@maadb/core 0.0.1 → 0.7.9

package/dist/mcp/response.d.ts

@@ -0,0 +1,109 @@
+import type { Result, MaadError } from '../errors.js';
+import type { ValidationWarning } from '../types.js';
+import type { ProvenanceMode } from './config.js';
+export declare function setProvenanceMode(mode: ProvenanceMode): void;
+export declare function getProvenanceMode(): ProvenanceMode;
+export declare function successResponse(data: unknown, toolName?: string): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+export declare function errorResponse(errors: MaadError[]): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+export declare function resultToResponse<T>(result: Result<T>, toolName?: string): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+/**
+ * 0.7.1 (R3) — Projected-size guard for list-returning tools. Computes the
+ * byte size of the serialized response before returning; rejects with
+ * RESPONSE_TOO_LARGE when over cap. Prevents silent truncation when the MCP
+ * client's tool-output harness caps the response (~80KB in Claude Code).
+ *
+ * Cap is read lazily from MAAD_RESPONSE_MAX_BYTES each call so tests can
+ * flip it via env without re-importing the module. Default 64KB gives
+ * headroom below the observed Claude Code ceiling.
+ *
+ * Only applies to success responses — error responses are small and
+ * stamping them risks hiding the original error. Returns the input
+ * unchanged for errors or when under cap.
+ */
+export declare function responseMaxBytes(): number;
+export declare function guardResponseSize(response: {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+}, context: {
+    tool: string;
+    hint?: string;
+}): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+/**
+ * Attach or merge fields into `_meta` on an already-serialized tool response.
+ * Used by the MCP wrapper to stamp request_id onto every response so clients
+ * can quote it in bug reports. Non-breaking (MCP allows extra fields).
+ */
+export declare function attachMeta(response: {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+}, meta: Record<string, unknown>): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+/**
+ * Attach validation warnings to `_meta.warnings[]`. No-op when the input is
+ * empty or undefined — avoids polluting responses for writes that produced
+ * no warnings. Used by write-tool handlers (maad_create / maad_update /
+ * maad_bulk_*) after a successful engine call.
+ */
+export declare function attachWarnings(response: {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+}, warnings: ValidationWarning[] | undefined): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+/**
+ * 0.6.10 — Stamp commit-durability signals onto a write response. Always
+ * attaches `write_durable`. When the commit failed (write landed on disk
+ * but the git commit didn't), also attaches `commit_failure` with the
+ * action / code / message so the client can log forensics or retry.
+ * `write_durable: true` attaches nothing else — existing clients that
+ * ignore `_meta` see zero behavioral change.
+ */
+export declare function attachDurability(response: {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+}, writeDurable: boolean, commitFailure: {
+    code: string;
+    message: string;
+    action: 'create' | 'update' | 'delete';
+} | undefined): {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+//# sourceMappingURL=response.d.ts.map

package/dist/mcp/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../src/mcp/response.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIlD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAE5D;AAED,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAiBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAMpH;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAarG;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAG5H;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,EAC5D,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAuBpD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,EAC5D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAcpD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,EAC5D,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,GACxC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAGpD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,EAC5D,YAAY,EAAE,OAAO,EACrB,aAAa,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,GAAG,SAAS,GACnG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAKpD"}

package/dist/mcp/response.js

@@ -0,0 +1,132 @@
+// ============================================================================
+// MCP Response Contract — standard { ok, data|errors } shape for all tools
+// Provenance mode injects _source metadata when enabled.
+// ============================================================================
+let provenanceMode = 'off';
+export function setProvenanceMode(mode) {
+    provenanceMode = mode;
+}
+export function getProvenanceMode() {
+    return provenanceMode;
+}
+export function successResponse(data, toolName) {
+    const response = { ok: true, data };
+    if (provenanceMode !== 'off' && toolName) {
+        response._source = toolName;
+    }
+    return { content: [{ type: 'text', text: JSON.stringify(response) }] };
+}
+export function errorResponse(errors) {
+    const response = {
+        ok: false,
+        errors: errors.map(e => {
+            const base = {
+                code: e.code,
+                message: e.message,
+            };
+            if (e.details !== undefined)
+                base.details = e.details;
+            return base;
+        }),
+    };
+    return { content: [{ type: 'text', text: JSON.stringify(response) }] };
+}
+export function resultToResponse(result, toolName) {
+    if (result.ok)
+        return successResponse(result.value, toolName);
+    return errorResponse(result.errors);
+}
+/**
+ * 0.7.1 (R3) — Projected-size guard for list-returning tools. Computes the
+ * byte size of the serialized response before returning; rejects with
+ * RESPONSE_TOO_LARGE when over cap. Prevents silent truncation when the MCP
+ * client's tool-output harness caps the response (~80KB in Claude Code).
+ *
+ * Cap is read lazily from MAAD_RESPONSE_MAX_BYTES each call so tests can
+ * flip it via env without re-importing the module. Default 64KB gives
+ * headroom below the observed Claude Code ceiling.
+ *
+ * Only applies to success responses — error responses are small and
+ * stamping them risks hiding the original error. Returns the input
+ * unchanged for errors or when under cap.
+ */
+export function responseMaxBytes() {
+    const raw = process.env['MAAD_RESPONSE_MAX_BYTES'];
+    if (!raw)
+        return 65536;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : 65536;
+}
+export function guardResponseSize(response, context) {
+    const first = response.content[0];
+    if (!first || first.type !== 'text')
+        return response;
+    const cap = responseMaxBytes();
+    const bytes = Buffer.byteLength(first.text, 'utf8');
+    if (bytes <= cap)
+        return response;
+    // Only reject success responses — error responses are small and should pass through.
+    let parsed;
+    try {
+        parsed = JSON.parse(first.text);
+    }
+    catch {
+        return response;
+    }
+    if (parsed.ok === false)
+        return response;
+    const hint = context.hint ?? 'Narrow field projection, add filters, or paginate with cursor';
+    return errorResponse([{
+            code: 'RESPONSE_TOO_LARGE',
+            message: `Projected response (${bytes} bytes) exceeds cap (${cap} bytes)`,
+            details: { projectedBytes: bytes, capBytes: cap, hint, tool: context.tool },
+        }]);
+}
+/**
+ * Attach or merge fields into `_meta` on an already-serialized tool response.
+ * Used by the MCP wrapper to stamp request_id onto every response so clients
+ * can quote it in bug reports. Non-breaking (MCP allows extra fields).
+ */
+export function attachMeta(response, meta) {
+    const first = response.content[0];
+    if (!first || first.type !== 'text')
+        return response;
+    let parsed;
+    try {
+        parsed = JSON.parse(first.text);
+    }
+    catch {
+        return response;
+    }
+    const existing = parsed._meta ?? {};
+    parsed._meta = { ...existing, ...meta };
+    return { content: [{ type: 'text', text: JSON.stringify(parsed) }] };
+}
+/**
+ * Attach validation warnings to `_meta.warnings[]`. No-op when the input is
+ * empty or undefined — avoids polluting responses for writes that produced
+ * no warnings. Used by write-tool handlers (maad_create / maad_update /
+ * maad_bulk_*) after a successful engine call.
+ */
+export function attachWarnings(response, warnings) {
+    if (!warnings || warnings.length === 0)
+        return response;
+    return attachMeta(response, { warnings });
+}
+/**
+ * 0.6.10 — Stamp commit-durability signals onto a write response. Always
+ * attaches `write_durable`. When the commit failed (write landed on disk
+ * but the git commit didn't), also attaches `commit_failure` with the
+ * action / code / message so the client can log forensics or retry.
+ * `write_durable: true` attaches nothing else — existing clients that
+ * ignore `_meta` see zero behavioral change.
+ */
+export function attachDurability(response, writeDurable, commitFailure) {
+    if (writeDurable)
+        return attachMeta(response, { write_durable: true });
+    const meta = { write_durable: false };
+    if (commitFailure)
+        meta['commit_failure'] = commitFailure;
+    return attachMeta(response, meta);
+}
+//# sourceMappingURL=response.js.map

package/dist/mcp/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../src/mcp/response.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,yDAAyD;AACzD,+EAA+E;AAM/E,IAAI,cAAc,GAAmB,KAAK,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC;AACxB,CAAC;AAiBD,MAAM,UAAU,eAAe,CAAC,IAAa,EAAE,QAAiB;IAC9D,MAAM,QAAQ,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,cAAc,KAAK,KAAK,IAAI,QAAQ,EAAE,CAAC;QACzC,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,MAAM,QAAQ,GAAgB;QAC5B,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACrB,MAAM,IAAI,GAAyE;gBACjF,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;KACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAI,MAAiB,EAAE,QAAiB;IACtE,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAA4D,EAC5D,OAAwC;IAExC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IAErD,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IAElC,qFAAqF;IACrF,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,+DAA+D,CAAC;IAC7F,OAAO,aAAa,CAAC,CAAC;YACpB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,uBAAuB,KAAK,wBAAwB,GAAG,SAAS;YACzE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SAC5E,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,QAA4D,EAC5D,IAA6B;IAE7B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAI,MAAM,CAAC,KAA6C,IAAI,EAAE,CAAC;IAC7E,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACxC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA4D,EAC5D,QAAyC;IAEzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4D,EAC5D,YAAqB,EACrB,aAAoG;IAEpG,IAAI,YAAY;QAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAA4B,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAC/D,IAAI,aAAa;QAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,aAAa,CAAC;IAC1D,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/mcp/roles.d.ts

@@ -0,0 +1,7 @@
+export type Role = 'reader' | 'writer' | 'admin';
+export declare function getToolsForRole(role: Role): ReadonlySet<string>;
+export declare function parseRole(raw: string | undefined): Role;
+export declare function roleSatisfies(have: Role, need: Role): boolean;
+export declare function minRole(a: Role, b: Role): Role;
+export declare function getMinRoleForTool(toolName: string): Role | null;
+//# sourceMappingURL=roles.d.ts.map

package/dist/mcp/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/mcp/roles.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AA8BjD,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAE/D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAGvD;AAKD,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAE7D;AAGD,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,CAE9C;AAID,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAK/D"}

package/dist/mcp/roles.js

@@ -0,0 +1,56 @@
+// ============================================================================
+// MCP Roles — role definitions and tool filtering
+// ============================================================================
+const READER_TOOLS = [
+    'maad_scan', 'maad_summary', 'maad_describe',
+    'maad_get', 'maad_query', 'maad_search', 'maad_related', 'maad_schema', 'maad_aggregate', 'maad_join',
+    'maad_verify', 'maad_changes_since',
+    'maad_history', 'maad_audit',
+    'maad_subscribe', 'maad_unsubscribe',
+];
+const WRITER_TOOLS = [
+    ...READER_TOOLS,
+    'maad_create', 'maad_update', 'maad_validate', 'maad_bulk_create', 'maad_bulk_update',
+];
+const ADMIN_TOOLS = [
+    ...WRITER_TOOLS,
+    'maad_delete', 'maad_reindex', 'maad_reload', 'maad_health',
+    'maad_instance_reload',
+    'maad_subscriptions',
+    'maad_issue_token', 'maad_revoke_token', 'maad_rotate_token',
+    'maad_list_tokens', 'maad_show_token',
+];
+const ROLE_TOOLS = {
+    reader: READER_TOOLS,
+    writer: WRITER_TOOLS,
+    admin: ADMIN_TOOLS,
+};
+export function getToolsForRole(role) {
+    return new Set(ROLE_TOOLS[role]);
+}
+export function parseRole(raw) {
+    if (raw === 'reader' || raw === 'writer' || raw === 'admin')
+        return raw;
+    return 'reader'; // default: least privilege
+}
+const ROLE_RANK = { reader: 0, writer: 1, admin: 2 };
+// Returns true if `have` satisfies at least the level of `need`.
+export function roleSatisfies(have, need) {
+    return ROLE_RANK[have] >= ROLE_RANK[need];
+}
+// Returns the more restrictive of two roles.
+export function minRole(a, b) {
+    return ROLE_RANK[a] <= ROLE_RANK[b] ? a : b;
+}
+// Inverse of getToolsForRole: for a given tool name, what's the minimum role
+// that can call it? Returns null for unknown tools.
+export function getMinRoleForTool(toolName) {
+    if (READER_TOOLS.includes(toolName))
+        return 'reader';
+    if (WRITER_TOOLS.includes(toolName))
+        return 'writer';
+    if (ADMIN_TOOLS.includes(toolName))
+        return 'admin';
+    return null;
+}
+//# sourceMappingURL=roles.js.map

package/dist/mcp/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/mcp/roles.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAI/E,MAAM,YAAY,GAAG;IACnB,WAAW,EAAE,cAAc,EAAE,eAAe;IAC5C,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW;IACrG,aAAa,EAAE,oBAAoB;IACnC,cAAc,EAAE,YAAY;IAC5B,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAEX,MAAM,YAAY,GAAG;IACnB,GAAG,YAAY;IACf,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB;CAC7E,CAAC;AAEX,MAAM,WAAW,GAAG;IAClB,GAAG,YAAY;IACf,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa;IAC3D,sBAAsB;IACtB,oBAAoB;IACpB,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB;IAC5D,kBAAkB,EAAE,iBAAiB;CAC7B,CAAC;AAEX,MAAM,UAAU,GAAoC;IAClD,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IACxE,OAAO,QAAQ,CAAC,CAAC,2BAA2B;AAC9C,CAAC;AAED,MAAM,SAAS,GAAyB,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE3E,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,IAAU;IAClD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,OAAO,CAAC,CAAO,EAAE,CAAO;IACtC,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAK,YAAkC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5E,IAAK,YAAkC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5E,IAAK,WAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,33 @@
+export type Transport = 'stdio' | 'http' | 'unix';
+export interface HttpServeOptions {
+    host: string;
+    port: number;
+    maxBodyBytes: number;
+    headersTimeoutMs: number;
+    requestTimeoutMs: number;
+    keepAliveTimeoutMs: number;
+    trustProxy: boolean;
+    idleMs: number;
+    authToken?: string | undefined;
+    /**
+     * 0.7.5 (fup-2026-148) — Unix domain socket path. When set with
+     * transport='unix' (or 'http' with this populated), the server binds
+     * to this socket instead of host:port. Same MCP protocol; trusted-host
+     * deploy pattern.
+     */
+    socketPath?: string | undefined;
+    /** Socket file mode (octal). Default 0o660. */
+    socketMode?: number | undefined;
+}
+export interface ServeOptions {
+    projectRoot?: string | undefined;
+    instancePath?: string | undefined;
+    role?: string | undefined;
+    dryRun?: boolean | undefined;
+    toolAllowlist?: string[] | undefined;
+    provenance?: string | undefined;
+    transport?: Transport | undefined;
+    http?: HttpServeOptions | undefined;
+}
+export declare function startServer(opts: ServeOptions): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAyCA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACrC;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+NnE"}

package/dist/mcp/server.js

@@ -0,0 +1,242 @@
+// ============================================================================
+// MCP Server — transport setup and tool registration
+// Lifecycle, config, and guardrails are extracted into separate modules.
+// ============================================================================
+import { createRequire } from 'node:module';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { buildConfig } from './config.js';
+import { startHttpTransport } from './transport/http.js';
+import { initTransportTelemetry, recordSessionClose } from './transport/telemetry.js';
+const require = createRequire(import.meta.url);
+const pkg = require('../../package.json');
+import { setGuardrailConfig } from './guardrails.js';
+import { setProvenanceMode } from './response.js';
+import { initIdempotencyCache, readIdempotencyEnv } from './idempotency.js';
+import { initRateLimiter, readRateLimitEnv } from './rate-limit.js';
+import { initLogging, readLoggingEnv, logOpsChannelReady } from '../logging.js';
+import { installSignalHandlers } from './shutdown.js';
+import { installReloadSignalHandler } from './reload-signal.js';
+import { getRateLimiter } from './rate-limit.js';
+import { logger } from '../engine/logger.js';
+import { synthesizeLegacyInstance, loadInstance } from '../instance/config.js';
+import { EnginePool } from '../instance/pool.js';
+import { SessionRegistry } from '../instance/session.js';
+import { parseRole } from './roles.js';
+import { TokenStore } from '../auth/token-store.js';
+import { checkHttpAuthAtBoot } from './transport/auth.js';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import * as discoverTools from './tools/discover.js';
+import * as readTools from './tools/read.js';
+import * as writeTools from './tools/write.js';
+import * as auditTools from './tools/audit.js';
+import * as maintainTools from './tools/maintain.js';
+import * as instanceTools from './tools/instance.js';
+import * as authTools from './tools/auth.js';
+export async function startServer(opts) {
+    // Resolve the instance: either loaded from instance.yaml or synthesized
+    // from a legacy --project path so existing clients upgrade without changes.
+    let instance;
+    if (opts.instancePath) {
+        const loaded = await loadInstance(opts.instancePath);
+        if (!loaded.ok) {
+            const messages = loaded.errors.map(e => `${e.code}: ${e.message}`).join('; ');
+            console.error(`MAAD MCP: instance config invalid: ${messages}`);
+            process.exit(1);
+        }
+        instance = loaded.value;
+    }
+    else if (opts.projectRoot) {
+        const config = buildConfig({ projectRoot: opts.projectRoot, role: opts.role, dryRun: opts.dryRun, toolAllowlist: opts.toolAllowlist, provenance: opts.provenance });
+        instance = synthesizeLegacyInstance(config.projectRoot, parseRole(config.role));
+    }
+    else {
+        console.error('MAAD MCP: must provide --project or --instance (or MAAD_PROJECT / MAAD_INSTANCE env var)');
+        process.exit(1);
+    }
+    // Build global guardrail + provenance state from opts
+    const dryRun = opts.dryRun ?? (process.env.MAAD_DRY_RUN === '1' || process.env.MAAD_DRY_RUN === 'true');
+    const provenance = opts.provenance ?? process.env.MAAD_PROV ?? 'off';
+    setGuardrailConfig({ dryRun, toolAllowlist: opts.toolAllowlist });
+    setProvenanceMode(provenance);
+    initLogging(readLoggingEnv());
+    // 0.7.3 (fup-2026-096) — emit one self-check line so deploy validation can
+    // confirm the ops channel is wired before any tool call. If this line is
+    // missing in journalctl/stderr, no other ops event (commit_failed,
+    // rate_limited, validation_warning) will surface either.
+    const loggingEnv = readLoggingEnv();
+    logOpsChannelReady({
+        destination: loggingEnv.pretty ? 'pretty' : 'stderr',
+        level: loggingEnv.level ?? 'info',
+        pid: process.pid,
+    });
+    initIdempotencyCache(readIdempotencyEnv());
+    initRateLimiter(readRateLimitEnv());
+    // 0.7.0 — Load the token registry (HTTP+file mode) or null-out for stdio/synthetic.
+    // Boot-mode enforcement happens in the HTTP branch below; in stdio/synthetic
+    // the registry is irrelevant (no bearer channel). Parse errors at startup
+    // refuse to boot — operator sees the exact file path + js-yaml error.
+    let tokens = null;
+    if (instance.source === 'file' && instance.configPath) {
+        const instanceRoot = path.dirname(instance.configPath);
+        const loaded = await TokenStore.load(instanceRoot);
+        if (!loaded.ok) {
+            const messages = loaded.errors.map(e => `${e.code}: ${e.message}`).join('; ');
+            console.error(`MAAD MCP: token registry invalid: ${messages}`);
+            process.exit(1);
+        }
+        tokens = loaded.value;
+    }
+    // Build the instance-scoped runtime context
+    const pool = new EnginePool(instance);
+    // 0.7.3 (fup-2026-150) — start idle-timeout sweeper. Defaults: 30 min idle,
+    // 60s sweep. Set MAAD_PROJECT_IDLE_TIMEOUT_MS=0 to disable.
+    pool.startIdleSweeper(EnginePool.readIdleSweepEnv());
+    const sessions = new SessionRegistry(instance);
+    const ctx = { instance, pool, sessions, tokens };
+    // For the legacy synthetic path we eager-init the single engine so the
+    // first tool call is fast and any startup errors surface immediately. In
+    // real instance mode, projects are lazy — engines init on first use.
+    if (instance.source === 'synthetic') {
+        const eager = await pool.get('default');
+        if (!eager.ok) {
+            const messages = eager.errors.map(e => `${e.code}: ${e.message}`).join('; ');
+            console.error(`MAAD MCP: engine initialization failed: ${messages}`);
+            process.exit(1);
+        }
+    }
+    // Tool registration factory. Stdio creates one server for the process.
+    // HTTP creates a fresh server per session (per SDK example pattern) — tool
+    // registration is cheap (schema only, no engine work), so the per-session
+    // cost is negligible and isolation is cleaner.
+    const legacyRole = instance.source === 'synthetic' ? parseRole(opts.role) : 'admin';
+    const buildMcpServer = () => {
+        const server = new McpServer({ name: 'maad', version: pkg.version });
+        let toolCount = 0;
+        if (instance.source === 'file') {
+            toolCount += instanceTools.register(server, ctx);
+        }
+        toolCount += discoverTools.register(server, ctx);
+        toolCount += readTools.register(server, ctx);
+        toolCount += auditTools.register(server, ctx);
+        if (legacyRole === 'writer' || legacyRole === 'admin') {
+            toolCount += writeTools.register(server, ctx);
+        }
+        if (legacyRole === 'admin') {
+            toolCount += maintainTools.register(server, ctx);
+            // maad_instance_reload always registers for admin, even on synthetic
+            // instances — handler rejects synthetic with INSTANCE_RELOAD_SYNTHETIC
+            // rather than an opaque "unknown tool" response.
+            toolCount += instanceTools.registerReload(server, ctx);
+            // 0.7.0 — admin token registry tools. Handler refuses if ctx.tokens is
+            // null (stdio/synthetic mode has no registry); registering always so
+            // synthetic clients get a clear TOKENS_FILE_MISSING error rather than
+            // an opaque "unknown tool" response.
+            toolCount += authTools.register(server, ctx);
+        }
+        return { server, toolCount };
+    };
+    const transportKind = opts.transport ?? 'stdio';
+    if (transportKind === 'http' || transportKind === 'unix') {
+        if (!opts.http) {
+            console.error(`MAAD MCP: --transport ${transportKind} requires HTTP/UDS config`);
+            process.exit(1);
+        }
+        if (transportKind === 'unix' && !opts.http.socketPath) {
+            console.error('MAAD MCP: --transport unix requires --unix-socket=<path> (or MAAD_UNIX_SOCKET env)');
+            process.exit(1);
+        }
+        // 0.7.0 — Legacy single-bearer mode hard-removed (dec-maadb-071). HTTP
+        // requires _auth/tokens.yaml with ≥1 active entry. Stale MAAD_AUTH_TOKEN
+        // env config surfaces a distinctive LEGACY_BEARER_REMOVED error so
+        // operators see the migration hint before chasing a generic boot failure.
+        // 0.7.5 — UDS transport reuses the same auth gate; bearer is still required
+        // (filesystem perms are defense-in-depth, not a replacement).
+        if (instance.source !== 'file' || !instance.configPath) {
+            console.error(`MAAD MCP: --transport ${transportKind} requires --instance (synthetic --project mode is stdio-only)`);
+            process.exit(1);
+        }
+        const instanceRoot = path.dirname(instance.configPath);
+        const storeExists = existsSync(path.join(instanceRoot, '_auth', 'tokens.yaml'));
+        const bootErr = checkHttpAuthAtBoot(tokens, storeExists, opts.http.authToken);
+        if (bootErr !== null) {
+            console.error(`MAAD MCP: ${bootErr}`);
+            process.exit(1);
+        }
+        // One-time registration log using a throwaway count from a probe server.
+        // In HTTP mode the real server instances are built per session.
+        const { toolCount } = buildMcpServer();
+        const transportLabel = transportKind === 'unix'
+            ? `unix:${opts.http.socketPath}`
+            : `http://${opts.http.host}:${opts.http.port}`;
+        logger.info('mcp', 'startup', `${toolCount} tools registered — instance "${instance.name}" (${instance.source}), ${instance.projects.length} project(s)${dryRun ? ' (dry-run)' : ''} [transport=${transportKind}, ${transportLabel}]`);
+        initTransportTelemetry(transportKind === 'unix'
+            ? { kind: 'unix', socketPath: opts.http.socketPath }
+            : { kind: 'http', host: opts.http.host, port: opts.http.port });
+        // Wire session-close fan-out: when a session is destroyed (for any
+        // reason — client DELETE, transport drop, idle sweep, shutdown), release
+        // its per-session rate-limit state and emit the session_close audit event
+        // with the measured duration. Additional handlers stack in registration order.
+        ctx.sessions.registerCloseHandler((sid, reason) => {
+            getRateLimiter().disposeSession(sid);
+            recordSessionClose({ session_id: sid, reason });
+        });
+        const handle = await startHttpTransport({
+            host: opts.http.host,
+            port: opts.http.port,
+            socketPath: transportKind === 'unix' ? opts.http.socketPath : undefined,
+            socketMode: transportKind === 'unix' ? opts.http.socketMode : undefined,
+            maxBodyBytes: opts.http.maxBodyBytes,
+            headersTimeoutMs: opts.http.headersTimeoutMs,
+            requestTimeoutMs: opts.http.requestTimeoutMs,
+            keepAliveTimeoutMs: opts.http.keepAliveTimeoutMs,
+            trustProxy: opts.http.trustProxy,
+            idleMs: opts.http.idleMs,
+            tokens: tokens,
+            sessions: ctx.sessions,
+            instance,
+            serverFactory: () => buildMcpServer().server,
+        });
+        installSignalHandlers({ pool, rateLimiter: getRateLimiter() }, {
+            finalCleanup: async () => {
+                try {
+                    await handle.close();
+                }
+                catch { /* best-effort */ }
+            },
+        });
+        installReloadSignalHandler(ctx);
+        return;
+    }
+    // stdio — single server, single transport, lifetime of the process
+    initTransportTelemetry({ kind: 'stdio' });
+    const { server, toolCount } = buildMcpServer();
+    logger.info('mcp', 'startup', `${toolCount} tools registered — instance "${instance.name}" (${instance.source}), ${instance.projects.length} project(s)${dryRun ? ' (dry-run)' : ''}`);
+    // 0.6.11 — stdio live-notification notifier. stdio has exactly one session
+    // per process, synthesized lazily on first tool call. Register on create so
+    // the sid is known before we install the notifier. Unregister on close.
+    const { registerNotifier: regN, unregisterNotifier: unregN } = await import('./notifications.js');
+    ctx.sessions.registerCreateHandler((sid) => {
+        regN(sid, async (event) => {
+            await server.server.sendResourceUpdated({
+                uri: `maad://records/${event.docId}`,
+                ...{ action: event.action, docId: event.docId, docType: event.docType, project: event.project, updatedAt: event.updatedAt },
+            });
+        });
+    });
+    ctx.sessions.registerCloseHandler((sid) => { unregN(sid); });
+    installSignalHandlers({ pool, rateLimiter: getRateLimiter() }, {
+        finalCleanup: async () => {
+            try {
+                await server.close();
+            }
+            catch { /* best-effort */ }
+        },
+    });
+    installReloadSignalHandler(ctx);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    logger.info('mcp', 'startup', 'Server started on stdio');
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,qDAAqD;AACrD,yEAAyE;AACzE,+EAA+E;AAE/E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAA4B,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEtF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAoC7C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB;IAClD,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,QAAwB,CAAC;IAC7B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACpK,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC;IACxG,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAClE,iBAAiB,CAAC,UAAiB,CAAC,CAAC;IACrC,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,yEAAyE;IACzE,mEAAmE;IACnE,yDAAyD;IACzD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,kBAAkB,CAAC;QACjB,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACpD,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,MAAM;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC3C,eAAe,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpC,oFAAoF;IACpF,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,CAAC,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,4EAA4E;IAC5E,4DAA4D;IAC5D,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAE9D,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAEpF,MAAM,cAAc,GAAG,GAA6C,EAAE;QACpE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjD,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YACtD,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACjD,qEAAqE;YACrE,uEAAuE;YACvE,iDAAiD;YACjD,SAAS,IAAI,aAAa,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,MAAM,aAAa,GAAc,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAE3D,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,aAAa,2BAA2B,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,aAAa,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtD,OAAO,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,yBAAyB,aAAa,+DAA+D,CAAC,CAAC;YACrH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAO,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,aAAa,KAAK,MAAM;YAC7C,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YAChC,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAC1B,GAAG,SAAS,iCAAiC,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,cAAc,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,eAAe,aAAa,KAAK,cAAc,GAAG,CAAC,CAAC;QAE3M,sBAAsB,CACpB,aAAa,KAAK,MAAM;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAW,EAAE;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CACjE,CAAC;QAEF,mEAAmE;QACnE,yEAAyE;QACzE,0EAA0E;QAC1E,+EAA+E;QAC/E,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAChD,cAAc,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACrC,kBAAkB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAwB,MAAM,kBAAkB,CAAC;YAC3D,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,UAAU,EAAE,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACvE,UAAU,EAAE,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACvE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAC5C,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAC5C,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,MAAM,EAAE,MAAO;YACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ;YACR,aAAa,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,MAAM;SAC7C,CAAC,CAAC;QAEH,qBAAqB,CACnB,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EACvC;YACE,YAAY,EAAE,KAAK,IAAI,EAAE;gBACvB,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC3D,CAAC;SACF,CACF,CAAC;QACF,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,mEAAmE;IACnE,sBAAsB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAC1B,GAAG,SAAS,iCAAiC,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,cAAc,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3J,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBACtC,GAAG,EAAE,kBAAkB,KAAK,CAAC,KAAK,EAAE;gBACpC,GAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAA8B;aACzJ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,qBAAqB,CACnB,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EACvC;QACE,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC;KACF,CACF,CAAC;IACF,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;AAC3D,CAAC"}