@numa-tech/numa 1.20.2 → 1.20.4

package/dist/tasks/oss-query.js

@@ -0,0 +1,125 @@
+import { z } from "zod";
+import { loadConfig } from "../config.js";
+import { OssClient } from "../oss/client.js";
+import { OssError, sanitizeOssOutput } from "../oss/errors.js";
+import { SEARCH_FIELDS, projectEntries, searchObjects, validateSearchOptions } from "../oss/search.js";
+import { OssTransferClient } from "../oss/transfers.js";
+const path = z.string().max(1024).refine(value => value === value.trim()
+    && !/[\\\u0000-\u001f\u007f]/u.test(value)
+    && !value.split("/").some(part => part === "." || part === ".."), "Invalid OSS path");
+export const ossQuerySchema = z.object({
+    grant_id: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+    bucket: z.string().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/u).optional()
+        .describe("Exact bucket name; required with prefix when grant_id is omitted"),
+    prefix: path.optional().describe("Exact requested prefix; an explicit empty string requests the bucket root"),
+    ttl: z.number().int().min(900).max(3600).optional(),
+    marker: path.min(1).optional(), delimiter: z.literal("/").optional(), directories_only: z.boolean().optional(),
+    contains: z.string().min(1).max(1024).optional(), suffix: z.string().min(1).max(1024).optional(), ignore_case: z.boolean().optional(),
+    min_size: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+    max_size: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+    modified_after: z.string().optional(), modified_before: z.string().optional(),
+    created_time_key: z.string().optional(), created_after: z.string().optional(), created_before: z.string().optional(),
+    meta: z.array(z.string().max(2048)).max(20).optional(), content_type: z.string().optional(),
+    sort: z.enum(["key", "size", "modified", "created"]).default("key"), order: z.enum(["asc", "desc"]).default("asc"),
+    limit: z.number().int().min(1).max(1000).default(100), scan_limit: z.number().int().min(1).max(100000).default(1000),
+    fields: z.array(z.enum(SEARCH_FIELDS)).min(1).optional()
+}).strict();
+function covered(scope, root, prefix) {
+    const kind = scope?.trim().toUpperCase().replace(/^OSS_/u, "");
+    const normalized = (root ?? "").trim().replace(/^\/+|\/+$/gu, "");
+    if (!["BUCKET", "PREFIX"].includes(kind ?? "") || kind === "PREFIX" && !normalized
+        || !path.safeParse(normalized).success)
+        return false;
+    return !normalized || prefix === normalized || prefix.startsWith(`${normalized}/`);
+}
+// Grant schemas deliberately preserve backend extensions; never return them to the agent.
+function candidate(grant) {
+    return { grant_id: grant.grantId, bucket: grant.bucketName, prefix: grant.objectPrefix ?? "",
+        scope_type: grant.scopeType, permission_level: grant.permissionLevel };
+}
+/** Only selection hints; the issued session and OSS remain the authorization boundary. */
+function supportsQuery(grant, needsHead) {
+    // Nullable Grant metadata represents the absence of explicit policy actions.
+    // Session schemas use undefined for that same legacy permission-level fallback.
+    const actions = grant.actions ?? undefined;
+    const effect = grant.effect ?? undefined;
+    if (actions !== undefined || effect !== undefined) {
+        const required = needsHead ? ["oss:ListObjects", "oss:GetObject"] : ["oss:ListObjects"];
+        return effect === "Allow" && Array.isArray(actions)
+            && required.every(action => actions.includes(action) || actions.includes("oss:*"));
+    }
+    return ["ADMIN", "READ_ONLY", "READ_WRITE", "READ_WRITE_NO_DELETE"].includes(grant.permissionLevel?.trim().toUpperCase() ?? "");
+}
+function safe(value) {
+    const redacted = sanitizeOssOutput(value);
+    const stripUrls = (item) => {
+        if (typeof item === "string")
+            return item.replace(/https?:\/\/[^\s<>"']+/giu, "[REDACTED_URL]");
+        if (Array.isArray(item))
+            return item.map(stripUrls);
+        if (item && typeof item === "object")
+            return Object.fromEntries(Object.entries(item).map(([key, data]) => [key, stripUrls(data)]));
+        return item;
+    };
+    return stripUrls(redacted);
+}
+/** One bounded read workflow; a denied or ambiguous Grant never triggers a fallback. */
+export async function runOssQuery(input, dependencies = {}) {
+    const task = "oss.query";
+    const parsed = ossQuerySchema.safeParse(input);
+    if (!parsed.success)
+        return { status: "needs_input", task,
+            error: { code: "oss_input_invalid", message: "Supply valid OSS query parameters." },
+            missing: [...new Set(parsed.error.issues.map(issue => issue.path.join(".")).filter(Boolean))] };
+    const query = parsed.data;
+    if (query.grant_id === undefined && (query.bucket === undefined || query.prefix === undefined)) {
+        return { status: "needs_input", task, missing: [query.bucket === undefined ? "bucket" : "", query.prefix === undefined ? "prefix" : ""].filter(Boolean),
+            error: { code: "oss_target_required", message: "Specify grant_id, or both an exact bucket and prefix. Use an explicit empty prefix for the bucket root." } };
+    }
+    const options = { marker: query.marker, delimiter: query.delimiter, directoriesOnly: query.directories_only,
+        contains: query.contains, suffix: query.suffix, ignoreCase: query.ignore_case,
+        minSize: query.min_size, maxSize: query.max_size, modifiedAfter: query.modified_after, modifiedBefore: query.modified_before,
+        createdTimeKey: query.created_time_key, createdAfter: query.created_after, createdBefore: query.created_before,
+        meta: query.meta, contentType: query.content_type, sort: query.sort, order: query.order,
+        limit: query.limit, scanLimit: query.scan_limit, fields: query.fields?.join(",") };
+    try {
+        const validated = validateSearchOptions(options);
+        await dependencies.beforeExecute?.();
+        const client = dependencies.clientFactory?.() ?? new OssClient(loadConfig("oss"));
+        let grantId = query.grant_id;
+        if (grantId === undefined) {
+            const available = await client.listGrants();
+            // One platform request, with a hard ceiling on selection and candidate output.
+            if (available.grants.length > 10000)
+                return { status: "needs_input", task, missing: ["grant_id"],
+                    error: { code: "oss_grant_limit", message: "Too many Grants for automatic selection; provide the exact grant_id." } };
+            const matches = available.grants.filter(grant => grant.status === "ACTIVE" && grant.cloudPolicySynced
+                && grant.roleName && grant.bucketName === query.bucket && supportsQuery(grant, validated.needsHead)
+                && covered(grant.scopeType, grant.objectPrefix, query.prefix));
+            if (!matches.length)
+                return { status: "blocked", task,
+                    error: { code: "oss_grant_unavailable", message: "No enabled, synchronized Grant covers the requested bucket and prefix." } };
+            if (matches.length > 1)
+                return { status: "needs_input", task, missing: ["grant_id"],
+                    candidates: safe(matches.slice(0, 100).map(candidate)),
+                    error: { code: "oss_grant_ambiguous", message: "Multiple Grants cover this target; select an exact grant_id. At most 100 candidates are shown." } };
+            grantId = matches[0].grantId;
+        }
+        const session = await client.issueSession(grantId, query.ttl);
+        if (session.grantId !== grantId || query.bucket !== undefined && session.bucketName !== query.bucket
+            || query.prefix !== undefined && !covered(session.scopeType, session.objectPrefix, query.prefix)) {
+            return { status: "blocked", task, error: { code: "oss_target_mismatch", message: "The issued session does not cover the exact requested target." } };
+        }
+        const transfer = dependencies.transferFactory?.() ?? new OssTransferClient();
+        const result = await searchObjects(transfer, session, query.prefix, options);
+        return { status: "succeeded", task,
+            data: safe({ grant_id: grantId, bucket: session.bucketName, ...result, objects: projectEntries(result.objects, validated.fields) }) };
+    }
+    catch (error) {
+        if (!(error instanceof OssError))
+            throw error;
+        return { status: error.code === "oss_input_invalid" ? "needs_input" : "blocked", task,
+            error: { code: error.code, message: safe(error.message) } };
+    }
+}
+//# sourceMappingURL=oss-query.js.map

package/dist/tasks/oss-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oss-query.js","sourceRoot":"","sources":["../../src/tasks/oss-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;OACnE,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;OACvC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;SAChF,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;IAC7G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrI,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,MAAM,EAAE,CAAC;AAQZ,SAAS,OAAO,CAAC,KAAgC,EAAE,IAA+B,EAAE,MAAc;IAChG,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU;WAC7E,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,CAAC,UAAU,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,KAAkB;IACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QAC1F,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,SAAS,aAAa,CAAC,KAAkB,EAAE,SAAkB;IAC3D,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxF,OAAO,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;eAC9C,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAClI,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,IAAa,EAAW,EAAE;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,YAAY,GAAyB,EAAE;IACvF,MAAM,IAAI,GAAG,WAAW,CAAC;IACzB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI;YACvD,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,EAAE;YACnF,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACrJ,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,yGAAyG,EAAE,EAAE,CAAC;IACjK,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,gBAAgB;QACzG,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7E,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,CAAC,eAAe;QAC5H,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc;QAC9G,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;QACvF,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,+EAA+E;YAC/E,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;oBAC9F,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sEAAsE,EAAE,EAAE,CAAC;YACxH,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB;mBAChG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC;mBAChG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;oBACnD,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,wEAAwE,EAAE,EAAE,CAAC;YAChI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;oBACjF,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAc;oBACnE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gGAAgG,EAAE,EAAE,CAAC;YACtJ,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM;eAC/F,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+DAA+D,EAAE,EAAE,CAAC;QACvJ,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,EAAE,EAAE,IAAI,IAAI,iBAAiB,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI;YAChC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI;YACnF,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAW,EAAE,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/tasks/runtime.d.ts

@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { type AuthConfig } from "../config.js";
+import { type WecomNotifyDependencies } from "./wecom-notify.js";
+import { type OssQueryDependencies } from "./oss-query.js";
+import type { TaskResult } from "./types.js";
+export declare const TASKS: readonly [{
+    readonly name: "wecom.notify";
+    readonly tool: "numa_wecom_notify";
+    readonly module: "wecom";
+    readonly readOnly: false;
+    readonly description: "一次完成企微通道检查、精确收件人解析、已授权通知发送和未知结果查询。";
+    readonly schema: z.ZodObject<{
+        recipient_email: z.ZodOptional<z.ZodString>;
+        email_type: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+        recipient_user_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        message_type: z.ZodDefault<z.ZodEnum<{
+            markdown: "markdown";
+            text: "text";
+        }>>;
+        safe: z.ZodDefault<z.ZodBoolean>;
+        request_id: z.ZodOptional<z.ZodString>;
+        confirmed: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, {
+    readonly name: "oss.query";
+    readonly tool: "numa_oss_query";
+    readonly module: "oss";
+    readonly readOnly: true;
+    readonly description: "一次完成精确目标的唯一 Grant 选择和有界 OSS 检索；歧义返回候选。";
+    readonly schema: z.ZodObject<{
+        grant_id: z.ZodOptional<z.ZodNumber>;
+        bucket: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        ttl: z.ZodOptional<z.ZodNumber>;
+        marker: z.ZodOptional<z.ZodString>;
+        delimiter: z.ZodOptional<z.ZodLiteral<"/">>;
+        directories_only: z.ZodOptional<z.ZodBoolean>;
+        contains: z.ZodOptional<z.ZodString>;
+        suffix: z.ZodOptional<z.ZodString>;
+        ignore_case: z.ZodOptional<z.ZodBoolean>;
+        min_size: z.ZodOptional<z.ZodNumber>;
+        max_size: z.ZodOptional<z.ZodNumber>;
+        modified_after: z.ZodOptional<z.ZodString>;
+        modified_before: z.ZodOptional<z.ZodString>;
+        created_time_key: z.ZodOptional<z.ZodString>;
+        created_after: z.ZodOptional<z.ZodString>;
+        created_before: z.ZodOptional<z.ZodString>;
+        meta: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content_type: z.ZodOptional<z.ZodString>;
+        sort: z.ZodDefault<z.ZodEnum<{
+            created: "created";
+            key: "key";
+            modified: "modified";
+            size: "size";
+        }>>;
+        order: z.ZodDefault<z.ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>;
+        limit: z.ZodDefault<z.ZodNumber>;
+        scan_limit: z.ZodDefault<z.ZodNumber>;
+        fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            contentType: "contentType";
+            createdAt: "createdAt";
+            etag: "etag";
+            key: "key";
+            kind: "kind";
+            lastModified: "lastModified";
+            metadata: "metadata";
+            sizeBytes: "sizeBytes";
+            storageClass: "storageClass";
+            type: "type";
+        }>>>;
+    }, z.core.$strict>;
+}];
+export interface TaskDependencies {
+    wecom?: WecomNotifyDependencies;
+    oss?: OssQueryDependencies;
+    /** Injection points keep tests offline; production always validates the selected profile. */
+    initializeProfile?: () => Promise<void>;
+    config?: (task: string) => AuthConfig;
+}
+export declare function inspectTasks(name?: string): {
+    name: "oss.query" | "wecom.notify";
+    tool: "numa_oss_query" | "numa_wecom_notify";
+    module: "oss" | "wecom";
+    description: "一次完成企微通道检查、精确收件人解析、已授权通知发送和未知结果查询。" | "一次完成精确目标的唯一 Grant 选择和有界 OSS 检索；歧义返回候选。";
+    read_only: boolean;
+    input_schema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
+        recipient_email: z.ZodOptional<z.ZodString>;
+        email_type: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+        recipient_user_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        message_type: z.ZodDefault<z.ZodEnum<{
+            markdown: "markdown";
+            text: "text";
+        }>>;
+        safe: z.ZodDefault<z.ZodBoolean>;
+        request_id: z.ZodOptional<z.ZodString>;
+        confirmed: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict> | z.ZodObject<{
+        grant_id: z.ZodOptional<z.ZodNumber>;
+        bucket: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        ttl: z.ZodOptional<z.ZodNumber>;
+        marker: z.ZodOptional<z.ZodString>;
+        delimiter: z.ZodOptional<z.ZodLiteral<"/">>;
+        directories_only: z.ZodOptional<z.ZodBoolean>;
+        contains: z.ZodOptional<z.ZodString>;
+        suffix: z.ZodOptional<z.ZodString>;
+        ignore_case: z.ZodOptional<z.ZodBoolean>;
+        min_size: z.ZodOptional<z.ZodNumber>;
+        max_size: z.ZodOptional<z.ZodNumber>;
+        modified_after: z.ZodOptional<z.ZodString>;
+        modified_before: z.ZodOptional<z.ZodString>;
+        created_time_key: z.ZodOptional<z.ZodString>;
+        created_after: z.ZodOptional<z.ZodString>;
+        created_before: z.ZodOptional<z.ZodString>;
+        meta: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content_type: z.ZodOptional<z.ZodString>;
+        sort: z.ZodDefault<z.ZodEnum<{
+            created: "created";
+            key: "key";
+            modified: "modified";
+            size: "size";
+        }>>;
+        order: z.ZodDefault<z.ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>;
+        limit: z.ZodDefault<z.ZodNumber>;
+        scan_limit: z.ZodDefault<z.ZodNumber>;
+        fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            contentType: "contentType";
+            createdAt: "createdAt";
+            etag: "etag";
+            key: "key";
+            kind: "kind";
+            lastModified: "lastModified";
+            metadata: "metadata";
+            sizeBytes: "sizeBytes";
+            storageClass: "storageClass";
+            type: "type";
+        }>>>;
+    }, z.core.$strict>>;
+    result_statuses: string[];
+}[];
+/** Validate configuration only. Clients obtain/reuse tokens and the server enforces authorization. */
+export declare function validateTaskIdentity(config: AuthConfig): void;
+export declare function runTask(name: string, input: unknown, dependencies?: TaskDependencies): Promise<TaskResult>;

package/dist/tasks/runtime.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { loadConfig } from "../config.js";
+import { currentPlatformProfile, initializePlatformProfile } from "../platform-profile.js";
+import { runWecomNotify, wecomNotifySchema } from "./wecom-notify.js";
+import { runOssQuery, ossQuerySchema } from "./oss-query.js";
+export const TASKS = [
+    { name: "wecom.notify", tool: "numa_wecom_notify", module: "wecom", readOnly: false,
+        description: "一次完成企微通道检查、精确收件人解析、已授权通知发送和未知结果查询。", schema: wecomNotifySchema },
+    { name: "oss.query", tool: "numa_oss_query", module: "oss", readOnly: true,
+        description: "一次完成精确目标的唯一 Grant 选择和有界 OSS 检索；歧义返回候选。", schema: ossQuerySchema },
+];
+export function inspectTasks(name) {
+    return TASKS.filter(task => name === undefined || task.name === name).map(task => ({
+        name: task.name, tool: task.tool, module: task.module,
+        description: task.description, read_only: task.readOnly,
+        input_schema: z.toJSONSchema(task.schema, { io: "input" }),
+        result_statuses: ["succeeded", "needs_input", "blocked", "pending"],
+    }));
+}
+/** Validate configuration only. Clients obtain/reuse tokens and the server enforces authorization. */
+export function validateTaskIdentity(config) {
+    if (!config.backendBaseUrl || !config.discoveryUrl || !config.clientId?.trim())
+        throw Object.assign(new Error(), { code: "TASK_CONFIGURATION_REQUIRED" });
+    if (config.authenticationMode === "client_credentials") {
+        if (config.clientId === "mcp-client" || Boolean(config.clientSecret) === Boolean(config.clientSecretFile))
+            throw Object.assign(new Error(), { code: "TASK_MACHINE_IDENTITY_REQUIRED" });
+    }
+    else if (config.clientSecret || config.clientSecretFile) {
+        // An explicit browser identity must not accidentally consume machine credentials.
+        throw Object.assign(new Error(), { code: "TASK_IDENTITY_CONFLICT" });
+    }
+}
+const configurationMessages = {
+    TASK_CONFIGURATION_REQUIRED: "Configure the selected platform API, issuer and client before running this task.",
+    TASK_MACHINE_IDENTITY_REQUIRED: "Machine mode requires a dedicated client and exactly one Secret source in this process environment. No browser fallback was attempted.",
+    TASK_IDENTITY_CONFLICT: "Browser mode and machine credentials conflict. Correct this process configuration; identity was not changed.",
+};
+export async function runTask(name, input, dependencies = {}) {
+    const task = TASKS.find(item => item.name === name);
+    if (!task)
+        return { task: name, status: "blocked", error: { code: "TASK_UNKNOWN", message: "Unknown task. Use task inspect to list supported tasks." } };
+    // Validate shape before loading a profile, obtaining credentials, or making any network requests.
+    const parsed = task.schema.safeParse(input);
+    if (!parsed.success)
+        return { task: name, status: "needs_input",
+            missing: [...new Set(parsed.error.issues.map(issue => issue.path.join(".") || "input"))],
+            error: { code: "TASK_INPUT_INVALID", message: "Task input does not match its schema. Correct the listed fields." } };
+    try {
+        const beforeExecute = async () => {
+            if (dependencies.initializeProfile)
+                await dependencies.initializeProfile();
+            else if (!currentPlatformProfile())
+                await initializePlatformProfile();
+            const config = dependencies.config?.(name) ?? loadConfig(name === "oss.query" ? "oss" : "platform");
+            validateTaskIdentity(config);
+        };
+        const result = name === "wecom.notify"
+            ? await runWecomNotify(parsed.data, { ...dependencies.wecom, beforeExecute })
+            : await runOssQuery(parsed.data, { ...dependencies.oss, beforeExecute });
+        // Each task owns output projection/redaction. Do not rewrite opaque recovery IDs here.
+        return result;
+    }
+    catch (error) {
+        // Never expose provider exceptions, request objects, credentials, or arbitrary response bodies.
+        const rawCode = error && typeof error === "object" && "code" in error ? error.code : undefined;
+        const code = typeof rawCode === "string" && /^[A-Za-z][A-Za-z0-9_]{0,79}$/u.test(rawCode) ? rawCode : "TASK_CONFIGURATION_OR_AUTH_FAILED";
+        return { task: name, status: "blocked", error: { code,
+                message: configurationMessages[code] ?? "Task initialization failed. Check the selected profile and process authentication configuration; no alternate identity was used." } };
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/tasks/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/tasks/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAgC,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,cAAc,EAA6B,MAAM,gBAAgB,CAAC;AAGxF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK;QACjF,WAAW,EAAE,oCAAoC,EAAE,MAAM,EAAE,iBAAiB,EAAE;IAChF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI;QACxE,WAAW,EAAE,wCAAwC,EAAE,MAAM,EAAE,cAAc,EAAE;CACzE,CAAC;AAUX,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ;QACvD,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC1D,eAAe,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;KACpE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACvG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1D,kFAAkF;QAClF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAA2B;IACpD,2BAA2B,EAAE,kFAAkF;IAC/G,8BAA8B,EAAE,wIAAwI;IACxK,sBAAsB,EAAE,8GAA8G;CACvI,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAc,EAAE,YAAY,GAAqB,EAAE;IAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,yDAAyD,EAAE,EAAE,CAAC;IACzJ,kGAAkG;IAClG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa;YAC7D,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;YACxF,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,CAAC;IACvH,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;YAC/B,IAAI,YAAY,CAAC,iBAAiB;gBAAE,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;iBACtE,IAAI,CAAC,sBAAsB,EAAE;gBAAE,MAAM,yBAAyB,EAAE,CAAC;YACtE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACpG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,KAAK,cAAc;YACpC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;YAC7E,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,uFAAuF;QACvF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gGAAgG;QAChG,MAAM,OAAO,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC;QAC1I,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI;gBACnD,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,kIAAkI,EAAE,EAAE,CAAC;IACnL,CAAC;AACH,CAAC"}

package/dist/tasks/tools.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type TaskDependencies } from "./runtime.js";
+export declare function registerTaskTools(server: McpServer, modules: ReadonlySet<string>, dependencies?: TaskDependencies): void;

package/dist/tasks/tools.js

@@ -0,0 +1,16 @@
+import { TASKS, runTask } from "./runtime.js";
+export function registerTaskTools(server, modules, dependencies = {}) {
+    for (const task of TASKS) {
+        if (!modules.has(task.module))
+            continue;
+        server.registerTool(task.tool, {
+            description: `${task.description} Call this task directly; configuration/authentication and required lookups run internally, without separate auth/catalog/capability calls. Uses this MCP process identity and environment. Returns succeeded, needs_input, blocked or pending. ${task.readOnly ? "Read-only bounded query; ambiguous Grants require user selection." : "SIDE EFFECT: requires user-approved exact recipients and content, confirmed=true and a stable request_id. ACCEPTED is not delivery. pending must be recovered with numa_wecom_status using the same request_id; never resend."}`,
+            inputSchema: task.schema,
+            annotations: { readOnlyHint: task.readOnly, destructiveHint: false, idempotentHint: task.readOnly, openWorldHint: true },
+        }, async (input) => {
+            const result = await runTask(task.name, input, dependencies);
+            return { isError: result.status === "blocked", content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: { ...result } };
+        });
+    }
+}
+//# sourceMappingURL=tools.js.map

package/dist/tasks/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/tasks/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAyB,MAAM,cAAc,CAAC;AAErE,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,OAA4B,EAAE,YAAY,GAAqB,EAAE;IACpH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACxC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE;YAC7B,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,mPAAmP,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC,CAAC,+NAA+N,EAAE;YAC1kB,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE;SACzH,EAAE,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;QACxJ,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/tasks/types.d.ts

@@ -0,0 +1,14 @@
+/** A task result is actionable without another discovery/preflight model turn. */
+export interface TaskResult {
+    status: "succeeded" | "needs_input" | "blocked" | "pending";
+    task: string;
+    data?: unknown;
+    error?: {
+        code: string;
+        message: string;
+    };
+    missing?: string[];
+    candidates?: unknown[];
+    request_id?: string;
+}
+export declare function taskExitCode(result: TaskResult): number;

package/dist/tasks/types.js

@@ -0,0 +1,4 @@
+export function taskExitCode(result) {
+    return { succeeded: 0, needs_input: 2, blocked: 3, pending: 4 }[result.status];
+}
+//# sourceMappingURL=types.js.map

package/dist/tasks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tasks/types.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC"}

package/dist/tasks/wecom-notify.d.ts

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { WecomClient } from "../wecom/client.js";
+import type { TaskResult } from "./types.js";
+/** Optional fields let both entry points return actionable needs_input results. */
+export declare const wecomNotifySchema: z.ZodObject<{
+    recipient_email: z.ZodOptional<z.ZodString>;
+    email_type: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+    recipient_user_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    content: z.ZodOptional<z.ZodString>;
+    message_type: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        text: "text";
+    }>>;
+    safe: z.ZodDefault<z.ZodBoolean>;
+    request_id: z.ZodOptional<z.ZodString>;
+    confirmed: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+type NotifyClient = Pick<WecomClient, "capabilities" | "recipientByEmail" | "send" | "statusByRequest">;
+export interface WecomNotifyDependencies {
+    client?: NotifyClient;
+    clientFactory?: () => NotifyClient;
+    beforeExecute?: () => Promise<void>;
+}
+/** Deterministic, bounded notification workflow shared by CLI and MCP. */
+export declare function runWecomNotify(input: unknown, dependencies?: WecomNotifyDependencies): Promise<TaskResult>;
+export {};

package/dist/tasks/wecom-notify.js

@@ -0,0 +1,150 @@
+import { z } from "zod";
+import { loadConfig } from "../config.js";
+import { WecomClient } from "../wecom/client.js";
+import { WecomError } from "../wecom/errors.js";
+import { EmailSchema, EmailTypeSchema, MessageTypeSchema, RequestIdSchema, SendMessageSchema, UserIdSchema } from "../wecom/schemas.js";
+/** Optional fields let both entry points return actionable needs_input results. */
+export const wecomNotifySchema = z.object({
+    recipient_email: EmailSchema.optional(),
+    email_type: EmailTypeSchema.optional(),
+    recipient_user_ids: z.array(UserIdSchema).min(1).max(100).refine(ids => new Set(ids).size === ids.length).optional(),
+    content: z.string().min(1).refine(value => value.trim().length > 0).optional(),
+    message_type: MessageTypeSchema.default("text"),
+    safe: z.boolean().default(false),
+    request_id: RequestIdSchema.optional(),
+    confirmed: z.boolean().default(false).describe("True only when the user has authorized these exact recipients and content; existing authorization is sufficient")
+}).strict();
+const task = "wecom.notify";
+function blocked(code, message, requestId) {
+    return { task, status: "blocked", error: { code, message }, ...(requestId ? { request_id: requestId } : {}) };
+}
+function pending(requestId) {
+    return { task, status: "pending", request_id: requestId, error: {
+            code: "WECOM_RESULT_PENDING",
+            message: "Send acceptance is not yet known. Query status using this request_id; do not resend or generate a new request ID."
+        } };
+}
+function safeError(error, requestId) {
+    const status = error instanceof WecomError ? error.status : undefined;
+    return blocked(status === 401 ? "WECOM_AUTHENTICATION_REQUIRED" : status === 403 ? "WECOM_PERMISSION_DENIED" : "WECOM_TASK_BLOCKED", status === 401 || status === 403
+        ? "The configured identity cannot complete this operation. Correct its authentication or grants; do not switch identities."
+        : "WeCom operation failed before acceptance. Check channel configuration, exact recipient and email type, and the configured identity. No automatic retry was made.", requestId);
+}
+function receiptResult(receipt, requestId) {
+    // Never report another request's receipt as acceptance of this one.
+    if (receipt.requestId !== requestId)
+        return pending(requestId);
+    const data = { message_id: receipt.id, receipt_status: receipt.status,
+        recipient_user_ids: receipt.recipientUserIds, invalid_user_ids: receipt.invalidUserIds };
+    if (receipt.status === "ACCEPTED")
+        return { task, status: "succeeded", request_id: requestId,
+            data: { ...data, message: "Accepted by the WeCom API; delivery and read status are not confirmed." } };
+    if (receipt.status === "SENDING" || receipt.status === "UNKNOWN")
+        return { ...pending(requestId), data };
+    return { ...blocked(receipt.status === "PARTIAL" ? "WECOM_PARTIAL_ACCEPTANCE" : "WECOM_SEND_FAILED", receipt.status === "PARTIAL"
+            ? "The API accepted only some recipients. Review the receipt; do not resend to the full recipient list."
+            : "The API reported a failed send. Review the receipt before taking further action.", requestId), data };
+}
+async function recover(client, requestId) {
+    try {
+        return receiptResult(await client.statusByRequest(requestId), requestId);
+    }
+    catch (error) {
+        if (error instanceof WecomError && (error.status === 401 || error.status === 403)) {
+            return { ...safeError(error, requestId), data: { send_outcome: "unknown", message: "The send outcome remains unknown. Restore access and query this request_id; do not resend." } };
+        }
+        // A missing ledger entry, unavailable platform, or invalid receipt is not proof of no send.
+        return pending(requestId);
+    }
+}
+/** Deterministic, bounded notification workflow shared by CLI and MCP. */
+export async function runWecomNotify(input, dependencies = {}) {
+    const parsed = wecomNotifySchema.safeParse(input);
+    if (!parsed.success)
+        return { task, status: "needs_input", missing: [...new Set(parsed.error.issues
+                    .map(issue => typeof issue.path[0] === "string" ? issue.path[0] : "input"))],
+            error: { code: "WECOM_INPUT_INVALID", message: "Supply valid notification fields, exact recipients, and a stable request_id of 8-128 safe ASCII characters." } };
+    const value = parsed.data;
+    const missing = [];
+    if (!value.content)
+        missing.push("content");
+    if (!value.request_id)
+        missing.push("request_id");
+    if (!value.confirmed)
+        missing.push("confirmed");
+    if (!value.recipient_email && !value.recipient_user_ids)
+        missing.push("recipient_email or recipient_user_ids");
+    if (value.recipient_email && value.email_type === undefined)
+        missing.push("email_type");
+    if (missing.length)
+        return { task, status: "needs_input", missing, error: { code: "WECOM_INPUT_REQUIRED",
+                message: "Provide the missing fields. confirmed=true represents existing user authorization for these exact recipients and content; ask only if authorization is absent." } };
+    const requestId = value.request_id;
+    const body = SendMessageSchema.safeParse({
+        ...(value.recipient_email ? { recipientEmail: value.recipient_email, emailType: value.email_type } : {}),
+        ...(value.recipient_user_ids ? { recipientUserIds: value.recipient_user_ids } : {}),
+        // An email_type without email is invalid even when userid recipients were supplied.
+        ...(!value.recipient_email && value.email_type !== undefined ? { emailType: value.email_type } : {}),
+        messageType: value.message_type, content: value.content, safe: value.safe
+    });
+    if (!body.success) {
+        const names = { recipientUserIds: "recipient_user_ids", recipientEmail: "recipient_email", emailType: "email_type", messageType: "message_type" };
+        const fields = body.error.issues.map(issue => {
+            const field = typeof issue.path[0] === "string" ? issue.path[0] : "input";
+            // The shared DTO uses the recipientUserIds path for all recipient-mode conflicts.
+            if (field === "recipientUserIds" && value.email_type !== undefined && !value.recipient_email)
+                return "email_type";
+            return names[field] ?? field;
+        });
+        if (value.recipient_email && value.recipient_user_ids)
+            fields.push("recipient_email");
+        return { task, status: "needs_input", request_id: requestId, missing: [...new Set(fields)],
+            error: { code: "WECOM_INPUT_INVALID", message: "Choose exactly one recipient mode; content must fit 2048 UTF-8 bytes and safe mode is available only for text." } };
+    }
+    let client;
+    let recipientUserIds = value.recipient_user_ids;
+    // Shared runner preserves actionable authentication/configuration failures.
+    await dependencies.beforeExecute?.();
+    try {
+        client = dependencies.client ?? dependencies.clientFactory?.() ?? new WecomClient(loadConfig());
+        const caps = await client.capabilities();
+        if (!caps.enabled || !caps.configured)
+            return blocked("WECOM_CHANNEL_UNAVAILABLE", "The WeCom channel is disabled or not configured.", requestId);
+        if (!caps.messageTypes.includes(value.message_type))
+            return blocked("WECOM_MESSAGE_TYPE_UNSUPPORTED", "The channel does not support this message type.", requestId);
+        if ((recipientUserIds?.length ?? 1) > caps.maxRecipients)
+            return blocked("WECOM_RECIPIENT_LIMIT", "The requested recipients exceed the channel limit; reduce the explicit recipient list.", requestId);
+        const byteLimit = value.message_type === "text" ? caps.maxTextBytes : caps.maxMarkdownBytes;
+        if (Buffer.byteLength(value.content, "utf8") > byteLimit)
+            return blocked("WECOM_CONTENT_LIMIT", "The content exceeds the channel UTF-8 byte limit.", requestId);
+        if (value.recipient_email) {
+            const recipient = await client.recipientByEmail(value.recipient_email, value.email_type);
+            recipientUserIds = [recipient.userId];
+        }
+    }
+    catch (error) {
+        return safeError(error, requestId);
+    }
+    // Validate the resolved ID too: no mutation happens before the complete body is valid.
+    const resolved = SendMessageSchema.safeParse({ recipientUserIds, messageType: value.message_type, content: value.content, safe: value.safe });
+    if (!resolved.success)
+        return blocked("WECOM_RECIPIENT_INVALID", "The exact recipient could not be resolved to valid user IDs. Do not guess addresses or switch email types.", requestId);
+    try {
+        // Preserve mailbox + type in the POST: the server's idempotency fingerprint
+        // retains the original recipient resolution even if the mailbox later changes.
+        const receipt = await client.send(body.data, requestId);
+        if (receipt.requestId !== requestId || receipt.status === "UNKNOWN" || receipt.status === "SENDING")
+            return recover(client, requestId);
+        return receiptResult(receipt, requestId);
+    }
+    catch (error) {
+        if (error instanceof WecomError && error.code !== "WECOM_RESULT_UNKNOWN"
+            && (error.code === "WECOM_INPUT_INVALID" || error.status !== undefined && error.status >= 400 && error.status < 500))
+            return safeError(error, requestId);
+        if (error instanceof Error && error.name === "AuthError")
+            return safeError(error, requestId);
+        // Once POST was attempted, transport and unexpected errors are conservatively uncertain.
+        return recover(client, requestId);
+    }
+}
+//# sourceMappingURL=wecom-notify.js.map

package/dist/tasks/wecom-notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wecom-notify.js","sourceRoot":"","sources":["../../src/tasks/wecom-notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAgB,MAAM,qBAAqB,CAAC;AAGtJ,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,eAAe,EAAE,WAAW,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACpH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9E,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,iHAAiH,CAAC;CAClK,CAAC,CAAC,MAAM,EAAE,CAAC;AAQZ,MAAM,IAAI,GAAG,cAAc,CAAC;AAC5B,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,SAAkB;IAChE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AACD,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE;YAC9D,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,mHAAmH;SAC7H,EAAE,CAAC;AACN,CAAC;AACD,SAAS,SAAS,CAAC,KAAc,EAAE,SAAkB;IACnD,MAAM,MAAM,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,oBAAoB,EACjI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAC9B,CAAC,CAAC,yHAAyH;QAC3H,CAAC,CAAC,kKAAkK,EAAE,SAAS,CAAC,CAAC;AACvL,CAAC;AACD,SAAS,aAAa,CAAC,OAAgB,EAAE,SAAiB;IACxD,oEAAoE;IACpE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM;QACnE,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS;YAC1F,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,wEAAwE,EAAE,EAAE,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IACzG,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,mBAAmB,EACjG,OAAO,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,sGAAsG;YACxG,CAAC,CAAC,kFAAkF,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;AAC/G,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,MAAoB,EAAE,SAAiB;IAC5D,IAAI,CAAC;QAAC,OAAO,aAAa,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAClF,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,4FAA4F,EAAE,EAAE,CAAC;QACtL,CAAC;QACD,4FAA4F;QAC5F,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAc,EAAE,YAAY,GAA4B,EAAE;IAC7F,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;qBAChG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6GAA6G,EAAE,EAAE,CAAC;IACnK,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB;gBACtG,OAAO,EAAE,gKAAgK,EAAE,EAAE,CAAC;IAChL,MAAM,SAAS,GAAG,KAAK,CAAC,UAAW,CAAC;IACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,oFAAoF;QACpF,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;KAC3E,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,KAAK,GAA2B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAC1K,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAC3C,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1E,kFAAkF;YAClF,IAAI,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,eAAe;gBAAE,OAAO,YAAY,CAAC;YAClH,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,kBAAkB;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YACxF,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gHAAgH,EAAE,EAAE,CAAC;IACxK,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAChD,4EAA4E;IAC5E,MAAM,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,EAAE,IAAI,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC,2BAA2B,EAAE,kDAAkD,EAAE,SAAS,CAAC,CAAC;QAClJ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAC,gCAAgC,EAAE,iDAAiD,EAAE,SAAS,CAAC,CAAC;QACpK,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa;YAAE,OAAO,OAAO,CAAC,uBAAuB,EAAE,wFAAwF,EAAE,SAAS,CAAC,CAAC;QACvM,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC5F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAQ,EAAE,MAAM,CAAC,GAAG,SAAS;YAAE,OAAO,OAAO,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,SAAS,CAAC,CAAC;QACjK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,UAAW,CAAC,CAAC;YAC1F,gBAAgB,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAEvD,uFAAuF;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/I,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,yBAAyB,EAAE,4GAA4G,EAAE,SAAS,CAAC,CAAC;IAC1L,IAAI,CAAC;QACH,4EAA4E;QAC5E,+EAA+E;QAC/E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACvI,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB;eACnE,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3J,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7F,yFAAyF;QACzF,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}