@nacre.work/api 0.33.0 → 0.35.0

package/dist/admin-names.d.ts

@@ -0,0 +1,52 @@
+import type { Pool } from 'pg';
+import type { AccessSubject } from './access.js';
+import type { AuthContext } from './auth.js';
+export declare const isUuid: (value: string) => boolean;
+export type PrincipalKind = 'person' | 'group' | 'service_account';
+export interface NamedLayer {
+    readonly id: string;
+    readonly slug: string;
+    readonly workspaceId: string;
+}
+export declare class AdminNames {
+    private readonly pool;
+    private readonly role;
+    constructor(pool: Pool, role: string);
+    private inOrg;
+    /** A principal named by email, name or id, in this organization — or a refusal naming the reference. */
+    principal(auth: AuthContext, args: Readonly<Record<string, unknown>>, kinds?: readonly PrincipalKind[]): Promise<AccessSubject>;
+    lookup(auth: AuthContext, kind: PrincipalKind, ref: string): Promise<AccessSubject | undefined>;
+    /** A layer by slug or id. */
+    layer(auth: AuthContext, ref: string): Promise<NamedLayer>;
+    /** A workspace by slug or id. */
+    workspace(auth: AuthContext, ref: string): Promise<{
+        readonly id: string;
+        readonly slug: string;
+    }>;
+    /**
+     * A name beside every id: an email for a person, a name for a group or a
+     * service account, a slug for a layer or a workspace. Ids the organization
+     * does not have come back unnamed rather than refused — a deleted layer is
+     * still in last month's log.
+     */
+    names(auth: AuthContext, ids: Iterable<string>): Promise<ReadonlyMap<string, string>>;
+    /** One grant with its names, or `undefined` when this organization has none by that id. */
+    grant(auth: AuthContext, id: string): Promise<{
+        readonly principalType: string;
+        readonly principalId: string;
+        readonly scopeType: string;
+        readonly scopeId: string;
+        readonly permission: string;
+        readonly effect: string;
+    } | undefined>;
+    /** Counts a person reads before deleting something that holds things. */
+    counts(auth: AuthContext, of: {
+        readonly group?: string;
+        readonly layer?: string;
+    }): Promise<{
+        readonly members: number;
+        readonly grants: number;
+        readonly documents: number;
+    }>;
+}
+//# sourceMappingURL=admin-names.d.ts.map

package/dist/admin-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-names.d.ts","sourceRoot":"","sources":["../src/admin-names.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAiB5C,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,OAA2B,CAAA;AAElE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,iBAAiB,CAAA;AAElE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM;IAG/B,OAAO,CAAC,KAAK;IAIb,wGAAwG;IAClG,SAAS,CACb,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,KAAK,GAAE,SAAS,aAAa,EAA2C,GACvE,OAAO,CAAC,aAAa,CAAC;IAYzB,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAiB/F,6BAA6B;IACvB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYhE,iCAAiC;IAC3B,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAYxG;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAgBrF,2FAA2F;IAC3F,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CACN;QACE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,GACD,SAAS,CACZ;IA6BD,yEAAyE;IACzE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAkB9F"}

package/dist/admin-names.js

@@ -0,0 +1,127 @@
+import { McpToolRefusal, withOrg } from '@nacre.work/core';
+/**
+ * Names an administrator uses, resolved to the ids the ports take.
+ *
+ * An agent on the administrative surface says "dana@example.com" and "the
+ * handbook layer", not a uuid — and so does the person reading what it
+ * proposes. Every lookup is inside the caller's organization and names it in
+ * its own literal, so a name in another tenant resolves to nothing rather than
+ * to somebody else's row, whatever the connection's role.
+ *
+ * Shared by the MCP process, which proposes, and by the API, which applies from
+ * the console — one answer to "who is dana@example.com" on both sides.
+ */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export const isUuid = (value) => UUID.test(value);
+export class AdminNames {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    inOrg(auth, run) {
+        return withOrg(this.pool, auth.orgId, run, { role: this.role });
+    }
+    /** A principal named by email, name or id, in this organization — or a refusal naming the reference. */
+    async principal(auth, args, kinds = ['person', 'group', 'service_account']) {
+        const given = kinds.filter((k) => typeof args[k] === 'string' && args[k] !== '');
+        if (given.length !== 1) {
+            throw new McpToolRefusal(`Name exactly one of ${kinds.join(', ').replace(/, ([^,]*)$/, ' or $1')}.`);
+        }
+        const kind = given[0];
+        const ref = args[kind].trim();
+        const found = await this.lookup(auth, kind, ref);
+        if (found === undefined)
+            throw new McpToolRefusal(`No ${kind.replace('_', ' ')} "${ref}" in this organization.`);
+        return found;
+    }
+    lookup(auth, kind, ref) {
+        return this.inOrg(auth, async (client) => {
+            const byId = UUID.test(ref);
+            const [table, column, type] = kind === 'person'
+                ? ['users', 'lower(email)', 'user']
+                : kind === 'group'
+                    ? ['groups', 'name', 'group']
+                    : ['service_accounts', 'name', 'service_account'];
+            const { rows } = await client.query(`SELECT id FROM ${table} WHERE org_id = $1 AND ${byId ? 'id = $2::uuid' : `${column} = $2`} LIMIT 2`, [auth.orgId, byId ? ref : kind === 'person' ? ref.toLowerCase() : ref]);
+            return rows.length === 1 && rows[0] !== undefined ? { type, id: rows[0].id } : undefined;
+        });
+    }
+    /** A layer by slug or id. */
+    async layer(auth, ref) {
+        const found = await this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT id, slug, workspace_id FROM layers WHERE org_id = $1 AND deleted_at IS NULL AND ${UUID.test(ref) ? 'id = $2::uuid' : 'slug = $2'}`, [auth.orgId, ref]);
+            return rows[0];
+        });
+        if (found === undefined)
+            throw new McpToolRefusal(`No layer "${ref}" in this organization.`);
+        return { id: found.id, slug: found.slug, workspaceId: found.workspace_id };
+    }
+    /** A workspace by slug or id. */
+    async workspace(auth, ref) {
+        const found = await this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT id, slug FROM workspaces WHERE org_id = $1 AND ${UUID.test(ref) ? 'id = $2::uuid' : 'slug = $2'}`, [auth.orgId, ref]);
+            return rows[0];
+        });
+        if (found === undefined)
+            throw new McpToolRefusal(`No workspace "${ref}" in this organization.`);
+        return found;
+    }
+    /**
+     * A name beside every id: an email for a person, a name for a group or a
+     * service account, a slug for a layer or a workspace. Ids the organization
+     * does not have come back unnamed rather than refused — a deleted layer is
+     * still in last month's log.
+     */
+    names(auth, ids) {
+        const wanted = [...new Set([...ids].filter((id) => UUID.test(id)))];
+        if (wanted.length === 0)
+            return Promise.resolve(new Map());
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT id::text, email AS name FROM users WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, name FROM service_accounts WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, name FROM groups WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, slug FROM layers WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, slug FROM workspaces WHERE org_id = $1 AND id = ANY($2::uuid[])`, [auth.orgId, wanted]);
+            return new Map(rows.map((r) => [r.id, r.name]));
+        });
+    }
+    /** One grant with its names, or `undefined` when this organization has none by that id. */
+    grant(auth, id) {
+        if (!UUID.test(id))
+            return Promise.resolve(undefined);
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT principal_type, principal_id, scope_type, scope_id, permission, effect
+           FROM grants WHERE org_id = $1 AND id = $2::uuid`, [auth.orgId, id]);
+            const row = rows[0];
+            return row === undefined
+                ? undefined
+                : {
+                    principalType: row.principal_type,
+                    principalId: row.principal_id,
+                    scopeType: row.scope_type,
+                    scopeId: row.scope_id,
+                    permission: row.permission,
+                    effect: row.effect,
+                };
+        });
+    }
+    /** Counts a person reads before deleting something that holds things. */
+    counts(auth, of) {
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT (SELECT count(*) FROM group_members WHERE org_id = $1 AND group_id = $2::uuid) AS members,
+                (SELECT count(*) FROM grants WHERE org_id = $1
+                   AND ((principal_type = 'group' AND principal_id = $2::uuid)
+                     OR (scope_type = 'layer' AND scope_id = $3::uuid))) AS grants,
+                (SELECT count(*) FROM documents WHERE org_id = $1 AND layer_id = $3::uuid AND deleted_at IS NULL) AS documents`, [auth.orgId, of.group ?? null, of.layer ?? null]);
+            const row = rows[0];
+            return {
+                members: Number(row?.members ?? 0),
+                grants: Number(row?.grants ?? 0),
+                documents: Number(row?.documents ?? 0),
+            };
+        });
+    }
+}
+//# sourceMappingURL=admin-names.js.map

package/dist/admin-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-names.js","sourceRoot":"","sources":["../src/admin-names.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAM1D;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAE9E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAUlE,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,IAAU,EACV,IAAY;QADZ,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAQ;IAC5B,CAAC;IAEI,KAAK,CAAI,IAAiB,EAAE,GAAuC;QACzE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,SAAS,CACb,IAAiB,EACjB,IAAuC,EACvC,QAAkC,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAExE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QACtG,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAkB,CAAA;QACtC,MAAM,GAAG,GAAI,IAAI,CAAC,IAAI,CAAY,CAAC,IAAI,EAAE,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,GAAG,yBAAyB,CAAC,CAAA;QAChH,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,IAAiB,EAAE,IAAmB,EAAE,GAAW;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GACzB,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAW;gBAC9C,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAW;oBACxC,CAAC,CAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,CAAW,CAAA;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,kBAAkB,KAAK,0BAA0B,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,UAAU,EACpG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACvE,CAAA;YACD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,6BAA6B;IAC7B,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,GAAW;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,0FAA0F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,EAC1I,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,aAAa,GAAG,yBAAyB,CAAC,CAAA;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAA;IAC5E,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,SAAS,CAAC,IAAiB,EAAE,GAAW;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,yDAAyD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,EACzG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,GAAG,yBAAyB,CAAC,CAAA;QAChG,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAiB,EAAE,GAAqB;QAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;oGAI4F,EAC5F,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CACrB,CAAA;YACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,2FAA2F;IAC3F,KAAK,CACH,IAAiB,EACjB,EAAU;QAYV,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAQjC;2DACmD,EACnD,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,OAAO,GAAG,KAAK,SAAS;gBACtB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,aAAa,EAAE,GAAG,CAAC,cAAc;oBACjC,WAAW,EAAE,GAAG,CAAC,YAAY;oBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;oBACzB,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACrB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAA;QACP,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,CACJ,IAAiB,EACjB,EAAwD;QAExD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;+HAIuH,EACvH,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CACjD,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;gBAClC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;gBAChC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,CAAC;aACvC,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/admin-notify.d.ts

@@ -0,0 +1,30 @@
+import { type AuditWriter, type McpReadTool, type McpWriteTool } from '@nacre.work/core';
+import type { AdminNames } from './admin-names.js';
+import { type NotificationStore } from './notifications.js';
+/**
+ * Notifications and alert rules on the administrative MCP. docs/mcp-admin.md,
+ * "Notifications".
+ *
+ * Built only where the installation has a mail relay — a tool that queues a
+ * message nothing will send is a tool that says it did something it did not —
+ * and composed by both processes that hold the core's writes: the MCP process,
+ * which proposes, and the API, which applies from the console.
+ *
+ * ## T35
+ *
+ * A recipient is named by address or id and resolved to an **active user of
+ * the caller's organization**, or the call is refused naming what did not
+ * resolve — before anything is stored, which is "refused before a message is
+ * composed". The address is used to find a person and then dropped: what is
+ * stored is the id, and the worker reads the address again at sending time.
+ * Applying resolves the ids once more, because a person disabled in the ten
+ * minutes between is somebody the organization has just decided should not be
+ * reached.
+ */
+export interface NotifyPorts {
+    readonly audit: AuditWriter;
+    readonly names: AdminNames;
+    readonly notifications: NotificationStore;
+}
+export declare function notificationTools(ports: NotifyPorts): readonly (McpReadTool | McpWriteTool)[];
+//# sourceMappingURL=admin-notify.d.ts.map

package/dist/admin-notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-notify.d.ts","sourceRoot":"","sources":["../src/admin-notify.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,WAAW,EAChB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAGlD,OAAO,EAAmC,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE5F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAA;CAC1C;AAmFD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC,WAAW,GAAG,YAAY,CAAC,EAAE,CA8Q7F"}

package/dist/admin-notify.js

@@ -0,0 +1,335 @@
+import { ALERT_KINDS, ALERT_WINDOW, isAlertKind, McpToolRefusal, NOTIFY_MAX_RECIPIENTS, NOTIFY_PER_HOUR, notificationText, ruleSentence, } from '@nacre.work/core';
+import { isUuid } from './admin-names.js';
+import { MAX_ALERT_RULES } from './notifications.js';
+const auth = (call) => call.auth;
+const RECIPIENT_PROPS = {
+    people: {
+        type: 'array',
+        items: { type: 'string' },
+        maxItems: NOTIFY_MAX_RECIPIENTS,
+        description: 'People in this organization, by email address or id. Nobody else can be named: there is no way to ' +
+            'send to an address outside the organization.',
+    },
+    org_admins: { type: 'boolean', description: "Every active organization administrator, whoever they are when it is sent." },
+};
+const count = (n, one, many = `${one}s`) => `${String(n)} ${n === 1 ? one : many}`;
+/** The references a call named, bounded, before anything is looked up. */
+function references(args) {
+    const people = args.people;
+    if (people !== undefined && !Array.isArray(people))
+        throw new McpToolRefusal("'people' is a list of addresses or ids.");
+    const refs = (people ?? []);
+    if (refs.some((r) => typeof r !== 'string' || r.trim() === '' || r.length > 320)) {
+        throw new McpToolRefusal("Each of 'people' is one person's address or id.");
+    }
+    if (refs.length > NOTIFY_MAX_RECIPIENTS) {
+        throw new McpToolRefusal(`At most ${String(NOTIFY_MAX_RECIPIENTS)} people by name; 'org_admins' reaches every administrator.`);
+    }
+    if (args.org_admins !== undefined && typeof args.org_admins !== 'boolean')
+        throw new McpToolRefusal("'org_admins' is true or false.");
+    const toOrgAdmins = args.org_admins === true;
+    if (refs.length === 0 && !toOrgAdmins)
+        throw new McpToolRefusal("Name the people it goes to, or set 'org_admins'.");
+    return { refs: refs, toOrgAdmins };
+}
+/**
+ * Who it goes to, as ids and as the sentence a person reads — or a refusal
+ * naming every reference that is not an active person here. T35.
+ */
+async function recipients(ports, a, args) {
+    const { refs, toOrgAdmins } = references(args);
+    const { found, unknown } = await ports.notifications.people(a, refs);
+    if (unknown.length > 0) {
+        throw new McpToolRefusal(`${unknown.map((r) => `"${r}"`).join(', ')} ${unknown.length === 1 ? 'is' : 'are'} not an active person in this ` +
+            'organization. A notification goes only to people here, named by their address — nobody outside it, ' +
+            'and nobody disabled.');
+    }
+    const people = [...new Map([...found.values()].map((p) => [p.id, p])).values()];
+    const emails = people.map((p) => p.email);
+    const admins = toOrgAdmins ? await ports.notifications.orgAdmins(a) : 0;
+    const parts = [...emails, ...(toOrgAdmins ? [`every organization administrator (${String(admins)} now)`] : [])];
+    const words = parts.length <= 1 ? (parts[0] ?? '') : `${parts.slice(0, -1).join(', ')} and ${parts[parts.length - 1] ?? ''}`;
+    return { ids: people.map((p) => p.id), emails, toOrgAdmins, words };
+}
+/** Ids a stored proposal carries, still active — or the refusal saying who is not. */
+async function stillActive(ports, a, ids) {
+    const { unknown } = await ports.notifications.people(a, ids);
+    if (unknown.length > 0) {
+        throw new McpToolRefusal(`${count(unknown.length, 'person', 'people')} it was addressed to ${unknown.length === 1 ? 'is' : 'are'} no longer active ` +
+            'in this organization. Propose it again to the people who are.');
+    }
+}
+const storedIds = (input, key) => {
+    const value = input[key];
+    if (!Array.isArray(value) || value.some((v) => typeof v !== 'string' || !isUuid(v))) {
+        throw new Error(`a stored proposal is missing ${key}`);
+    }
+    return value;
+};
+export function notificationTools(ports) {
+    const record = async (call, action, result, target, detail = {}) => {
+        const a = auth(call);
+        if (Object.keys(target).length === 0)
+            throw new Error(`${action.action} was recorded with no target`);
+        await ports.audit.write({
+            orgId: a.orgId,
+            actor: `${a.principal.type}:${a.principal.id}`,
+            ...action,
+            result,
+            surface: 'mcp-admin',
+            target: { ...target },
+            detail: { ...detail, ...(call.proposal === undefined ? {} : { proposal: call.proposal.id, through: call.proposal.through }) },
+            requestId: call.requestId,
+        });
+    };
+    const describeRule = async (a, rule) => {
+        const named = await ports.names.names(a, [...rule.recipients, rule.createdBy]);
+        return {
+            id: rule.id,
+            when: ruleSentence(rule),
+            kind: rule.kind,
+            ...(rule.layerSlug === null ? {} : { layer: rule.layerSlug }),
+            ...(rule.threshold === null ? {} : { threshold: rule.threshold, window_minutes: rule.windowMinutes }),
+            notifies: [
+                ...rule.recipients.map((id) => named.get(id) ?? id),
+                ...(rule.toOrgAdmins ? ['every organization administrator'] : []),
+            ],
+            created_by: named.get(rule.createdBy) ?? rule.createdBy,
+            created_at: rule.createdAt,
+            last_fired_at: rule.lastFiredAt,
+        };
+    };
+    return [
+        {
+            kind: 'write',
+            name: 'send_notification',
+            title: 'Send a notification',
+            description: 'Propose an email to people in this organization — by address, or every organization administrator. ' +
+                'A subject and a plain-text body, no links. It says an agent wrote it and who approved it. Only people ' +
+                `in this organization can be named. At most ${String(NOTIFY_PER_HOUR)} an hour per organization.`,
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    ...RECIPIENT_PROPS,
+                    subject: { type: 'string', maxLength: 200, description: 'One line.' },
+                    body: { type: 'string', maxLength: 4000, description: 'Plain text; a blank line starts a paragraph. No links.' },
+                },
+                required: ['subject', 'body'],
+                additionalProperties: false,
+            },
+            async propose(call, args) {
+                const a = auth(call);
+                // Recipients first, and refused before the text is even looked at: the
+                // question T35 asks is answered before anything is composed.
+                const to = await recipients(ports, a, args);
+                const text = notificationText(args.subject, args.body);
+                if ('refused' in text)
+                    throw new McpToolRefusal(text.refused);
+                const consentId = a.delegation?.id;
+                if (consentId === undefined)
+                    throw new McpToolRefusal('A notification is proposed through an administrative connection.');
+                return {
+                    summary: `Email ${to.words}: "${text.subject}".`,
+                    details: [
+                        { label: 'to', value: to.words },
+                        { label: 'subject', value: text.subject },
+                        { label: 'body', value: text.body },
+                        { label: 'note', value: 'The message says an agent wrote it, through which connection, and that you approved it.' },
+                    ],
+                    input: { recipients: to.ids, to_org_admins: to.toOrgAdmins, subject: text.subject, body: text.body, consent_id: consentId },
+                };
+            },
+            async apply(call, input) {
+                const a = auth(call);
+                const ids = storedIds(input, 'recipients');
+                const consentId = typeof input.consent_id === 'string' && isUuid(input.consent_id) ? input.consent_id : undefined;
+                if (consentId === undefined)
+                    throw new Error('a stored proposal is missing consent_id');
+                const text = notificationText(input.subject, input.body);
+                try {
+                    if ('refused' in text)
+                        throw new McpToolRefusal(text.refused);
+                    await stillActive(ports, a, ids);
+                }
+                catch (error) {
+                    await record(call, { action: 'send_notification' }, 'deny', { connection: consentId }, { recipients: ids.length });
+                    throw error;
+                }
+                const queued = await ports.notifications.enqueue(a, {
+                    recipients: ids,
+                    toOrgAdmins: input.to_org_admins === true,
+                    subject: text.subject,
+                    body: text.body,
+                    consentId,
+                });
+                if (queued.kind === 'limited') {
+                    await record(call, { action: 'send_notification' }, 'deny', { connection: consentId }, { outcome: 'rate_limited' });
+                    throw new McpToolRefusal(`This organization has queued ${String(NOTIFY_PER_HOUR)} notifications in the last hour, which is the limit. ` +
+                        'Try again later.');
+                }
+                await record(call, { action: 'send_notification' }, 'allow', { notification: queued.id, connection: consentId }, { recipients: ids.length, to_org_admins: input.to_org_admins === true });
+                return { notification: queued.id, status: 'queued: the worker sends it within a minute or two' };
+            },
+        },
+        {
+            kind: 'write',
+            name: 'create_alert_rule',
+            title: 'Create an alert rule',
+            description: 'Propose a standing rule the worker checks every minute, emailing people in this organization when it ' +
+                'fires: a skill version written by an agent (skill_by_agent), one adding scripts (skill_scripts), an ' +
+                'administrative connection approved (admin_connection), one principal denied at least `threshold` ' +
+                'times in `window_minutes` (denial_spike), or at least `threshold` documents failing to index in ' +
+                '`window_minutes` (documents_failed). A counting rule fires at most once per window.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    kind: { type: 'string', enum: Object.keys(ALERT_KINDS) },
+                    layer: { type: 'string', description: "A layer's slug, to watch only it — for the skill kinds and documents_failed." },
+                    threshold: { type: 'integer', minimum: 1, maximum: 100000, description: 'For denial_spike and documents_failed.' },
+                    window_minutes: {
+                        type: 'integer',
+                        minimum: ALERT_WINDOW.min,
+                        maximum: ALERT_WINDOW.max,
+                        description: `For denial_spike and documents_failed; ${String(ALERT_WINDOW.default)} by default.`,
+                    },
+                    ...RECIPIENT_PROPS,
+                },
+                required: ['kind'],
+                additionalProperties: false,
+            },
+            async propose(call, args) {
+                const a = auth(call);
+                if (!isAlertKind(args.kind))
+                    throw new McpToolRefusal(`'kind' is one of ${Object.keys(ALERT_KINDS).join(', ')}.`);
+                const kind = args.kind;
+                const shape = ALERT_KINDS[kind];
+                const to = await recipients(ports, a, args);
+                let layer = null;
+                if (typeof args.layer === 'string' && args.layer !== '') {
+                    if (!shape.layered)
+                        throw new McpToolRefusal(`A ${kind} rule watches the whole organization; it takes no layer.`);
+                    layer = await ports.names.layer(a, args.layer);
+                }
+                let threshold = null;
+                let windowMinutes = null;
+                if (shape.counts) {
+                    if (typeof args.threshold !== 'number' || !Number.isInteger(args.threshold) || args.threshold < 1 || args.threshold > 100000) {
+                        throw new McpToolRefusal(`A ${kind} rule needs a 'threshold': a whole number from 1.`);
+                    }
+                    threshold = args.threshold;
+                    const w = args.window_minutes ?? ALERT_WINDOW.default;
+                    if (typeof w !== 'number' || !Number.isInteger(w) || w < ALERT_WINDOW.min || w > ALERT_WINDOW.max) {
+                        throw new McpToolRefusal(`'window_minutes' is from ${String(ALERT_WINDOW.min)} to ${String(ALERT_WINDOW.max)}.`);
+                    }
+                    windowMinutes = w;
+                }
+                else if (args.threshold !== undefined || args.window_minutes !== undefined) {
+                    throw new McpToolRefusal(`A ${kind} rule fires on each one; it takes no threshold or window.`);
+                }
+                const when = ruleSentence({ kind, layerSlug: layer?.slug ?? null, threshold, windowMinutes });
+                return {
+                    summary: `Email ${to.words} whenever ${when}.`,
+                    details: [
+                        { label: 'when', value: when },
+                        { label: 'to', value: to.words },
+                        { label: 'checked', value: 'every minute, by the worker, whether or not an agent is connected' },
+                    ],
+                    input: {
+                        kind,
+                        layer_id: layer?.id ?? null,
+                        threshold,
+                        window_minutes: windowMinutes,
+                        recipients: to.ids,
+                        to_org_admins: to.toOrgAdmins,
+                    },
+                };
+            },
+            async apply(call, input) {
+                const a = auth(call);
+                if (!isAlertKind(input.kind))
+                    throw new Error('a stored proposal is missing kind');
+                const ids = storedIds(input, 'recipients');
+                const layerId = typeof input.layer_id === 'string' && isUuid(input.layer_id) ? input.layer_id : null;
+                try {
+                    await stillActive(ports, a, ids);
+                    if (layerId !== null)
+                        await ports.names.layer(a, layerId);
+                }
+                catch (error) {
+                    await record(call, { action: 'create_alert_rule' }, 'deny', { kind: input.kind });
+                    throw error;
+                }
+                const created = await ports.notifications.createRule(a, {
+                    kind: input.kind,
+                    layerId,
+                    threshold: typeof input.threshold === 'number' ? input.threshold : null,
+                    windowMinutes: typeof input.window_minutes === 'number' ? input.window_minutes : null,
+                    recipients: ids,
+                    toOrgAdmins: input.to_org_admins === true,
+                });
+                if (created.kind === 'full') {
+                    await record(call, { action: 'create_alert_rule' }, 'deny', { kind: input.kind }, { outcome: 'limit' });
+                    throw new McpToolRefusal(`This organization keeps ${String(MAX_ALERT_RULES)} rules, which is the limit. Remove one first.`);
+                }
+                await record(call, { action: 'create_alert_rule' }, 'allow', { alert_rule: created.id, kind: input.kind }, {
+                    recipients: ids.length,
+                    to_org_admins: input.to_org_admins === true,
+                    ...(layerId === null ? {} : { layer_id: layerId }),
+                });
+                return { alert_rule: created.id };
+            },
+        },
+        {
+            kind: 'write',
+            name: 'remove_alert_rule',
+            title: 'Remove an alert rule',
+            description: 'Propose removing an alert rule, by the id list_alert_rules gives. It stops firing once applied.',
+            inputSchema: {
+                type: 'object',
+                properties: { rule: { type: 'string', description: 'The rule id, from list_alert_rules.' } },
+                required: ['rule'],
+                additionalProperties: false,
+            },
+            async propose(call, args) {
+                const a = auth(call);
+                const id = typeof args.rule === 'string' ? args.rule.trim() : '';
+                const rule = id === '' ? undefined : await ports.notifications.rule(a, id);
+                if (rule === undefined)
+                    throw new McpToolRefusal(`No alert rule "${id}" in this organization.`);
+                const described = await describeRule(a, rule);
+                const to = described.notifies.join(', ');
+                return {
+                    summary: `Stop emailing ${to} whenever ${ruleSentence(rule)}.`,
+                    details: [
+                        { label: 'when', value: ruleSentence(rule) },
+                        { label: 'to', value: to },
+                    ],
+                    input: { rule_id: rule.id },
+                };
+            },
+            async apply(call, input) {
+                const id = typeof input.rule_id === 'string' && isUuid(input.rule_id) ? input.rule_id : undefined;
+                if (id === undefined)
+                    throw new Error('a stored proposal is missing rule_id');
+                const removed = await ports.notifications.removeRule(auth(call), id);
+                await record(call, { action: 'remove_alert_rule' }, removed ? 'allow' : 'deny', { alert_rule: id });
+                if (!removed)
+                    throw new McpToolRefusal('That rule is already gone.');
+                return { removed: true };
+            },
+        },
+        {
+            kind: 'read',
+            name: 'list_alert_rules',
+            title: 'List alert rules',
+            description: 'The alert rules this organization keeps: what each watches, whom it emails, and when it last fired.',
+            inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+            async run(call) {
+                const a = auth(call);
+                const rules = await ports.notifications.rules(a);
+                return { rules: await Promise.all(rules.map((r) => describeRule(a, r))) };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=admin-notify.js.map

package/dist/admin-notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-notify.js","sourceRoot":"","sources":["../src/admin-notify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,YAAY,GAKb,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC,OAAO,EAAE,eAAe,EAA0C,MAAM,oBAAoB,CAAA;AA+B5F,MAAM,IAAI,GAAG,CAAC,IAAiB,EAAe,EAAE,CAAC,IAAI,CAAC,IAAmB,CAAA;AAEzE,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE;QACN,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,QAAQ,EAAE,qBAAqB;QAC/B,WAAW,EACT,oGAAoG;YACpG,8CAA8C;KACjD;IACD,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,4EAA4E,EAAE;CAClH,CAAA;AAEV,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,IAAI,GAAG,GAAG,GAAG,GAAG,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAE1G,0EAA0E;AAC1E,SAAS,UAAU,CAAC,IAAU;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,yCAAyC,CAAC,CAAA;IACvH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAc,CAAA;IACxC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,cAAc,CAAC,iDAAiD,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,WAAW,MAAM,CAAC,qBAAqB,CAAC,4DAA4D,CAAC,CAAA;IAChI,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,cAAc,CAAC,gCAAgC,CAAC,CAAA;IACrI,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAA;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,cAAc,CAAC,kDAAkD,CAAC,CAAA;IACnH,OAAO,EAAE,IAAI,EAAE,IAAgB,EAAE,WAAW,EAAE,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,KAAkB,EAClB,CAAc,EACd,IAAU;IAEV,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CACtB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gCAAgC;YAC/G,qGAAqG;YACrG,sBAAsB,CACzB,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/G,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5H,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AACrE,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,WAAW,CAAC,KAAkB,EAAE,CAAc,EAAE,GAAsB;IACnF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CACtB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,wBAAwB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;YACzH,+DAA+D,CAClE,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAW,EAAE,GAAW,EAAqB,EAAE;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,KAAiB,CAAA;AAC1B,CAAC,CAAA;AAGD,MAAM,UAAU,iBAAiB,CAAC,KAAkB;IAClD,MAAM,MAAM,GAAG,KAAK,EAClB,IAAiB,EACjB,MAAmC,EACnC,MAAwB,EACxB,MAA+B,EAC/B,SAAkC,EAAE,EACrB,EAAE;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,8BAA8B,CAAC,CAAA;QACrG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE;YAC9C,GAAG,MAAM;YACT,MAAM;YACN,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE;YAC7H,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,CAAc,EAAE,IAAe,EAAoC,EAAE;QAC/F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9E,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrG,QAAQ,EAAE;gBACR,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE;YACD,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS;YACvD,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,aAAa,EAAE,IAAI,CAAC,WAAW;SAChC,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EACT,qGAAqG;gBACrG,wGAAwG;gBACxG,8CAA8C,MAAM,CAAC,eAAe,CAAC,4BAA4B;YACnG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,GAAG,eAAe;oBAClB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE;oBACrE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,wDAAwD,EAAE;iBACjH;gBACD,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;gBAC7B,oBAAoB,EAAE,KAAK;aAC5B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;gBACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpB,uEAAuE;gBACvE,6DAA6D;gBAC7D,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBACtD,IAAI,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAA;gBAClC,IAAI,SAAS,KAAK,SAAS;oBAAE,MAAM,IAAI,cAAc,CAAC,kEAAkE,CAAC,CAAA;gBACzH,OAAO;oBACL,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,MAAM,IAAI,CAAC,OAAO,IAAI;oBAChD,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;wBAChC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;wBACzC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;wBACnC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,yFAAyF,EAAE;qBACpH;oBACD,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;iBAC5H,CAAA;YACH,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK;gBACrB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;gBAC1C,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;gBACjH,IAAI,SAAS,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;gBACvF,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;gBACxD,IAAI,CAAC;oBACH,IAAI,SAAS,IAAI,IAAI;wBAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBAC7D,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;gBAClC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;oBAClH,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;oBAClD,UAAU,EAAE,GAAG;oBACf,WAAW,EAAE,KAAK,CAAC,aAAa,KAAK,IAAI;oBACzC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,SAAS;iBACV,CAAC,CAAA;gBACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;oBACnH,MAAM,IAAI,cAAc,CACtB,gCAAgC,MAAM,CAAC,eAAe,CAAC,uDAAuD;wBAC5G,kBAAkB,CACrB,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,CACV,IAAI,EACJ,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAC/B,OAAO,EACP,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAClD,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CACxE,CAAA;gBACD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAA;YAClG,CAAC;SACF;QACD;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EACT,uGAAuG;gBACvG,sGAAsG;gBACtG,mGAAmG;gBACnG,kGAAkG;gBAClG,qFAAqF;YACvF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;oBACxD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8EAA8E,EAAE;oBACtH,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,wCAAwC,EAAE;oBAClH,cAAc,EAAE;wBACd,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,YAAY,CAAC,GAAG;wBACzB,OAAO,EAAE,YAAY,CAAC,GAAG;wBACzB,WAAW,EAAE,0CAA0C,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc;qBAClG;oBACD,GAAG,eAAe;iBACnB;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,oBAAoB,EAAE,KAAK;aAC5B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;gBACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;gBAE3C,IAAI,KAAK,GAAwC,IAAI,CAAA;gBACrD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACxD,IAAI,CAAC,KAAK,CAAC,OAAO;wBAAE,MAAM,IAAI,cAAc,CAAC,KAAK,IAAI,0DAA0D,CAAC,CAAA;oBACjH,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChD,CAAC;gBACD,IAAI,SAAS,GAAkB,IAAI,CAAA;gBACnC,IAAI,aAAa,GAAkB,IAAI,CAAA;gBACvC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;wBAC7H,MAAM,IAAI,cAAc,CAAC,KAAK,IAAI,mDAAmD,CAAC,CAAA;oBACxF,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;oBAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC,OAAO,CAAA;oBACrD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;wBAClG,MAAM,IAAI,cAAc,CAAC,4BAA4B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBAClH,CAAC;oBACD,aAAa,GAAG,CAAC,CAAA;gBACnB,CAAC;qBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;oBAC7E,MAAM,IAAI,cAAc,CAAC,KAAK,IAAI,2DAA2D,CAAC,CAAA;gBAChG,CAAC;gBAED,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;gBAC7F,OAAO;oBACL,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,aAAa,IAAI,GAAG;oBAC9C,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;wBAC9B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;wBAChC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,mEAAmE,EAAE;qBACjG;oBACD,KAAK,EAAE;wBACL,IAAI;wBACJ,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;wBAC3B,SAAS;wBACT,cAAc,EAAE,aAAa;wBAC7B,UAAU,EAAE,EAAE,CAAC,GAAG;wBAClB,aAAa,EAAE,EAAE,CAAC,WAAW;qBAC9B;iBACF,CAAA;YACH,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK;gBACrB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBAClF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;gBAC1C,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;gBACpG,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;oBAChC,IAAI,OAAO,KAAK,IAAI;wBAAE,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;gBAC3D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;oBACjF,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE;oBACtD,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO;oBACP,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBACvE,aAAa,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;oBACrF,UAAU,EAAE,GAAG;oBACf,WAAW,EAAE,KAAK,CAAC,aAAa,KAAK,IAAI;iBAC1C,CAAC,CAAA;gBACF,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC5B,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;oBACvG,MAAM,IAAI,cAAc,CAAC,2BAA2B,MAAM,CAAC,eAAe,CAAC,+CAA+C,CAAC,CAAA;gBAC7H,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE;oBACzG,UAAU,EAAE,GAAG,CAAC,MAAM;oBACtB,aAAa,EAAE,KAAK,CAAC,aAAa,KAAK,IAAI;oBAC3C,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;iBACnD,CAAC,CAAA;gBACF,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;YACnC,CAAC;SACF;QACD;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,iGAAiG;YAC9G,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE,EAAE;gBAC5F,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,oBAAoB,EAAE,KAAK;aAC5B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;gBACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAChE,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC1E,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAA;gBAC/F,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC7C,MAAM,EAAE,GAAI,SAAS,CAAC,QAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACtD,OAAO;oBACL,OAAO,EAAE,iBAAiB,EAAE,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG;oBAC9D,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;wBAC5C,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;qBAC3B;oBACD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE;iBAC5B,CAAA;YACH,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK;gBACrB,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;gBACjG,IAAI,EAAE,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;gBAC7E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;gBACpE,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBACnG,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,cAAc,CAAC,4BAA4B,CAAC,CAAA;gBACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;SACF;QACD;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,qGAAqG;YAClH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;YAC5E,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;gBACpB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAChD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3E,CAAC;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/admin-writes.d.ts

@@ -0,0 +1,40 @@
+import { type AuditWriter, type McpWriteTool } from '@nacre.work/core';
+import type { Pool } from 'pg';
+import type { OAuthConsents } from './oauth-store.js';
+import type { Groups, Users } from './principals.js';
+import type { Grants, Layers, Workspaces } from './server.js';
+import type { Skills } from './skills.js';
+/**
+ * The core's writes on the administrative MCP. docs/mcp-admin.md, "Tools".
+ *
+ * Every one is two halves, which is the whole design: `propose` resolves what
+ * the model named into ids and writes the sentence a person reads, and `apply`
+ * makes the change — only ever called when that person presses Apply, in the
+ * panel or on the console's Proposals screen. A module's write registered
+ * through `registerMcpTools` has exactly this shape, so the core's and a
+ * module's go past a person the same way.
+ *
+ * `apply` goes through the port the REST surface uses for the same change, as
+ * the person deciding — so every check that endpoint makes is made again here,
+ * ten minutes later at most, and a role lost in between is what decides. It
+ * records the same action the REST handler records, on the administrative
+ * surface, naming the proposal.
+ *
+ * What is not here, and why, is in the document: passwords and keys (a
+ * plaintext returned to a conversation stays in it), second factors (never on
+ * anybody's behalf), and anything above the organization.
+ */
+export interface AdminWritePorts {
+    readonly pool: Pool;
+    readonly role: string;
+    readonly audit: AuditWriter;
+    readonly grants: Grants;
+    readonly groups: Groups;
+    readonly users: Users;
+    readonly workspaces: Workspaces;
+    readonly layers: Layers;
+    readonly skills: Skills;
+    readonly consents: OAuthConsents;
+}
+export declare function coreAdminWrites(ports: AdminWritePorts): readonly McpWriteTool[];
+//# sourceMappingURL=admin-writes.d.ts.map

package/dist/admin-writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-writes.d.ts","sourceRoot":"","sources":["../src/admin-writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EAGhB,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAI9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CACjC;AA8CD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,YAAY,EAAE,CAswB/E"}