ * `mcpDeclaredAnnotationLookup`, which will not look a declaration up under it. Both are required:
+ * the first stops a permissive `defaults` reaching an unattributable call, the second stops one
+ * being found by string arithmetic on the sentinel.
+ */
+export const UNRESOLVED_MCP_SERVER = '';
+/** Does this registered tool name sit in the MCP namespace? */
+export function isMcpNamespacedToolName(toolName) {
+    return toolName.startsWith(MCP_NAME_PREFIX);
+}
+/**
+ * The registered tool name mcp-adapters emits for one server's tool — the inverse of
+ * {@link approvalSubjectForToolName}'s split, single-sourced so a declared-annotation lookup keyed
+ * by registered name round-trips exactly instead of re-deriving the separator.
+ */
+export function mcpToolRegisteredName(server, toolName) {
+    return `${MCP_NAME_PREFIX}${server}${NAME_SEPARATOR}${toolName}`;
+}
+/**
+ * §4.7.1/§4.7.5 — the subject a gated call on `toolName` presents to the rule matcher.
+ *
+ * A name outside the MCP namespace is one of ours (a built-in, or a tool the user wired into their
+ * own config): `kind: 'tool'`, the trusted provenance. A name inside it is `kind: 'mcpTool'`
+ * **always** — with its resolved server where the configured keys name exactly one, and with
+ * {@link UNRESOLVED_MCP_SERVER} otherwise.
+ *
+ * @param toolName The registered tool name, exactly as the model called it.
+ * @param configuredMcpServers `Object.keys(config.mcpServers)` — the user's own keys, and the only
+ *   thing consulted. Nothing a server declares about its own name ever participates (§4.7.5).
+ */
+export function approvalSubjectForToolName(toolName, configuredMcpServers) {
+    if (!isMcpNamespacedToolName(toolName))
+        return { kind: 'tool', name: toolName };
+    let resolved;
+    for (const server of configuredMcpServers) {
+        // An empty key is unnameable in `approvals.mcp.servers` and on an `mcpTool` entry, so resolving
+        // to it would be indistinguishable from not resolving at all — treat it as the latter.
+        if (server === UNRESOLVED_MCP_SERVER)
+            continue;
+        const prefix = mcpToolRegisteredName(server, '');
+        if (!toolName.startsWith(prefix))
+            continue;
+        const name = toolName.slice(prefix.length);
+        if (name.length === 0)
+            continue;
+        // A second matching key means two nested server names both explain this tool. Neither is more
+        // right than the other, so neither is used.
+        if (resolved)
+            return { kind: 'mcpTool', server: UNRESOLVED_MCP_SERVER, name: toolName };
+        resolved = { kind: 'mcpTool', server, name };
+    }
+    // Nothing configured explains the name: keep the whole name as the tool's identity, since there
+    // is no server key to strip and guessing at one is exactly what this function refuses to do.
+    return resolved ?? { kind: 'mcpTool', server: UNRESOLVED_MCP_SERVER, name: toolName };
+}
+//# sourceMappingURL=mcpSubjects.js.map

package/dist/core/approvals/mcpSubjects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpSubjects.js","sourceRoot":"","sources":["../../../src/core/approvals/mcpSubjects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGzD,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,yDAAyD;AACzD,MAAM,eAAe,GAAG,GAAG,oBAAoB,GAAG,cAAc,EAAE,CAAC;AAEnE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,+DAA+D;AAC/D,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,QAAgB;IACpE,OAAO,GAAG,eAAe,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,oBAAsC;IAEtC,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEhF,IAAI,QAA4C,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,gGAAgG;QAChG,uFAAuF;QACvF,IAAI,MAAM,KAAK,qBAAqB;YAAE,SAAS;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,8FAA8F;QAC9F,4CAA4C;QAC5C,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxF,QAAQ,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,gGAAgG;IAChG,6FAA6F;IAC7F,OAAO,QAAQ,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACxF,CAAC"}