@mcp-index/sdk 0.18.0 → 0.19.0

package/dist/src/lock/store.js

@@ -0,0 +1,459 @@
+/**
+ * LockStore: where a host gets its lock snapshot and where approvals land.
+ *
+ * A snapshot is frozen and carries a snapshotId, so a decision can name the
+ * lock state it came from. loadSnapshot never throws for a bad lock: a lock
+ * failure comes back as a LockError inside the snapshot, and the check then
+ * withholds everything. It may throw when the store itself cannot be reached;
+ * hosts treat that as lock-unreadable.
+ *
+ * The file store reads `.mcp/` once per load (see lock.ts). Approvals and
+ * revocations take the existing create-excl file lock on `.mcp/lock.lck`
+ * (fileLock.ts), write the contract, then replace the shard (and the manifest,
+ * when one exists) by rename from a temporary file in `.mcp/`, so `.mcp/lock`
+ * never holds a partial file.
+ */
+import { closeSync, constants, fsyncSync, lstatSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { basename, dirname, isAbsolute, join, parse, resolve, sep } from "node:path";
+import { canonicalBody, instructionsDigest, metaDigest, toolDigest } from "./digest.js";
+import { FrozenMap, LockError, MANIFEST, VIA, formatManifest, formatShard, identityKey, loadLock, loadLockSync, readLockDir, shardFilename, validateIdentity, } from "./lock.js";
+import { withExclusiveLock } from "../fileLock.js";
+import { sigstoreVerifier } from "./signing.js";
+export function nowRfc3339(date = new Date()) {
+    return date.toISOString().replace(/\.[0-9]{3}Z$/, "Z");
+}
+export function snapshotOfError(error, loadedAt = Date.now()) {
+    return Object.freeze({ snapshotId: `error:${error.reason}`, loadedAt, lock: error });
+}
+export function prepareTool(tool) {
+    if (tool === null || typeof tool !== "object" || Array.isArray(tool))
+        throw new Error("tool must be an object");
+    const name = Object.getOwnPropertyDescriptor(tool, "name")?.value;
+    if (typeof name !== "string")
+        throw new Error("tool has no string name");
+    const digest = toolDigest(tool);
+    const body = canonicalBody(tool);
+    if (digest === null || body === null)
+        throw new Error(`tool ${JSON.stringify(name)} has no digest; it cannot be approved`);
+    return { name, digest, contract: `sha256-${digest.slice("sha256:".length)}.json`, body, metaDigest: metaDigest(tool) };
+}
+export function checkApprovalFields(request, subject) {
+    if (!VIA.includes(request.via))
+        throw new Error(`unknown via ${String(request.via)}`);
+    if (typeof subject !== "string" || subject.length === 0)
+        throw new Error("approval needs a subject");
+    const at = request.at ?? nowRfc3339();
+    if (!/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$/.test(at)) {
+        throw new Error("approval time is not RFC 3339");
+    }
+    if (request.ref !== undefined && typeof request.ref !== "string")
+        throw new Error("ref must be a string");
+    return request.ref !== undefined
+        ? Object.freeze({ subject, at, via: request.via, ref: request.ref })
+        : Object.freeze({ subject, at, via: request.via });
+}
+/**
+ * A host-owned file holding the sequence as ASCII digits and a newline, the
+ * format the Python host writes to its sequence_path. A missing file is no
+ * record; a file that is not a regular file or does not hold digits throws.
+ */
+export function fileSequenceStore(path) {
+    const full = resolve(path);
+    return {
+        read() {
+            let st;
+            try {
+                st = lstatSync(full);
+            }
+            catch (exc) {
+                if (exc.code === "ENOENT")
+                    return null;
+                throw new Error("last accepted sequence is unreadable");
+            }
+            if (!st.isFile())
+                throw new Error("last accepted sequence is not a regular file");
+            let raw;
+            try {
+                raw = readFileSync(full);
+            }
+            catch {
+                throw new Error("last accepted sequence is unreadable");
+            }
+            if (raw.some((b) => b > 0x7f))
+                throw new Error("last accepted sequence is unreadable");
+            const text = raw.toString("latin1").trim();
+            if (!/^[0-9]+$/.test(text))
+                throw new Error("last accepted sequence is not an integer");
+            const n = Number(text);
+            if (!Number.isSafeInteger(n))
+                throw new Error("last accepted sequence is not an integer");
+            return n;
+        },
+        write(sequence) {
+            writeAtomic(dirname(full), full, Buffer.from(`${sequence}\n`, "ascii"), basename(full));
+        },
+    };
+}
+// Host configuration paths ---------------------------------------------------
+/** A host configuration the host must not run with. Thrown when a store is constructed. */
+export class HostConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HostConfigError";
+    }
+}
+function exists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** (st_dev, st_ino) of what `path` resolves to, or null when it does not resolve. */
+function identity(path) {
+    try {
+        const st = statSync(path, { bigint: true });
+        return `${st.dev}:${st.ino}`;
+    }
+    catch {
+        return null;
+    }
+}
+function realpathOrSelf(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return path;
+    }
+}
+/**
+ * One host path walked without lexical normalization (section 8.2, draft
+ * 1e). A relative path gets the working directory prefixed as a string, so a
+ * `..` is left for the operating system: after a symlink it goes up from the
+ * link's target. The longest existing leading part is resolved with
+ * realpath(3) and the rest appended only when it holds no `..`.
+ */
+function walkHostPath(value) {
+    const absolute = isAbsolute(value) ? value : `${process.cwd()}${sep}${value}`;
+    const root = parse(absolute).root || sep;
+    const parts = absolute.slice(root.length).split(/[\\/]+/).filter((p) => p !== "" && p !== ".");
+    const prefixes = [root];
+    for (const part of parts) {
+        const last = prefixes[prefixes.length - 1];
+        prefixes.push(last.endsWith(sep) ? `${last}${part}` : `${last}${sep}${part}`);
+    }
+    let existing = 0;
+    while (existing + 1 < prefixes.length && identity(prefixes[existing + 1]) !== null)
+        existing += 1;
+    const real = realpathOrSelf(prefixes[existing]);
+    const rest = parts.slice(existing);
+    if (existing + 1 < prefixes.length && exists(prefixes[existing + 1])) {
+        return { refusal: "is a symbolic link that does not resolve", chain: [], resolved: real };
+    }
+    if (rest.includes(".."))
+        return { refusal: "has a .. below the part that exists", chain: [], resolved: real };
+    const chain = prefixes.slice(0, existing + 1);
+    for (let dir = real;; dir = dirname(dir)) {
+        chain.push(dir);
+        if (dirname(dir) === dir)
+            break;
+    }
+    return { refusal: null, chain, resolved: rest.length === 0 ? real : join(real, ...rest) };
+}
+/**
+ * Where the system puts a host path: realpath of its longest existing part
+ * with the rest appended. FileLockStore opens this form, so the file it
+ * writes is the one hostPathProblem checked.
+ */
+export function resolvedHostPath(value) {
+    return walkHostPath(value).resolved;
+}
+/**
+ * What a `.git` file points at: "module" when its gitdir lies under
+ * `modules` inside a git directory (a submodule), "worktree" when under
+ * `worktrees` (a linked worktree), else "unknown".
+ */
+function gitFileKind(path) {
+    let text;
+    try {
+        text = readFileSync(path).subarray(0, 4096).toString("utf8");
+    }
+    catch {
+        return "unknown";
+    }
+    const line = text.split(/\r?\n/)[0] ?? "";
+    if (!line.startsWith("gitdir:"))
+        return "unknown";
+    const target = resolve(dirname(path), line.slice("gitdir:".length).trim());
+    const parts = target.split(sep);
+    const at = parts.lastIndexOf(".git");
+    if (at < 0)
+        return "unknown";
+    const tail = parts.slice(at + 1);
+    if (tail.includes("modules"))
+        return "module";
+    if (tail[0] === "worktrees")
+        return "worktree";
+    return "unknown";
+}
+function isDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The repository that holds the lock (section 8.2, draft 1e), walking up
+ * from the resolved lock root. A `.git` directory ends the walk, and so does
+ * a `.git` file pointing into a git directory's `worktrees/` (a linked
+ * worktree's top). Any other `.git` file, a submodule's or one that names
+ * neither, is a candidate: the walk goes on so a submodule resolves to its
+ * superproject, and the candidate stands when nothing above has a `.git`
+ * entry. With no entry at all the repository is the lock root, and only the
+ * lock root is protected.
+ */
+export function repositoryRoot(lockRoot) {
+    const start = resolvedHostPath(lockRoot);
+    let candidate = null;
+    for (let dir = start;; dir = dirname(dir)) {
+        const git = join(dir, ".git");
+        if (exists(git)) {
+            if (isDirectory(git) || gitFileKind(git) === "worktree")
+                return dir;
+            candidate ??= dir;
+        }
+        if (dirname(dir) === dir)
+            return candidate ?? start;
+    }
+}
+/**
+ * Null if every named host path lies outside the repository that holds the
+ * lock and the lock root, else what is wrong. Inside means an existing
+ * leading part of the path as given, or an ancestor of its resolved form, is
+ * the same directory (device and inode) as the repository root or the lock
+ * root.
+ */
+export function hostPathProblem(lockRoot, paths) {
+    const repo = repositoryRoot(lockRoot);
+    const roots = new Set([identity(repo), identity(lockRoot)].filter((i) => i !== null));
+    for (const [key, value] of Object.entries(paths)) {
+        if (value === null || value === undefined)
+            continue;
+        const { refusal, chain } = walkHostPath(value);
+        if (refusal !== null)
+            return `${key} ${refusal}`;
+        if (chain.some((dir) => roots.has(identity(dir) ?? ""))) {
+            return `${key} lies inside the repository that holds the lock (${repo}); whoever writes the lock could choose it`;
+        }
+    }
+    return null;
+}
+function writeAtomic(dir, target, data, prefix = "") {
+    const tmp = join(dir, `.${prefix}mcplock-${process.pid}-${randomBytes(6).toString("hex")}.tmp`);
+    let flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL;
+    if (typeof constants.O_NOFOLLOW === "number")
+        flags |= constants.O_NOFOLLOW;
+    const fd = openSync(tmp, flags, 0o644);
+    try {
+        writeSync(fd, data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(tmp, target);
+    }
+    catch (exc) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // best effort
+        }
+        throw exc;
+    }
+}
+/** The higher of two sequence floors; null only when both are. */
+export function sequenceFloor(a, b) {
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    return Math.max(a, b);
+}
+export class FileLockStore {
+    #root;
+    #config;
+    #sequences;
+    /** In-memory floor for this store instance; never lowered. */
+    #lastSequence = null;
+    #now;
+    #verifier;
+    /** Throws HostConfigError when sequencePath or trustedRootPath lies inside the lock's repository. */
+    constructor(options) {
+        const problem = hostPathProblem(options.root, {
+            sequencePath: options.sequencePath,
+            trustedRootPath: options.trustedRootPath,
+        });
+        if (problem !== null)
+            throw new HostConfigError(problem);
+        this.#root = options.root;
+        this.#config = options;
+        // The resolved forms: the files opened are the ones the path rule checked.
+        this.#sequences =
+            options.sequenceStore ??
+                (options.sequencePath !== undefined ? fileSequenceStore(resolvedHostPath(options.sequencePath)) : null);
+        this.#verifier =
+            options.verifier ??
+                (options.trustedRootPath !== undefined
+                    ? sigstoreVerifier({ trustedRootPath: resolvedHostPath(options.trustedRootPath) })
+                    : null);
+        this.#now = options.now ?? Date.now;
+    }
+    async loadSnapshot() {
+        const signer = this.#config.signer ?? null;
+        const loadedAt = this.#now();
+        try {
+            let last = null;
+            if (signer !== null) {
+                if (this.#sequences === null) {
+                    throw new LockError("lock-signature-invalid", "a signer is configured but the host config names no sequence store (sequencePath); rollback cannot be refused");
+                }
+                let stored;
+                try {
+                    stored = this.#sequences.read();
+                }
+                catch (exc) {
+                    throw new LockError("lock-signature-invalid", exc.message ?? "last accepted sequence is unreadable");
+                }
+                last = sequenceFloor(stored, this.#lastSequence);
+            }
+            const config = {
+                requireManifest: this.#config.requireManifest ?? false,
+                signer,
+                sequenceStore: this.#sequences !== null,
+                verifier: this.#verifier,
+                lastSequence: last,
+            };
+            const loaded = await loadLock(this.#root, config);
+            const seq = loaded.lock.sequence;
+            if (signer !== null && seq !== null && (last === null || seq > last)) {
+                this.#lastSequence = seq;
+                try {
+                    this.#sequences?.write(seq);
+                }
+                catch {
+                    // As in the Python host: not recording the new floor weakens rollback
+                    // protection on the next start; the in-memory floor still holds, and
+                    // this load is no less trustworthy.
+                }
+            }
+            return Object.freeze({ snapshotId: loaded.snapshotId, loadedAt, lock: loaded.lock });
+        }
+        catch (exc) {
+            if (exc instanceof LockError)
+                return snapshotOfError(exc, loadedAt);
+            return snapshotOfError(new LockError("lock-unreadable", exc.message ?? "read failed"), loadedAt);
+        }
+    }
+    /** Edit one shard under the file lock. `edit` returns the new shard. */
+    #edit(identity, edit) {
+        const ident = validateIdentity(identity);
+        const mcp = join(this.#root, ".mcp");
+        const lockDir = join(mcp, "lock");
+        withExclusiveLock(lockDir, () => {
+            // A writer refuses to build on a lock it cannot read. Signatures are not
+            // checked here; the next signed load verifies whatever was written.
+            const current = loadLockSync(this.#root, { requireManifest: false });
+            const shard = current.lock.shards.get(identityKey(ident)) ?? null;
+            const contractsDir = join(mcp, "contracts");
+            const writeContract = (p) => {
+                // The contract name is its own digest, so an existing file with that
+                // name was already verified by the load above if referenced; rewriting
+                // the same bytes is harmless.
+                try {
+                    writeAtomic(contractsDir, join(contractsDir, p.contract), p.body);
+                }
+                catch (exc) {
+                    const code = exc.code;
+                    if (code !== "ENOENT")
+                        throw exc;
+                    throw new Error(".mcp/contracts is missing; create it before approving");
+                }
+            };
+            const next = edit(shard, writeContract);
+            const name = shardFilename(next.identity);
+            const bytes = formatShard(next);
+            writeAtomic(mcp, join(lockDir, name), bytes);
+            const signer = this.#config.signer ?? null;
+            if (current.lock.sequence !== null || this.#config.requireManifest === true || signer !== null) {
+                // Same rule as the Python store: write a manifest when one exists or
+                // the host requires or signs one. The old signature no longer covers
+                // it; re-signing is the signer's job, and a signed host fails closed
+                // until then.
+                const sequence = current.lock.sequence === null ? 1 : current.lock.sequence + 1;
+                writeAtomic(mcp, join(lockDir, MANIFEST), formatManifest(sequence, readLockDir(lockDir)));
+            }
+        });
+    }
+    async approve(request) {
+        const subject = request.subject;
+        if (subject === undefined)
+            throw new Error("file store approvals need a subject");
+        const approval = checkApprovalFields(request, subject);
+        if ("tool" in request) {
+            const prepared = prepareTool(request.tool);
+            this.#edit(request.identity, (shard, writeContract) => {
+                writeContract(prepared);
+                const entry = prepared.metaDigest === null
+                    ? Object.freeze({ digest: prepared.digest, contract: prepared.contract, approval })
+                    : Object.freeze({ digest: prepared.digest, contract: prepared.contract, metaDigest: prepared.metaDigest, approval });
+                const tools = new Map(shard?.tools ?? []);
+                tools.set(prepared.name, entry); // Map.set keeps an existing name in place, appends a new one
+                return {
+                    identity: shard?.identity ?? validateIdentity(request.identity),
+                    attributes: shard?.attributes ?? null,
+                    instructions: shard?.instructions ?? null,
+                    tools: new FrozenMap(tools),
+                };
+            });
+            return;
+        }
+        const digest = instructionsDigest(request.instructions);
+        if (digest === null)
+            throw new Error("instructions have no digest; they cannot be approved");
+        this.#edit(request.identity, (shard) => ({
+            identity: shard?.identity ?? validateIdentity(request.identity),
+            attributes: shard?.attributes ?? null,
+            instructions: digest,
+            tools: shard?.tools ?? new FrozenMap([]),
+        }));
+    }
+    async revoke(request) {
+        this.#edit(request.identity, (shard) => {
+            if (shard === null)
+                throw new Error("no shard for this identity");
+            if ("tool" in request) {
+                if (!shard.tools.has(request.tool))
+                    throw new Error(`tool ${JSON.stringify(request.tool)} is not approved`);
+                const tools = new Map(shard.tools);
+                tools.delete(request.tool);
+                return { ...shardFields(shard), tools: new FrozenMap(tools) };
+            }
+            if (shard.instructions === null)
+                throw new Error("instructions are not approved");
+            return { ...shardFields(shard), instructions: null };
+        });
+    }
+}
+function shardFields(shard) {
+    return { identity: shard.identity, attributes: shard.attributes, instructions: shard.instructions, tools: shard.tools };
+}
+//# sourceMappingURL=store.js.map

package/dist/src/lock/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/lock/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxJ,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,GAAG,EACH,cAAc,EACd,WAAW,EACX,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmChD,MAAM,UAAU,UAAU,CAAC,OAAa,IAAI,IAAI,EAAE;IAChD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAgB,EAAE,WAAmB,IAAI,CAAC,GAAG,EAAE;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,KAAK,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAYD,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;IAClE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC3H,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACzH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,OAAe;IAC1E,IAAI,CAAE,GAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrG,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;IACtC,IAAI,CAAC,6FAA6F,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1G,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;QAC9B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACpE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACvD,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO;QACL,IAAI;YACF,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClF,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACxF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1F,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,CAAC,QAAgB;YACpB,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,2FAA2F;AAC3F,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAW,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAW,CAAC,KAAK,IAAI;QAAE,QAAQ,IAAI,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAW,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,0CAA0C,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9G,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC9C,KAAK,IAAI,GAAG,GAAG,IAAI,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,MAAM;IAClC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,IAAI,GAAG,GAAG,KAAK,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,UAAU;gBAAE,OAAO,GAAG,CAAC;YACpE,SAAS,KAAK,GAAG,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,SAAS,IAAI,KAAK,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAA0D;IAC1G,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,GAAG,oDAAoD,IAAI,4CAA4C,CAAC;QACpH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgCD,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc,EAAE,IAAgB,EAAE,MAAM,GAAG,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,WAAW,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChG,IAAI,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC;IACtE,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;QAAE,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC;IAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,CAAgB,EAAE,CAAgB;IAC9D,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,OAAO,aAAa;IACf,KAAK,CAAS;IACd,OAAO,CAAuB;IAC9B,UAAU,CAAuB;IAC1C,8DAA8D;IAC9D,aAAa,GAAkB,IAAI,CAAC;IAC3B,IAAI,CAAe;IACnB,SAAS,CAA0B;IAE5C,qGAAqG;IACrG,YAAY,OAA6B;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,2EAA2E;QAC3E,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,aAAa;gBACrB,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1G,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,QAAQ;gBAChB,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;oBACpC,CAAC,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBAClF,CAAC,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,IAAI,GAAkB,IAAI,CAAC;YAC/B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,SAAS,CACjB,wBAAwB,EACxB,+GAA+G,CAChH,CAAC;gBACJ,CAAC;gBACD,IAAI,MAAqB,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAClC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAG,GAAa,CAAC,OAAO,IAAI,sCAAsC,CAAC,CAAC;gBAClH,CAAC;gBACD,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAiB;gBAC3B,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,KAAK;gBACtD,MAAM;gBACN,aAAa,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI;gBACvC,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjC,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;gBACzB,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,sEAAsE;oBACtE,qEAAqE;oBACrE,oCAAoC;gBACtC,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,SAAS;gBAAE,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,eAAe,CAAC,IAAI,SAAS,CAAC,iBAAiB,EAAG,GAAa,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,QAAkB,EAAE,IAAsE;QAC9F,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE;YAC9B,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;YAClE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,CAAC,CAAe,EAAQ,EAAE;gBAC9C,qEAAqE;gBACrE,uEAAuE;gBACvE,8BAA8B;gBAC9B,IAAI,CAAC;oBACH,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;oBAC7C,IAAI,IAAI,KAAK,QAAQ;wBAAE,MAAM,GAAG,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAChC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC/F,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,cAAc;gBACd,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAChF,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;gBACpD,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACxB,MAAM,KAAK,GACT,QAAQ,CAAC,UAAU,KAAK,IAAI;oBAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBACnF,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC7D,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,6DAA6D;gBAC9F,OAAO;oBACL,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAC/D,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI;oBACrC,YAAY,EAAE,KAAK,EAAE,YAAY,IAAI,IAAI;oBACzC,KAAK,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC/D,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI;YACrC,YAAY,EAAE,MAAM;YACpB,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,SAAS,CAAoB,EAAE,CAAC;SAC5D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YACrC,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAClE,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC5G,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAClF,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC1H,CAAC"}

package/dist/src/wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2C,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAErG,OAAO,EAEL,SAAS,EACT,OAAO,EAQR,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAuB,YAAY,EAA+C,MAAM,gBAAgB,CAAC;AAShH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAW,MAAM,gBAAgB,CAAC;AAU5E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AACpD,OAAO,EAAU,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOpD;;6DAE6D;AAC7D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC;;uEAEmE;IACnE,QAAQ,CAAC,YAAY,EAAG,MAAM,GAAG,IAAI,CAAC;gBAGpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,UAAU,GAAG,IAAI,EAC7B,OAAO,EAAE,MAAM,EACf,YAAY,GAAE,MAAM,GAAG,IAAW;CAiBrC;AAED;;;iFAGiF;AACjF,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B;;;;kCAI8B;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;kFAC8E;IAC9E,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B;+FAC2F;IAC3F,cAAc,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5D,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACvG;;uFAEmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uBAAuB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC;;;;;;kDAM8C;IAC9C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA0gCD;;;;;;;;;;;;;;;;;wDAiBwD;AACxD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC;IACnC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IACxE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAAC;IACvF,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,wBAAgB,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,CA6FrF;AAED,gFAAgF;AAChF,wBAAgB,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAExF"}
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2C,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAErG,OAAO,EAEL,SAAS,EACT,OAAO,EAQR,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAuB,YAAY,EAA+C,MAAM,gBAAgB,CAAC;AAShH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAW,MAAM,gBAAgB,CAAC;AAU5E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AACpD,OAAO,EAAU,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOpD;;6DAE6D;AAC7D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC;;uEAEmE;IACnE,QAAQ,CAAC,YAAY,EAAG,MAAM,GAAG,IAAI,CAAC;gBAGpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,UAAU,GAAG,IAAI,EAC7B,OAAO,EAAE,MAAM,EACf,YAAY,GAAE,MAAM,GAAG,IAAW;CAiBrC;AAED;;;iFAGiF;AACjF,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B;;;;kCAI8B;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;kFAC8E;IAC9E,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B;+FAC2F;IAC3F,cAAc,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5D,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACvG;;uFAEmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uBAAuB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC;;;;;;kDAM8C;IAC9C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAsmCD;;;;;;;;;;;;;;;;;wDAiBwD;AACxD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC;IACnC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IACxE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAAC;IACvF,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,wBAAgB,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,CAmGrF;AAED,gFAAgF;AAChF,wBAAgB,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAExF"}

package/dist/src/wrap.js

@@ -187,6 +187,12 @@ function cursorOfRequest(request) {
         return null;
     return cursorText(params.cursor);
 }
+/** The task id a `tasks/result` request names, or that a CreateTaskResult carries. */
+function taskIdOf(value, key) {
+    const holder = attrOrKey(value, key);
+    const id = attrOrKey(holder, "taskId");
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
 function cursorText(value) {
     return typeof value === "string" && value.length > 0 ? value : null;
 }
@@ -232,6 +238,8 @@ class Interceptor {
     // list page that started after the notification carries it; until then its calls hold
     // under guard and strict. Per name, because the MCP client's refresh reads page 1 only.
     staleNames = new Set();
+    // Task id -> the tool whose gated call created it, so a task result is scanned under that name.
+    taskTools = new Map();
     contextWatcher;
     contextObserved = false;
     // Names pinned by the current list window when it opened on an empty, untainted
@@ -715,6 +723,9 @@ class Interceptor {
                 return result.then((r) => this.filterList(r, window, epoch, firstSight));
             return this.filterList(result, window, epoch, firstSight);
         }
+        if (method === "tasks/result") {
+            return this.gateResult(this.taskToolName(taskIdOf(args[0], "params")), reqFn.apply(target, args));
+        }
         if (method !== "tools/call") {
             return reqFn.apply(target, args);
         }
@@ -727,7 +738,12 @@ class Interceptor {
             // resolves a CallToolResult (the SAME shape `gateResult` extracts content/structuredContent
             // from). A transport/schema that resolves a raw envelope instead -> content/structuredContent
             // absent -> not scanned (v1 boundary, documented; the pre-call gate still covers the call).
-            return this.gateResult(toolName, reqFn.apply(target, args));
+            // A task-augmented call resolves a CreateTaskResult; its id is kept for the later result.
+            const raw = reqFn.apply(target, args);
+            const noted = isThenable(raw)
+                ? raw.then((value) => this.noteTask(toolName, value, "task"))
+                : this.noteTask(toolName, raw, "task");
+            return this.gateResult(toolName, noted);
         }
         // The SDK `request()` is async (returns a Promise<SchemaOutput>), so — like
         // `callTool` — a HOLD must surface as a REJECTED Promise, not a sync throw,
@@ -751,6 +767,17 @@ class Interceptor {
      * `_client` for the experimental seam, which it captured itself). */
     requestStream(streamFn, receiver, args) {
         const [method, toolName] = requestMethodAndTool(args[0]);
+        if (method === "tools/list") {
+            // The same listing filter as `request`: a list read through the stream is not a way around it.
+            const window = this.openListingWindow(cursorOfRequest(args[0]));
+            const epoch = this.listEpoch;
+            const firstSight = this.firstSightNames;
+            return this.gateStream(streamFn.apply(receiver, args), "", (r) => this.filterList(r, window, epoch, firstSight));
+        }
+        if (method === "tasks/result") {
+            const name = this.taskToolName(taskIdOf(args[0], "params"));
+            return this.gateStream(streamFn.apply(receiver, args), name, (r) => this.scanStreamed(name, r));
+        }
         if (method !== "tools/call") {
             return streamFn.apply(receiver, args);
         }
@@ -758,10 +785,51 @@ class Interceptor {
         if (verdict.decision === Decision.PROCEED) {
             if (verdict.failOpenWarning)
                 warn(verdict);
-            return streamFn.apply(receiver, args);
+            return this.gateStream(streamFn.apply(receiver, args), toolName, (r) => this.scanStreamed(toolName, r));
         }
         return this.refuseStream(toolName, verdict);
     }
+    /** Pass a request stream through, gating each `result` message with `onResult` and
+     * keeping the id of any task the stream creates. A HOLD thrown by `onResult` ends
+     * the stream for the caller, and the upstream stream is closed. */
+    async *gateStream(upstream, name, onResult) {
+        for await (const message of upstream) {
+            const type = attrOrKey(message, "type");
+            if (type === "taskCreated")
+                this.noteTask(name, message, "task");
+            if (type !== "result") {
+                yield message;
+                continue;
+            }
+            const result = attrOrKey(message, "result");
+            // An onHold callback may answer with a Promise; the stream yields what it resolves to.
+            const gated = await Promise.resolve(onResult(result));
+            yield gated === result ? message : { ...message, result: gated };
+        }
+    }
+    /** The result scan for a streamed result, which arrives as a value. */
+    scanStreamed(name, result) {
+        return this.scanResults ? this.gateResultValue(name, result) : result;
+    }
+    noteTask(name, value, key) {
+        const id = taskIdOf(value, key);
+        if (id !== null && name) {
+            // Bounded like the Python wrapper's map: the oldest entry goes first.
+            if (this.taskTools.size >= 1024 && !this.taskTools.has(id)) {
+                this.taskTools.delete(this.taskTools.keys().next().value);
+            }
+            this.taskTools.set(id, name);
+        }
+        return value;
+    }
+    /** Session-level `getTaskResult({taskId}, ...)`: the result scan, under the creating tool's name. */
+    taskResult(target, args) {
+        const name = this.taskToolName(taskIdOf({ params: args[0] }, "params"));
+        return this.gateResult(name, target["getTaskResult"].apply(target, args));
+    }
+    taskToolName(taskId) {
+        return (taskId !== null && this.taskTools.get(taskId)) || "";
+    }
     /** A HELD streaming seam: an async generator that raises the SAME
      * `PreflightHold` (or onHold result) as `refuseAsync`, on first iteration,
      * before the upstream stream is ever opened. Shares `heldSurface` / `onHold`
@@ -801,11 +869,20 @@ class Interceptor {
                         if (verdict.decision === Decision.PROCEED) {
                             if (verdict.failOpenWarning)
                                 warn(verdict);
-                            return realTasks.callToolStream.apply(realTasks, a);
+                            const upstream = realTasks.callToolStream.apply(realTasks, a);
+                            return self.gateStream(upstream, toolName, (r) => self.scanStreamed(toolName, r));
                         }
                         return self.refuseStream(toolName, verdict);
                     };
                 }
+                if (prop === "getTaskResult" && typeof Reflect.get(t, prop, t) === "function") {
+                    // getTaskResult(taskId, resultSchema?, options?) reads a task's result off the
+                    // unwrapped client; scan it like the call that created the task.
+                    return (...a) => {
+                        const name = self.taskToolName(typeof a[0] === "string" ? a[0] : null);
+                        return self.gateResult(name, realTasks.getTaskResult.apply(realTasks, a));
+                    };
+                }
                 if (prop === "requestStream") {
                     // tasks.requestStream(request, ...) takes the raw {method,params} shape —
                     // route it through the SAME gate as the session-level seam, delegating
@@ -1067,6 +1144,11 @@ export function wrap(session, opts = {}) {
                     return interceptor.requestStream(fn, target, args);
                 };
             }
+            if (prop === "getTaskResult" && typeof Reflect.get(target, prop, target) === "function") {
+                // getTaskResult({taskId}, resultSchema?, options?) reads a task's result; scan it
+                // like the call that created the task.
+                return (...args) => interceptor.taskResult(target, args);
+            }
             if (prop === "experimental") {
                 // The SDK `experimental` accessor returns an object whose `tasks` holds
                 // the UNWRAPPED client; left untouched it bypasses the gate. Return a