@oobe-protocol-labs/sap-mcp-server 0.1.0

package/dist/policy/local-policy-engine.js

@@ -0,0 +1,318 @@
+/**
+ * Local Policy Engine
+ *
+ * Deterministic security policies for SAP MCP Server
+ * Runs entirely locally - no external dependencies
+ *
+ * Features:
+ * - Spend limits per tool/operation
+ * - Program whitelist/blacklist
+ * - Address whitelist/blacklist
+ * - Rate limiting per user
+ * - Time-based restrictions
+ */
+/**
+ * Runtime service that implements local policy engine behavior.
+ */
+export class LocalPolicyEngine {
+    config;
+    callHistory = new Map();
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Validate a tool call against all policy rules
+     */
+    async validateToolCall(context) {
+        const decisions = [];
+        // 1. Check blacklist (highest priority)
+        const blacklistCheck = this.checkBlacklist(context);
+        if (blacklistCheck.blocked) {
+            return blacklistCheck;
+        }
+        decisions.push(blacklistCheck);
+        // 2. Check whitelist
+        const whitelistCheck = this.checkWhitelist(context);
+        if (whitelistCheck.blocked) {
+            return whitelistCheck;
+        }
+        decisions.push(whitelistCheck);
+        // 3. Check spend limits
+        const spendLimitCheck = this.checkSpendLimits(context);
+        if (spendLimitCheck.blocked) {
+            return spendLimitCheck;
+        }
+        decisions.push(spendLimitCheck);
+        // 4. Check rate limits
+        const rateLimitCheck = this.checkRateLimits(context);
+        if (rateLimitCheck.blocked) {
+            return rateLimitCheck;
+        }
+        decisions.push(rateLimitCheck);
+        // 5. Check escalation requirements
+        const escalationCheck = this.checkEscalation(context);
+        if (escalationCheck.escalated) {
+            return escalationCheck;
+        }
+        decisions.push(escalationCheck);
+        // 6. Check time windows
+        const timeCheck = this.checkTimeWindow(context);
+        if (timeCheck.blocked) {
+            return timeCheck;
+        }
+        decisions.push(timeCheck);
+        // All checks passed
+        return {
+            allowed: true,
+            reason: 'All policy checks passed',
+            rule: 'default-allow',
+            metadata: {
+                checksPerformed: decisions.length,
+                timestamp: Date.now(),
+            },
+        };
+    }
+    /**
+     * Check if program or address is blacklisted
+     */
+    checkBlacklist(context) {
+        // Check program blacklist
+        if (context.programId && this.config.programBlacklist.includes(context.programId)) {
+            return {
+                allowed: false,
+                blocked: true,
+                reason: `Program ${context.programId} is blacklisted`,
+                rule: 'program-blacklist',
+            };
+        }
+        // Check address blacklist
+        if (context.destination && this.config.addressBlacklist.includes(context.destination)) {
+            return {
+                allowed: false,
+                blocked: true,
+                reason: `Address ${context.destination} is blacklisted`,
+                rule: 'address-blacklist',
+            };
+        }
+        return { allowed: true, reason: 'Not blacklisted' };
+    }
+    /**
+     * Check if program or address is whitelisted (if whitelist is configured)
+     */
+    checkWhitelist(context) {
+        // Only enforce whitelist if it's configured (non-empty)
+        if (this.config.programWhitelist.length > 0 && context.programId) {
+            if (!this.config.programWhitelist.includes(context.programId)) {
+                return {
+                    allowed: false,
+                    blocked: true,
+                    reason: `Program ${context.programId} is not whitelisted`,
+                    rule: 'program-whitelist',
+                };
+            }
+        }
+        if (this.config.addressWhitelist.length > 0 && context.destination) {
+            if (!this.config.addressWhitelist.includes(context.destination)) {
+                return {
+                    allowed: false,
+                    blocked: true,
+                    reason: `Address ${context.destination} is not whitelisted`,
+                    rule: 'address-whitelist',
+                };
+            }
+        }
+        return { allowed: true, reason: 'Whitelist check passed' };
+    }
+    /**
+     * Check if amount exceeds spend limits
+     */
+    checkSpendLimits(context) {
+        if (!context.amount) {
+            return { allowed: true, reason: 'No amount to check' };
+        }
+        const limit = this.config.spendLimits[context.toolName];
+        if (limit !== undefined && context.amount > limit) {
+            return {
+                allowed: false,
+                blocked: true,
+                reason: `Amount ${context.amount} exceeds limit ${limit} for ${context.toolName}`,
+                rule: 'spend-limit',
+                metadata: {
+                    amount: context.amount,
+                    limit,
+                    tool: context.toolName,
+                },
+            };
+        }
+        // Check global limit if tool-specific limit not set
+        const globalLimit = this.config.spendLimits['*'];
+        if (globalLimit !== undefined && context.amount > globalLimit) {
+            return {
+                allowed: false,
+                blocked: true,
+                reason: `Amount ${context.amount} exceeds global limit ${globalLimit}`,
+                rule: 'global-spend-limit',
+                metadata: {
+                    amount: context.amount,
+                    limit: globalLimit,
+                },
+            };
+        }
+        return { allowed: true, reason: 'Within spend limits' };
+    }
+    /**
+     * Check rate limiting per user
+     */
+    checkRateLimits(context) {
+        const now = Date.now();
+        const windowMs = 60 * 1000; // 1 minute window
+        const userKey = `${context.user}:${context.toolName}`;
+        // Get or initialize call history
+        const history = this.callHistory.get(userKey) || [];
+        // Filter to only recent calls
+        const recentCalls = history.filter(call => now - call.timestamp < windowMs);
+        // Check rate limit
+        const limit = this.config.rateLimits[context.toolName] ?? this.config.rateLimits['*'] ?? Infinity;
+        if (recentCalls.length >= limit) {
+            return {
+                allowed: false,
+                blocked: true,
+                reason: `Rate limit exceeded: ${recentCalls.length}/${limit} calls per minute`,
+                rule: 'rate-limit',
+                metadata: {
+                    calls: recentCalls.length,
+                    limit,
+                    windowMs,
+                },
+            };
+        }
+        // Record this call
+        recentCalls.push({ timestamp: now, tool: context.toolName });
+        this.callHistory.set(userKey, recentCalls);
+        // Cleanup old entries periodically
+        if (recentCalls.length < history.length) {
+            this.callHistory.set(userKey, recentCalls);
+        }
+        return { allowed: true, reason: 'Within rate limits' };
+    }
+    /**
+     * Check if tool requires human escalation
+     */
+    checkEscalation(context) {
+        if (this.config.escalationTools.includes(context.toolName)) {
+            return {
+                allowed: false,
+                escalated: true,
+                reason: `Tool ${context.toolName} requires human approval`,
+                rule: 'escalation-required',
+                metadata: {
+                    tool: context.toolName,
+                    escalationType: 'human-approval',
+                },
+            };
+        }
+        return { allowed: true, reason: 'No escalation required' };
+    }
+    /**
+     * Check if operation is within allowed time window
+     */
+    checkTimeWindow(context) {
+        if (!this.config.allowedHours) {
+            return { allowed: true, reason: 'No time restrictions' };
+        }
+        const now = context.timestamp ?? Date.now();
+        const hour = new Date(now).getUTCHours();
+        const { start, end } = this.config.allowedHours;
+        // Handle both same-day and overnight windows
+        let inWindow;
+        if (start <= end) {
+            inWindow = hour >= start && hour < end;
+        }
+        else {
+            // Overnight window (e.g., start=22, end=6)
+            inWindow = hour >= start || hour < end;
+        }
+        if (!inWindow) {
+            return {
+                allowed: false,
+                blocked: true,
+                reason: `Operations not allowed at ${hour}:00 UTC (allowed: ${start}:00-${end}:00)`,
+                rule: 'time-window',
+                metadata: {
+                    currentHour: hour,
+                    allowedStart: start,
+                    allowedEnd: end,
+                },
+            };
+        }
+        return { allowed: true, reason: 'Within allowed time window' };
+    }
+    /**
+     * Get current policy configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Clear call history (useful for testing)
+     */
+    clearHistory() {
+        this.callHistory.clear();
+    }
+}
+/**
+ * Create policy config from environment variables
+ */
+export function createPolicyConfigFromEnv() {
+    const spendLimitsRaw = process.env.SAP_MCP_SPEND_LIMITS || '{}';
+    const rateLimitsRaw = process.env.SAP_MCP_RATE_LIMITS || '{}';
+    let spendLimits;
+    let rateLimits;
+    try {
+        spendLimits = JSON.parse(spendLimitsRaw);
+    }
+    catch {
+        spendLimits = {};
+    }
+    try {
+        rateLimits = JSON.parse(rateLimitsRaw);
+    }
+    catch {
+        rateLimits = {};
+    }
+    const programWhitelist = process.env.SAP_MCP_PROGRAM_WHITELIST
+        ? process.env.SAP_MCP_PROGRAM_WHITELIST.split(',').map(s => s.trim())
+        : [];
+    const programBlacklist = process.env.SAP_MCP_PROGRAM_BLACKLIST
+        ? process.env.SAP_MCP_PROGRAM_BLACKLIST.split(',').map(s => s.trim())
+        : [];
+    const addressWhitelist = process.env.SAP_MCP_ADDRESS_WHITELIST
+        ? process.env.SAP_MCP_ADDRESS_WHITELIST.split(',').map(s => s.trim())
+        : [];
+    const addressBlacklist = process.env.SAP_MCP_ADDRESS_BLACKLIST
+        ? process.env.SAP_MCP_ADDRESS_BLACKLIST.split(',').map(s => s.trim())
+        : [];
+    const escalationTools = process.env.SAP_MCP_ESCALATION_TOOLS
+        ? process.env.SAP_MCP_ESCALATION_TOOLS.split(',').map(s => s.trim())
+        : ['sap_close_agent', 'sap_withdraw_escrow', 'sap_transfer_ownership'];
+    // Parse time window if specified (format: "9-17" for 9am-5pm UTC)
+    let allowedHours;
+    const timeWindowEnv = process.env.SAP_MCP_ALLOWED_HOURS;
+    if (timeWindowEnv) {
+        const [start, end] = timeWindowEnv.split('-').map(s => parseInt(s.trim(), 10));
+        if (!isNaN(start) && !isNaN(end)) {
+            allowedHours = { start, end };
+        }
+    }
+    return {
+        spendLimits,
+        programWhitelist,
+        programBlacklist,
+        addressWhitelist,
+        addressBlacklist,
+        rateLimits,
+        escalationTools,
+        allowedHours,
+    };
+}
+//# sourceMappingURL=local-policy-engine.js.map

package/dist/policy/local-policy-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-policy-engine.js","sourceRoot":"","sources":["../../src/policy/local-policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA2DH;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAuD,IAAI,GAAG,EAAE,CAAC;IAEpF,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QAC3C,MAAM,SAAS,GAAqB,EAAE,CAAC;QAEvC,wCAAwC;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,qBAAqB;QACrB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,wBAAwB;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhC,uBAAuB;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,mCAAmC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhC,wBAAwB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1B,oBAAoB;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;YAClC,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE;gBACR,eAAe,EAAE,SAAS,CAAC,MAAM;gBACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAsB;QAC3C,0BAA0B;QAC1B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,iBAAiB;gBACrD,IAAI,EAAE,mBAAmB;aAC1B,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,OAAO,CAAC,WAAW,iBAAiB;gBACvD,IAAI,EAAE,mBAAmB;aAC1B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAsB;QAC3C,wDAAwD;QACxD,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,qBAAqB;oBACzD,IAAI,EAAE,mBAAmB;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW,OAAO,CAAC,WAAW,qBAAqB;oBAC3D,IAAI,EAAE,mBAAmB;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAsB;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,kBAAkB,KAAK,QAAQ,OAAO,CAAC,QAAQ,EAAE;gBACjF,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK;oBACL,IAAI,EAAE,OAAO,CAAC,QAAQ;iBACvB;aACF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,yBAAyB,WAAW,EAAE;gBACtE,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,WAAW;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kBAAkB;QAC9C,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtD,iCAAiC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAEpD,8BAA8B;QAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;QAE5E,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAClG,IAAI,WAAW,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,wBAAwB,WAAW,CAAC,MAAM,IAAI,KAAK,mBAAmB;gBAC9E,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE;oBACR,KAAK,EAAE,WAAW,CAAC,MAAM;oBACzB,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE3C,mCAAmC;QACnC,IAAI,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,CAAC,QAAQ,0BAA0B;gBAC1D,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;oBACtB,cAAc,EAAE,gBAAgB;iBACjC;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAEhD,6CAA6C;QAC7C,IAAI,QAAiB,CAAC;QACtB,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,6BAA6B,IAAI,qBAAqB,KAAK,OAAO,GAAG,MAAM;gBACnF,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,GAAG;iBAChB;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAE9D,IAAI,WAAmC,CAAC;IACxC,IAAI,UAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB;QAC1D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;IAEzE,kEAAkE;IAClE,IAAI,YAAwD,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,UAAU;QACV,eAAe;QACf,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/policy/permission-checks.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Permission checks
+ */
+import type { SapPermission, SapMcpConfig } from '../core/types.js';
+/**
+ * Check if permission is allowed
+ */
+export declare function checkPermission(config: SapMcpConfig, permission: SapPermission): {
+    allowed: boolean;
+    reason?: string;
+};
+/**
+ * Check if tool is allowed
+ */
+export declare function checkToolAllowed(config: SapMcpConfig, toolName: string): {
+    allowed: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=permission-checks.d.ts.map

package/dist/policy/permission-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-checks.d.ts","sourceRoot":"","sources":["../../src/policy/permission-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,aAAa,GACxB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAevC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,GACf;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CASvC"}

package/dist/policy/permission-checks.js

@@ -0,0 +1,60 @@
+/**
+ * Permission checks
+ */
+/**
+ * Check if permission is allowed
+ */
+export function checkPermission(config, permission) {
+    // Check if allowed tools is 'all'
+    if (config.allowedTools === 'all') {
+        return { allowed: true };
+    }
+    // Check if permission is in allowed list
+    if (config.allowedTools.includes(permission)) {
+        return { allowed: true };
+    }
+    return {
+        allowed: false,
+        reason: `Permission ${permission} is not in allowed tools list`,
+    };
+}
+/**
+ * Check if tool is allowed
+ */
+export function checkToolAllowed(config, toolName) {
+    if (config.allowedTools === 'all') {
+        return { allowed: true };
+    }
+    // Extract permission from tool name (e.g., sap_get_agent -> registry:read)
+    const permission = toolNameToPermission(toolName);
+    return checkPermission(config, permission);
+}
+/**
+ * Map tool name to permission
+ */
+function toolNameToPermission(toolName) {
+    // Extract action from tool name (e.g., sap_get_agent -> get, sap_register_agent -> register)
+    const actionMatch = toolName.match(/sap_(\w+)_/);
+    const action = actionMatch ? actionMatch[1] : '';
+    // Extract category from tool name (e.g., sap_registry_get -> registry)
+    const categoryMatch = toolName.match(/sap_(\w+)-/);
+    const category = categoryMatch ? categoryMatch[1] : '';
+    // Map category to permission namespace
+    const categoryMap = {
+        'registry': 'registry',
+        'identity': 'identity',
+        'reputation': 'reputation',
+        'payment': 'payments',
+        'settlement': 'settlement',
+        'memory': 'memory',
+        'transaction': 'transaction',
+        'tool': 'registry',
+        'developer': 'registry',
+        'execution': 'reputation',
+    };
+    const permissionCategory = categoryMap[category] || 'registry';
+    const isWrite = ['register', 'update', 'create', 'write', 'submit', 'bridge', 'mint', 'prepare', 'verify', 'open', 'resolve', 'batch'].some(w => action.includes(w));
+    const permissionType = isWrite ? 'write' : 'read';
+    return `${permissionCategory}:${permissionType}`;
+}
+//# sourceMappingURL=permission-checks.js.map

package/dist/policy/permission-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-checks.js","sourceRoot":"","sources":["../../src/policy/permission-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,UAAyB;IAEzB,kCAAkC;IAClC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,cAAc,UAAU,+BAA+B;KAChE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,QAAgB;IAEhB,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAElD,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,6FAA6F;IAC7F,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,uEAAuE;IACvE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,uCAAuC;IACvC,MAAM,WAAW,GAA2B;QAC1C,UAAU,EAAE,UAAU;QACtB,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,aAAa;QAC5B,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,YAAY;KAC1B,CAAC;IAEF,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrK,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAElD,OAAO,GAAG,kBAAkB,IAAI,cAAc,EAAmB,CAAC;AACpE,CAAC"}

package/dist/policy/policy-engine.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Policy engine for enforcing permissions and limits
+ */
+import type { SapMcpConfig, SapPolicy, SapPermission } from '../core/types.js';
+interface PermissionContext {
+    amountSol?: number;
+    toolName?: string;
+    args?: Record<string, unknown>;
+    programId?: string;
+    destination?: string;
+    user?: string;
+}
+/**
+ * Policy engine class
+ */
+export declare class PolicyEngine {
+    private config;
+    private policies;
+    private hybridPolicyEngine;
+    constructor(config: SapMcpConfig);
+    /**
+     * Validate permissions
+     */
+    validatePermissions(permissions: string[]): Promise<{
+        valid: boolean;
+        permissions: SapPermission[];
+        errors?: string[];
+    }>;
+    /**
+     * Check if action is allowed
+     */
+    checkPermission(permission: string, context?: PermissionContext): Promise<{
+        allowed: boolean;
+        reason?: string;
+    }>;
+    /**
+     * Returns current hybrid/Bento policy status for diagnostics.
+     */
+    getRuntimeStatus(): {
+        mode: string;
+        bentoConfigured: boolean;
+        bentoAvailable: boolean;
+        localEngineActive: boolean;
+    };
+    private createHybridPolicyEngine;
+    private checkHybridPolicy;
+    /**
+     * Get policy by ID
+     */
+    getPolicy(policyId: string): SapPolicy | undefined;
+    /**
+     * Add custom policy
+     */
+    addPolicy(policy: SapPolicy): void;
+}
+export {};
+//# sourceMappingURL=policy-engine.d.ts.map

package/dist/policy/policy-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAO/E,UAAU,iBAAiB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,kBAAkB,CAA4B;gBAE1C,MAAM,EAAE,YAAY;IAiBhC;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACxD,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,aAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAmBF;;OAEG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCjD;;OAEG;IACH,gBAAgB,IAAI;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC;KAC5B;IAaD,OAAO,CAAC,wBAAwB;YAqClB,iBAAiB;IAwB/B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIlD;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;CAInC"}

package/dist/policy/policy-engine.js

@@ -0,0 +1,162 @@
+/**
+ * Policy engine for enforcing permissions and limits
+ */
+import { logger } from '../core/logger.js';
+import { defaultPolicies } from './default-policies.js';
+import { HybridPolicyEngine } from './hybrid-policy-engine.js';
+const LAMPORTS_PER_SOL = 1_000_000_000;
+/**
+ * Policy engine class
+ */
+export class PolicyEngine {
+    config;
+    policies;
+    hybridPolicyEngine;
+    constructor(config) {
+        this.config = config;
+        this.policies = new Map();
+        this.hybridPolicyEngine = this.createHybridPolicyEngine(config);
+        // Load default policies
+        for (const policy of defaultPolicies) {
+            this.policies.set(policy.id, policy);
+        }
+        logger.info('Policy engine initialized', {
+            policyCount: this.policies.size,
+            mode: config.policy?.mode ?? 'local-only',
+            bentoEnabled: config.bento?.enabled ?? false,
+        });
+    }
+    /**
+     * Validate permissions
+     */
+    async validatePermissions(permissions) {
+        const errors = [];
+        const validPermissions = [];
+        for (const permission of permissions) {
+            if (this.config.allowedTools !== 'all' && !this.config.allowedTools.includes(permission)) {
+                errors.push(`Permission ${permission} not allowed by config`);
+            }
+            else {
+                validPermissions.push(permission);
+            }
+        }
+        if (errors.length > 0) {
+            return { valid: false, permissions: [], errors };
+        }
+        return { valid: true, permissions: validPermissions };
+    }
+    /**
+     * Check if action is allowed
+     */
+    async checkPermission(permission, context) {
+        // Check if permission is in allowed tools
+        if (this.config.allowedTools !== 'all') {
+            if (!this.config.allowedTools.includes(permission)) {
+                return { allowed: false, reason: `Permission ${permission} not allowed` };
+            }
+        }
+        // Check spending limits
+        if (context?.amountSol !== undefined) {
+            const maxTxValueSol = this.config.maxTxValueSol;
+            if (context.amountSol > maxTxValueSol) {
+                return {
+                    allowed: false,
+                    reason: `Amount ${context.amountSol} SOL exceeds max ${maxTxValueSol} SOL`,
+                };
+            }
+            if (context.amountSol > this.config.requireApprovalAboveSol) {
+                return {
+                    allowed: false,
+                    reason: `Amount ${context.amountSol} SOL requires approval (threshold: ${this.config.requireApprovalAboveSol} SOL)`,
+                };
+            }
+        }
+        const hybridDecision = await this.checkHybridPolicy(permission, context);
+        if (hybridDecision && !hybridDecision.allowed) {
+            return {
+                allowed: false,
+                reason: hybridDecision.reason,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Returns current hybrid/Bento policy status for diagnostics.
+     */
+    getRuntimeStatus() {
+        if (!this.hybridPolicyEngine) {
+            return {
+                mode: this.config.policy?.mode ?? 'local-only',
+                bentoConfigured: false,
+                bentoAvailable: false,
+                localEngineActive: true,
+            };
+        }
+        return this.hybridPolicyEngine.getStatus();
+    }
+    createHybridPolicyEngine(config) {
+        const policyMode = config.policy?.mode ?? 'local-only';
+        const bentoConfig = config.bento?.enabled && config.bento.apiKey
+            ? {
+                apiKey: config.bento.apiKey,
+                agentId: config.bento.agentId || 'sap-mcp-server',
+                endpoint: config.bento.endpoint,
+            }
+            : null;
+        if (policyMode === 'local-only' && !bentoConfig) {
+            return null;
+        }
+        const hybridConfig = {
+            mode: policyMode,
+            bento: bentoConfig,
+            failOpen: config.policy?.failOpen ?? false,
+            logging: config.policy?.logging ?? true,
+            local: {
+                spendLimits: {
+                    '*': Math.floor(config.maxTxValueSol * LAMPORTS_PER_SOL),
+                },
+                programWhitelist: [],
+                programBlacklist: [],
+                addressWhitelist: [],
+                addressBlacklist: [],
+                rateLimits: config.enableRateLimit
+                    ? { '*': config.rateLimitPerMinute }
+                    : {},
+                escalationTools: [],
+            },
+        };
+        return new HybridPolicyEngine(hybridConfig);
+    }
+    async checkHybridPolicy(permission, context) {
+        if (!this.hybridPolicyEngine) {
+            return null;
+        }
+        const toolName = context?.toolName ?? permission;
+        const policyContext = {
+            toolName,
+            args: context?.args ?? {},
+            user: context?.user ?? 'local-mcp-client',
+            amount: context?.amountSol === undefined
+                ? undefined
+                : Math.floor(context.amountSol * LAMPORTS_PER_SOL),
+            programId: context?.programId,
+            destination: context?.destination,
+            timestamp: Date.now(),
+        };
+        return this.hybridPolicyEngine.validateToolCall(policyContext);
+    }
+    /**
+     * Get policy by ID
+     */
+    getPolicy(policyId) {
+        return this.policies.get(policyId);
+    }
+    /**
+     * Add custom policy
+     */
+    addPolicy(policy) {
+        this.policies.set(policy.id, policy);
+        logger.info('Policy added', { policyId: policy.id });
+    }
+}
+//# sourceMappingURL=policy-engine.js.map

package/dist/policy/policy-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,2BAA2B,CAAC;AAGxF,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAWvC;;GAEG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAe;IACrB,QAAQ,CAAyB;IACjC,kBAAkB,CAA4B;IAEtD,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAEhE,wBAAwB;QACxB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY;YACzC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,WAAqB;QAK7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAoB,EAAE,CAAC;QAE7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,cAAc,UAAU,wBAAwB,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,UAA2B,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,OAA2B;QAE3B,0CAA0C;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,UAAU,cAAc,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAChD,IAAI,OAAO,CAAC,SAAS,GAAG,aAAa,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,OAAO,CAAC,SAAS,oBAAoB,aAAa,MAAM;iBAC3E,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;gBAC5D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,OAAO,CAAC,SAAS,sCAAsC,IAAI,CAAC,MAAM,CAAC,uBAAuB,OAAO;iBACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,gBAAgB;QAMd,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY;gBAC9C,eAAe,EAAE,KAAK;gBACtB,cAAc,EAAE,KAAK;gBACrB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IAEO,wBAAwB,CAAC,MAAoB;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;YAC9D,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB;gBACjD,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;aAChC;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,UAAU,KAAK,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAuB;YACvC,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,KAAK;YAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI;YACvC,KAAK,EAAE;gBACL,WAAW,EAAE;oBACX,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;iBACzD;gBACD,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,MAAM,CAAC,eAAe;oBAChC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,kBAAkB,EAAE;oBACpC,CAAC,CAAC,EAAE;gBACN,eAAe,EAAE,EAAE;aACpB;SACF,CAAC;QAEF,OAAO,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,UAAkB,EAClB,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QACjD,MAAM,aAAa,GAAkB;YACnC,QAAQ;YACR,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;YACzB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,kBAAkB;YACzC,MAAM,EAAE,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC;YACpD,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,OAAO,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAiB;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;CACF"}