@mcp-rating/gateway 0.2.0

package/dist/proxy/resource-router.js

@@ -0,0 +1,91 @@
+import { TRUST_LABELS } from "../permissions/trust-tiers.js";
+import { log } from "../utils/logger.js";
+/**
+ * Register proxied resources on the gateway McpServer for a downstream connection.
+ *
+ * Each downstream resource is registered with:
+ * - Namespaced URI: `slug://original-uri`
+ * - Description prefixed with trust tier and server name
+ * - Read handler that forwards to downstream `client.readResource()`
+ *
+ * Returns a map of namespaced URI → { remove } handle for cleanup.
+ */
+export function registerProxiedResources(mcpServer, connection, downstreamResources) {
+    const registered = new Map();
+    const trustLabel = TRUST_LABELS[connection.trustTier];
+    for (const resource of downstreamResources) {
+        const nsUri = namespaceResourceUri(connection.slug, resource.uri);
+        const description = `[${trustLabel}] [${connection.displayName}] ${resource.description || resource.name}`;
+        log.debug("Registering proxied resource", {
+            nsUri,
+            downstream: resource.uri,
+            server: connection.slug,
+        });
+        try {
+            const handle = mcpServer.resource(resource.name, nsUri, {
+                description,
+                mimeType: resource.mimeType,
+            }, async () => {
+                log.debug("Proxying resource read", {
+                    nsUri,
+                    downstream: resource.uri,
+                    server: connection.slug,
+                });
+                try {
+                    const result = await connection.client.readResource({
+                        uri: resource.uri,
+                    });
+                    return result;
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    log.error("Proxied resource read failed", {
+                        nsUri,
+                        error: msg,
+                    });
+                    return {
+                        contents: [
+                            {
+                                uri: nsUri,
+                                text: `Error reading resource from ${connection.displayName}: ${msg}`,
+                            },
+                        ],
+                    };
+                }
+            });
+            registered.set(nsUri, handle);
+        }
+        catch (err) {
+            log.warn("Failed to register proxied resource", {
+                nsUri,
+                error: String(err),
+            });
+        }
+    }
+    return registered;
+}
+/**
+ * Remove all proxied resources for a connection.
+ */
+export function removeProxiedResources(proxies) {
+    for (const [uri, handle] of proxies) {
+        log.debug("Removing proxied resource", { uri });
+        handle.remove();
+    }
+    proxies.clear();
+}
+/**
+ * Namespace a resource URI: `slug://original-uri-path`
+ */
+export function namespaceResourceUri(slug, originalUri) {
+    // If the original URI has a scheme, replace it with slug://
+    try {
+        const parsed = new URL(originalUri);
+        return `${slug}://${parsed.host}${parsed.pathname}${parsed.search}${parsed.hash}`;
+    }
+    catch {
+        // Not a valid URL — just prepend the slug scheme
+        return `${slug}://${originalUri}`;
+    }
+}
+//# sourceMappingURL=resource-router.js.map

package/dist/proxy/resource-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-router.js","sourceRoot":"","sources":["../../src/proxy/resource-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAK7D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAoB,EACpB,UAAgC,EAChC,mBAAyC;IAEzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC7D,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAEtD,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,UAAU,MAAM,UAAU,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE3G,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE;YACxC,KAAK;YACL,UAAU,EAAE,QAAQ,CAAC,GAAG;YACxB,MAAM,EAAE,UAAU,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAC/B,QAAQ,CAAC,IAAI,EACb,KAAK,EACL;gBACE,WAAW;gBACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,EACD,KAAK,IAAI,EAAE;gBACT,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBAClC,KAAK;oBACL,UAAU,EAAE,QAAQ,CAAC,GAAG;oBACxB,MAAM,EAAE,UAAU,CAAC,IAAI;iBACxB,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;wBAClD,GAAG,EAAE,QAAQ,CAAC,GAAG;qBAClB,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE;wBACxC,KAAK;wBACL,KAAK,EAAE,GAAG;qBACX,CAAC,CAAC;oBACH,OAAO;wBACL,QAAQ,EAAE;4BACR;gCACE,GAAG,EAAE,KAAK;gCACV,IAAI,EAAE,+BAA+B,UAAU,CAAC,WAAW,KAAK,GAAG,EAAE;6BACtE;yBACF;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC,CACF,CAAC;YAEF,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBAC9C,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA4C;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,WAAmB;IACpE,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,MAAM,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;QACjD,OAAO,GAAG,IAAI,MAAM,WAAW,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/proxy/schema-adapter.d.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+/**
+ * Build a permissive Zod object schema from a downstream tool's JSON Schema.
+ *
+ * The gateway does NOT enforce types — it preserves property names so the
+ * host client can display them, but accepts any value for each property.
+ * The downstream server handles its own validation.
+ *
+ * If the input schema has no properties, returns an empty passthrough schema.
+ */
+export declare function buildPassthroughSchema(jsonSchema: Record<string, unknown>): Record<string, z.ZodTypeAny>;

package/dist/proxy/schema-adapter.js

@@ -0,0 +1,36 @@
+import { z } from "zod";
+/**
+ * Build a permissive Zod object schema from a downstream tool's JSON Schema.
+ *
+ * The gateway does NOT enforce types — it preserves property names so the
+ * host client can display them, but accepts any value for each property.
+ * The downstream server handles its own validation.
+ *
+ * If the input schema has no properties, returns an empty passthrough schema.
+ */
+export function buildPassthroughSchema(jsonSchema) {
+    const properties = jsonSchema?.properties;
+    if (!properties || typeof properties !== "object") {
+        // No known properties — accept arbitrary args
+        return {};
+    }
+    const shape = {};
+    const required = new Set(Array.isArray(jsonSchema.required) ? jsonSchema.required : []);
+    for (const [key, propSchema] of Object.entries(properties)) {
+        // Build a Zod type that accepts any value but carries the description
+        const desc = typeof propSchema.description === "string"
+            ? propSchema.description
+            : undefined;
+        let field = z.any();
+        if (desc) {
+            field = field.describe(desc);
+        }
+        // Mark optional if not in required array
+        if (!required.has(key)) {
+            field = field.optional();
+        }
+        shape[key] = field;
+    }
+    return shape;
+}
+//# sourceMappingURL=schema-adapter.js.map

package/dist/proxy/schema-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-adapter.js","sourceRoot":"","sources":["../../src/proxy/schema-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAmC;IAEnC,MAAM,UAAU,GAAG,UAAU,EAAE,UAElB,CAAC;IAEd,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,8CAA8C;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAiC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAC9D,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,sEAAsE;QACtE,MAAM,IAAI,GACR,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;YACxC,CAAC,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,KAAK,GAAiB,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/proxy/task-proxy.d.ts

@@ -0,0 +1,28 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DownstreamConnection, DownstreamTool } from "../connection/types.js";
+import type { UsageTracker } from "../analytics/usage-tracker.js";
+import type { AdTracker } from "../ads/ad-tracker.js";
+/**
+ * Returns true if the downstream tool runs as an experimental MCP task
+ * (taskSupport "optional" or "required"), meaning it must be proxied
+ * through the task lifecycle rather than a plain `tools/call`.
+ */
+export declare function isTaskTool(tool: DownstreamTool): boolean;
+/**
+ * Register a task-capable downstream tool on the gateway as an upstream
+ * task-tool.
+ *
+ * Bridging model:
+ *  - `createTask`: starts the downstream tool via `callToolStream`, creates a
+ *    matching task in the gateway's upstream task store, and drives the
+ *    downstream stream in the background — mirroring status updates and the
+ *    final result/error into the upstream store.
+ *  - `getTask` / `getTaskResult`: read straight from the upstream store, which
+ *    the background loop keeps current. No manual task-ID mapping is needed
+ *    because the upstream store owns the upstream task identity.
+ *
+ * Returns a `{ remove }` handle for cleanup, matching the plain-tool path.
+ */
+export declare function registerTaskProxyTool(mcpServer: McpServer, connection: DownstreamConnection, tool: DownstreamTool, proxyTimeoutMs: number, usageTracker?: UsageTracker, adTracker?: AdTracker | null): {
+    remove: () => void;
+};

package/dist/proxy/task-proxy.js

@@ -0,0 +1,186 @@
+import { buildPassthroughSchema } from "./schema-adapter.js";
+import { TRUST_LABELS } from "../permissions/trust-tiers.js";
+import { log } from "../utils/logger.js";
+const SEPARATOR = "__";
+/**
+ * Returns true if the downstream tool runs as an experimental MCP task
+ * (taskSupport "optional" or "required"), meaning it must be proxied
+ * through the task lifecycle rather than a plain `tools/call`.
+ */
+export function isTaskTool(tool) {
+    const support = tool.execution?.taskSupport;
+    return support === "optional" || support === "required";
+}
+/**
+ * Register a task-capable downstream tool on the gateway as an upstream
+ * task-tool.
+ *
+ * Bridging model:
+ *  - `createTask`: starts the downstream tool via `callToolStream`, creates a
+ *    matching task in the gateway's upstream task store, and drives the
+ *    downstream stream in the background — mirroring status updates and the
+ *    final result/error into the upstream store.
+ *  - `getTask` / `getTaskResult`: read straight from the upstream store, which
+ *    the background loop keeps current. No manual task-ID mapping is needed
+ *    because the upstream store owns the upstream task identity.
+ *
+ * Returns a `{ remove }` handle for cleanup, matching the plain-tool path.
+ */
+export function registerTaskProxyTool(mcpServer, connection, tool, proxyTimeoutMs, usageTracker, adTracker) {
+    const nsName = `${connection.slug}${SEPARATOR}${tool.name}`;
+    const trustLabel = TRUST_LABELS[connection.trustTier];
+    const description = `[${trustLabel}] [${connection.displayName}] [task] ${tool.description || tool.name}`;
+    const inputSchema = buildPassthroughSchema(tool.inputSchema);
+    log.debug("Registering task-proxy tool", {
+        nsName,
+        downstream: tool.name,
+        server: connection.slug,
+        taskSupport: tool.execution?.taskSupport,
+    });
+    const registered = mcpServer.experimental.tasks.registerToolTask(nsName, {
+        description,
+        inputSchema,
+        // Mirror the downstream requirement: if the downstream demands a task,
+        // require it upstream too; otherwise allow either.
+        execution: {
+            taskSupport: tool.execution?.taskSupport === "required" ? "required" : "optional",
+        },
+    }, {
+        // ── Create: kick off downstream work, mirror into upstream store ──
+        createTask: async (args, extra) => {
+            const startedAt = Date.now();
+            const task = await extra.taskStore.createTask({
+                ttl: extra.taskRequestedTtl ?? 300_000,
+            });
+            log.debug("Task created, starting downstream stream", {
+                nsName,
+                taskId: task.taskId,
+            });
+            // Drive the downstream task in the background. We intentionally do
+            // not await — createTask must return promptly with the task handle.
+            void driveDownstreamTask({
+                connection,
+                tool,
+                args,
+                upstreamTaskId: task.taskId,
+                taskStore: extra.taskStore,
+                proxyTimeoutMs,
+                startedAt,
+                usageTracker,
+                adTracker,
+            });
+            return { task };
+        },
+        // ── Get task status: read from upstream store ──
+        getTask: async (_args, extra) => {
+            return extra.taskStore.getTask(extra.taskId);
+        },
+        // ── Get task result: read from upstream store ──
+        getTaskResult: async (_args, extra) => {
+            const result = await extra.taskStore.getTaskResult(extra.taskId);
+            return result;
+        },
+    });
+    return { remove: () => registered.remove() };
+}
+/**
+ * Background driver: consumes the downstream task stream and mirrors its
+ * lifecycle into the gateway's upstream task store. Never throws — all
+ * failures are converted into a stored "failed" result so upstream getters
+ * always resolve.
+ */
+async function driveDownstreamTask(opts) {
+    const { connection, tool, args, upstreamTaskId, taskStore, startedAt, usageTracker, adTracker, } = opts;
+    try {
+        const stream = connection.client.experimental.tasks.callToolStream({
+            name: tool.name,
+            arguments: args,
+        });
+        for await (const message of stream) {
+            switch (message.type) {
+                case "taskStatus":
+                    // Mirror non-terminal status (working / input_required) upstream.
+                    if (message.task.status === "working" ||
+                        message.task.status === "input_required") {
+                        await taskStore
+                            .updateTaskStatus(upstreamTaskId, message.task.status, message.task.statusMessage)
+                            .catch(() => { });
+                    }
+                    break;
+                case "result": {
+                    await taskStore.storeTaskResult(upstreamTaskId, "completed", message.result);
+                    recordUsage(usageTracker, connection, tool, startedAt, true);
+                    if (adTracker) {
+                        adTracker.trackToolUsage(connection.slug, tool.name).catch(() => { });
+                    }
+                    return;
+                }
+                case "error": {
+                    const errMsg = message.error?.message ?? "Downstream task failed";
+                    await taskStore.storeTaskResult(upstreamTaskId, "failed", {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error from ${connection.displayName}: ${errMsg}`,
+                            },
+                        ],
+                        isError: true,
+                    });
+                    recordUsage(usageTracker, connection, tool, startedAt, false, errMsg);
+                    return;
+                }
+                // "taskCreated" — downstream task started; nothing to mirror since the
+                // upstream task already exists. Continue consuming the stream.
+                default:
+                    break;
+            }
+        }
+        // Stream ended without an explicit result/error message — treat as failure
+        // so upstream getters never hang on a missing result.
+        await taskStore
+            .storeTaskResult(upstreamTaskId, "failed", {
+            content: [
+                {
+                    type: "text",
+                    text: `Downstream task for ${tool.name} ended without a result.`,
+                },
+            ],
+            isError: true,
+        })
+            .catch(() => { });
+        recordUsage(usageTracker, connection, tool, startedAt, false, "no result");
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        log.error("Downstream task stream failed", {
+            slug: connection.slug,
+            tool: tool.name,
+            error: msg,
+        });
+        await taskStore
+            .storeTaskResult(upstreamTaskId, "failed", {
+            content: [
+                {
+                    type: "text",
+                    text: `Error from ${connection.displayName}: ${msg}`,
+                },
+            ],
+            isError: true,
+        })
+            .catch(() => { });
+        recordUsage(usageTracker, connection, tool, startedAt, false, msg);
+    }
+}
+function recordUsage(usageTracker, connection, tool, startedAt, success, error) {
+    if (!usageTracker)
+        return;
+    usageTracker.recordCall({
+        slug: connection.slug,
+        toolName: tool.name,
+        startedAt,
+        durationMs: Date.now() - startedAt,
+        success,
+        ...(error ? { error } : {}),
+    });
+}
+//# sourceMappingURL=task-proxy.js.map

package/dist/proxy/task-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-proxy.js","sourceRoot":"","sources":["../../src/proxy/task-proxy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAIzC,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;IAC5C,OAAO,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,UAAU,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAoB,EACpB,UAAgC,EAChC,IAAoB,EACpB,cAAsB,EACtB,YAA2B,EAC3B,SAA4B;IAE5B,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,UAAU,MAAM,UAAU,CAAC,WAAW,YAAY,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1G,MAAM,WAAW,GAAG,sBAAsB,CACxC,IAAI,CAAC,WAAsC,CAC5C,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;QACvC,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,IAAI;QACvB,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW;KACzC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAC9D,MAAM,EACN;QACE,WAAW;QACX,WAAW;QACX,uEAAuE;QACvE,mDAAmD;QACnD,SAAS,EAAE;YACT,WAAW,EACT,IAAI,CAAC,SAAS,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;SACvE;KACF,EACD;QACE,qEAAqE;QACrE,UAAU,EAAE,KAAK,EACf,IAA6B,EAC7B,KAAoC,EACpC,EAAE;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;gBAC5C,GAAG,EAAE,KAAK,CAAC,gBAAgB,IAAI,OAAO;aACvC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACpD,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,mEAAmE;YACnE,oEAAoE;YACpE,KAAK,mBAAmB,CAAC;gBACvB,UAAU;gBACV,IAAI;gBACJ,IAAI;gBACJ,cAAc,EAAE,IAAI,CAAC,MAAM;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc;gBACd,SAAS;gBACT,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QAED,kDAAkD;QAClD,OAAO,EAAE,KAAK,EACZ,KAA8B,EAC9B,KAA8B,EAC9B,EAAE;YACF,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,kDAAkD;QAClD,aAAa,EAAE,KAAK,EAClB,KAA8B,EAC9B,KAA8B,EAC9B,EAAE;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO,MAAwB,CAAC;QAClC,CAAC;KACF,CACF,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAUlC;IACC,MAAM,EACJ,UAAU,EACV,IAAI,EACJ,IAAI,EACJ,cAAc,EACd,SAAS,EACT,SAAS,EACT,YAAY,EACZ,SAAS,GACV,GAAG,IAAI,CAAC;IAET,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;YACjE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YACnC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,YAAY;oBACf,kEAAkE;oBAClE,IACE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;wBACjC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,gBAAgB,EACxC,CAAC;wBACD,MAAM,SAAS;6BACZ,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;6BACjF,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrB,CAAC;oBACD,MAAM;gBAER,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,SAAS,CAAC,eAAe,CAC7B,cAAc,EACd,WAAW,EACX,OAAO,CAAC,MAAM,CACf,CAAC;oBACF,WAAW,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC7D,IAAI,SAAS,EAAE,CAAC;wBACd,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,wBAAwB,CAAC;oBAClE,MAAM,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,QAAQ,EAAE;wBACxD,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,cAAc,UAAU,CAAC,WAAW,KAAK,MAAM,EAAE;6BACxD;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC,CAAC;oBACH,WAAW,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBAED,uEAAuE;gBACvE,+DAA+D;gBAC/D;oBACE,MAAM;YACV,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,SAAS;aACZ,eAAe,CAAC,cAAc,EAAE,QAAQ,EAAE;YACzC,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,uBAAuB,IAAI,CAAC,IAAI,0BAA0B;iBACjE;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,WAAW,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE;YACzC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,MAAM,SAAS;aACZ,eAAe,CAAC,cAAc,EAAE,QAAQ,EAAE;YACzC,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,cAAc,UAAU,CAAC,WAAW,KAAK,GAAG,EAAE;iBACrD;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,WAAW,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,YAAsC,EACtC,UAAgC,EAChC,IAAoB,EACpB,SAAiB,EACjB,OAAgB,EAChB,KAAc;IAEd,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,YAAY,CAAC,UAAU,CAAC;QACtB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/dist/proxy/tool-router.d.ts

@@ -0,0 +1,38 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { PermissionManager } from "../permissions/permission-manager.js";
+import type { DownstreamConnection, DownstreamTool } from "../connection/types.js";
+import type { AdTracker } from "../ads/ad-tracker.js";
+import type { UsageTracker } from "../analytics/usage-tracker.js";
+import type { PluginManager } from "../plugins/plugin-manager.js";
+import type { AuditLog } from "../audit/audit-log.js";
+/**
+ * Namespace a tool name: `{slug}__{toolname}`
+ */
+export declare function namespaceTool(slug: string, toolName: string): string;
+/**
+ * Parse a namespaced tool name back into slug + original tool name.
+ */
+export declare function parseNamespacedTool(namespacedName: string): {
+    slug: string;
+    toolName: string;
+} | null;
+/**
+ * Register proxied tools on the gateway McpServer for a downstream connection.
+ *
+ * Each downstream tool is registered with:
+ * - Namespaced name: `slug__toolname`
+ * - Description prefixed with trust tier and server name
+ * - Passthrough Zod schema (preserves property names, accepts any values)
+ * - Callback that forwards to `client.callTool()`
+ *
+ * Returns a map of namespaced name → { remove } handle for cleanup.
+ */
+export declare function registerProxiedTools(mcpServer: McpServer, connection: DownstreamConnection, downstreamTools: DownstreamTool[], proxyTimeoutMs: number, permissionManager?: PermissionManager, adTracker?: AdTracker | null, usageTracker?: UsageTracker, pluginManager?: PluginManager, auditLog?: AuditLog): Map<string, {
+    remove: () => void;
+}>;
+/**
+ * Remove all proxied tools for a connection.
+ */
+export declare function removeProxiedTools(proxies: Map<string, {
+    remove: () => void;
+}>): void;

package/dist/proxy/tool-router.js

@@ -0,0 +1,229 @@
+import { buildPassthroughSchema } from "./schema-adapter.js";
+import { TRUST_LABELS } from "../permissions/trust-tiers.js";
+import { log } from "../utils/logger.js";
+import { buildProgressForwarder } from "./progress-forwarder.js";
+import { isTaskTool, registerTaskProxyTool } from "./task-proxy.js";
+const SEPARATOR = "__";
+/**
+ * Namespace a tool name: `{slug}__{toolname}`
+ */
+export function namespaceTool(slug, toolName) {
+    return `${slug}${SEPARATOR}${toolName}`;
+}
+/**
+ * Parse a namespaced tool name back into slug + original tool name.
+ */
+export function parseNamespacedTool(namespacedName) {
+    const idx = namespacedName.indexOf(SEPARATOR);
+    if (idx === -1)
+        return null;
+    return {
+        slug: namespacedName.substring(0, idx),
+        toolName: namespacedName.substring(idx + SEPARATOR.length),
+    };
+}
+/**
+ * Register proxied tools on the gateway McpServer for a downstream connection.
+ *
+ * Each downstream tool is registered with:
+ * - Namespaced name: `slug__toolname`
+ * - Description prefixed with trust tier and server name
+ * - Passthrough Zod schema (preserves property names, accepts any values)
+ * - Callback that forwards to `client.callTool()`
+ *
+ * Returns a map of namespaced name → { remove } handle for cleanup.
+ */
+export function registerProxiedTools(mcpServer, connection, downstreamTools, proxyTimeoutMs, permissionManager, adTracker, usageTracker, pluginManager, auditLog) {
+    const registered = new Map();
+    const trustLabel = TRUST_LABELS[connection.trustTier];
+    for (const tool of downstreamTools) {
+        // Check tool-level permissions if a permission manager is provided
+        if (permissionManager && !permissionManager.isToolAllowed(connection.slug, tool.name)) {
+            log.info("Tool blocked by permission policy", {
+                tool: tool.name,
+                server: connection.slug,
+            });
+            continue;
+        }
+        const nsName = namespaceTool(connection.slug, tool.name);
+        // Task-based tools (experimental) need the task lifecycle, not a plain
+        // call. Route them to the dedicated task proxy.
+        if (isTaskTool(tool)) {
+            try {
+                const taskHandle = registerTaskProxyTool(mcpServer, connection, tool, proxyTimeoutMs, usageTracker, adTracker);
+                registered.set(nsName, taskHandle);
+            }
+            catch (err) {
+                log.warn("Failed to register task-proxy tool; skipping", {
+                    nsName,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+            continue;
+        }
+        // Build description with trust label and optional annotation hints
+        const annotationHints = buildAnnotationHints(tool.annotations);
+        const description = `[${trustLabel}] [${connection.displayName}]${annotationHints} ${tool.description || tool.name}`;
+        const schema = buildPassthroughSchema(tool.inputSchema);
+        log.debug("Registering proxied tool", {
+            nsName,
+            downstream: tool.name,
+            server: connection.slug,
+        });
+        const handle = mcpServer.tool(nsName, description, schema, async (args, 
+        // RequestHandlerExtra from the upstream caller (e.g. Cursor). We type
+        // loosely (`unknown`) because the SDK's generic shape is awkward to
+        // import here and we only need two fields — captured by the
+        // UpstreamProgressContext interface.
+        extra) => {
+            const startedAt = Date.now();
+            log.debug("Proxying tool call", {
+                nsName,
+                downstream: tool.name,
+                server: connection.slug,
+            });
+            // Run plugin beforeToolCall hooks
+            if (pluginManager) {
+                const ctx = {
+                    slug: connection.slug,
+                    toolName: tool.name,
+                    args,
+                    trustTier: connection.trustTier,
+                };
+                const modifiedCtx = await pluginManager.runBeforeToolCall(ctx);
+                if (modifiedCtx === null) {
+                    // Plugin blocked the call
+                    auditLog?.record({
+                        type: "tool_blocked",
+                        slug: connection.slug,
+                        tool: tool.name,
+                        enforcement: connection.manifest?.enforcement,
+                        reason: "blocked by gateway plugin",
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Tool call blocked by gateway plugin.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                // Use potentially modified args
+                args = modifiedCtx.args;
+            }
+            // Forward progress notifications back to the upstream client
+            // using the upstream-supplied progress token (Bug A fix).
+            const onprogress = buildProgressForwarder(extra, { slug: connection.slug, toolName: tool.name });
+            try {
+                const result = await connection.client.callTool({ name: tool.name, arguments: args }, undefined, {
+                    signal: AbortSignal.timeout(proxyTimeoutMs),
+                    ...(onprogress ? { onprogress } : {}),
+                });
+                const durationMs = Date.now() - startedAt;
+                // Track tool usage for ad attribution (fire-and-forget)
+                if (adTracker) {
+                    adTracker.trackToolUsage(connection.slug, tool.name).catch(() => { });
+                }
+                // Track usage analytics
+                if (usageTracker) {
+                    usageTracker.recordCall({
+                        slug: connection.slug,
+                        toolName: tool.name,
+                        startedAt,
+                        durationMs,
+                        success: true,
+                    });
+                }
+                // Safety audit: the tool ran under its sandbox enforcement level.
+                auditLog?.record({
+                    type: "tool_call",
+                    slug: connection.slug,
+                    tool: tool.name,
+                    enforcement: connection.manifest?.enforcement,
+                    ok: true,
+                });
+                // Run plugin afterToolCall hooks
+                let finalResult = result;
+                if (pluginManager) {
+                    finalResult = await pluginManager.runAfterToolCall({
+                        slug: connection.slug,
+                        toolName: tool.name,
+                        args,
+                        trustTier: connection.trustTier,
+                    }, finalResult);
+                }
+                return finalResult;
+            }
+            catch (err) {
+                const durationMs = Date.now() - startedAt;
+                const msg = err instanceof Error ? err.message : String(err);
+                log.error("Proxied tool call failed", {
+                    nsName,
+                    error: msg,
+                });
+                // Track failed call analytics
+                if (usageTracker) {
+                    usageTracker.recordCall({
+                        slug: connection.slug,
+                        toolName: tool.name,
+                        startedAt,
+                        durationMs,
+                        success: false,
+                        error: msg,
+                    });
+                }
+                // Safety audit: the tool call errored (forensics — what failed).
+                auditLog?.record({
+                    type: "tool_call",
+                    slug: connection.slug,
+                    tool: tool.name,
+                    enforcement: connection.manifest?.enforcement,
+                    ok: false,
+                    reason: msg.slice(0, 200),
+                });
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error from ${connection.displayName}: ${msg}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        });
+        registered.set(nsName, handle);
+    }
+    return registered;
+}
+/**
+ * Remove all proxied tools for a connection.
+ */
+export function removeProxiedTools(proxies) {
+    for (const [name, handle] of proxies) {
+        log.debug("Removing proxied tool", { name });
+        handle.remove();
+    }
+    proxies.clear();
+}
+/**
+ * Build a compact annotation hint string from tool annotations.
+ * E.g. " [read-only]" or " [destructive]" or "" if no relevant annotations.
+ */
+function buildAnnotationHints(annotations) {
+    if (!annotations)
+        return "";
+    const hints = [];
+    if (annotations.readOnlyHint === true)
+        hints.push("read-only");
+    if (annotations.destructiveHint === true)
+        hints.push("destructive");
+    if (annotations.idempotentHint === true)
+        hints.push("idempotent");
+    if (annotations.openWorldHint === true)
+        hints.push("open-world");
+    return hints.length > 0 ? ` [${hints.join(", ")}]` : "";
+}
+//# sourceMappingURL=tool-router.js.map

package/dist/proxy/tool-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-router.js","sourceRoot":"","sources":["../../src/proxy/tool-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAM7D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAKzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAEpE,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAgB;IAC1D,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAsB;IAEtB,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QACtC,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAoB,EACpB,UAAgC,EAChC,eAAiC,EACjC,cAAsB,EACtB,iBAAqC,EACrC,SAA4B,EAC5B,YAA2B,EAC3B,aAA6B,EAC7B,QAAmB;IAEnB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC7D,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,mEAAmE;QACnE,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAC5C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,UAAU,CAAC,IAAI;aACxB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzD,uEAAuE;QACvE,gDAAgD;QAChD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,qBAAqB,CACtC,SAAS,EACT,UAAU,EACV,IAAI,EACJ,cAAc,EACd,YAAY,EACZ,SAAS,CACV,CAAC;gBACF,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE;oBACvD,MAAM;oBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,UAAU,MAAM,UAAU,CAAC,WAAW,IAAI,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACrH,MAAM,MAAM,GAAG,sBAAsB,CACnC,IAAI,CAAC,WAAsC,CAC5C,CAAC;QAEF,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;YACpC,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAC3B,MAAM,EACN,WAAW,EACX,MAAM,EACN,KAAK,EACH,IAA6B;QAC7B,sEAAsE;QACtE,oEAAoE;QACpE,4DAA4D;QAC5D,qCAAqC;QACrC,KAAe,EACf,EAAE;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBAC9B,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,MAAM,EAAE,UAAU,CAAC,IAAI;aACxB,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,GAAG,GAAG;oBACV,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,IAAI;oBACJ,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC,CAAC;gBACF,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACzB,0BAA0B;oBAC1B,QAAQ,EAAE,MAAM,CAAC;wBACf,IAAI,EAAE,cAAc;wBACpB,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW;wBAC7C,MAAM,EAAE,2BAA2B;qBACpC,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,sCAAsC;6BAC7C;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,gCAAgC;gBAChC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;YAC1B,CAAC;YAED,6DAA6D;YAC7D,0DAA0D;YAC1D,MAAM,UAAU,GAAG,sBAAsB,CACvC,KAAqD,EACrD,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAC7C,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EACpC,SAAS,EACT;oBACE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;oBAC3C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtC,CACF,CAAC;gBAEF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAE1C,wDAAwD;gBACxD,IAAI,SAAS,EAAE,CAAC;oBACd,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;gBAED,wBAAwB;gBACxB,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,CAAC,UAAU,CAAC;wBACtB,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,SAAS;wBACT,UAAU;wBACV,OAAO,EAAE,IAAI;qBACd,CAAC,CAAC;gBACL,CAAC;gBAED,kEAAkE;gBAClE,QAAQ,EAAE,MAAM,CAAC;oBACf,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW;oBAC7C,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBAEH,iCAAiC;gBACjC,IAAI,WAAW,GAAG,MAAwB,CAAC;gBAC3C,IAAI,aAAa,EAAE,CAAC;oBAClB,WAAW,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAChD;wBACE,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,IAAI;wBACJ,SAAS,EAAE,UAAU,CAAC,SAAS;qBAChC,EACD,WAAW,CACZ,CAAC;gBACJ,CAAC;gBAED,OAAO,WAAW,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1C,MAAM,GAAG,GACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;oBACpC,MAAM;oBACN,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;gBAEH,8BAA8B;gBAC9B,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,CAAC,UAAU,CAAC;wBACtB,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,SAAS;wBACT,UAAU;wBACV,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,GAAG;qBACX,CAAC,CAAC;gBACL,CAAC;gBAED,iEAAiE;gBACjE,QAAQ,EAAE,MAAM,CAAC;oBACf,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW;oBAC7C,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC1B,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,cAAc,UAAU,CAAC,WAAW,KAAK,GAAG,EAAE;yBACrD;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;QAEF,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA4C;IAE5C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,WAAgD;IAEhD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,WAAW,CAAC,YAAY,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,IAAI,WAAW,CAAC,eAAe,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpE,IAAI,WAAW,CAAC,cAAc,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,aAAa,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEjE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC"}