@oobe-protocol-labs/sap-mcp-server 0.9.1 → 0.9.3

package/dist/premium/plugin-validator.js

@@ -0,0 +1,325 @@
+/**
+ * @name premium/plugin-validator
+ * @description Strict structural validator for premium plugin manifests.
+ *
+ * Validates unknown JSON objects against the `PremiumPluginManifest` shape,
+ * rejecting unknown fields (so private provider secrets or executable code
+ * cannot leak through manifests), enforcing semver versions, JSON Schema
+ * correctness, pricing bounds, and delivery contract constraints.
+ *
+ * Used by:
+ *   - `private-manifest-loader.ts` → validates every `.json` file loaded from disk.
+ *   - `premium-tools.ts` → MCP tool `sap_premium_validate_plugin_manifest`.
+ *
+ * @flow
+ *   1. External manifest JSON arrives (filesystem or MCP tool argument).
+ *   2. → `validatePremiumPluginManifest(manifest)` runs structural checks.
+ *   3. Returns `PremiumValidationReport` with errors[] and warnings[].
+ *   4. Caller decides: accept (valid=true) or reject with error details.
+ *
+ * @module premium/plugin-validator
+ */
+/* -------------------------------------------------------------------------- */
+/* Validation regex patterns                                                  */
+/* -------------------------------------------------------------------------- */
+/** @description Plugin id: lowercase, starts with letter, dots/dashes allowed. */
+const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9.-]{2,80}$/;
+/** @description Capability id: lowercase, starts with letter, dots/colons/dashes allowed. */
+const CAPABILITY_ID_PATTERN = /^[a-z][a-z0-9.:-]{2,96}$/;
+/** @description Semver version: X.Y.Z with optional prerelease tag. */
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/;
+/** @description Env var name: uppercase, starts with letter, underscores allowed. */
+const ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{2,120}$/;
+/* -------------------------------------------------------------------------- */
+/* Allowed key sets (reject unknown fields)                                   */
+/* -------------------------------------------------------------------------- */
+/** @description Top-level keys allowed on a `PremiumPluginManifest` object. */
+const PLUGIN_KEYS = new Set(['id', 'version', 'title', 'description', 'publisher', 'visibility', 'capabilities']);
+/** @description Keys allowed on a `PremiumCapabilityDefinition` object. */
+const CAPABILITY_KEYS = new Set([
+    'id',
+    'type',
+    'title',
+    'description',
+    'status',
+    'requiresProvider',
+    'providerEnv',
+    'inputSchema',
+    'outputSchema',
+    'pricing',
+    'delivery',
+]);
+/** @description Keys allowed on a `PremiumPricingPolicy` object. */
+const PRICING_KEYS = new Set(['tier', 'model', 'unit', 'unitPriceUsd', 'minUnits', 'maxUnits', 'settlement']);
+/** @description Keys allowed on a `PremiumDeliveryContract` object. */
+const DELIVERY_KEYS = new Set(['transport', 'events', 'latencyTargetMs', 'replayWindowSeconds']);
+/* -------------------------------------------------------------------------- */
+/* Allowed enum values                                                        */
+/* -------------------------------------------------------------------------- */
+const PRICING_TIERS = new Set(['premium-stream', 'premium-webhook', 'premium-tool']);
+const PRICING_MODELS = new Set(['x402-per-open', 'x402-per-minute', 'x402-per-event', 'x402-session']);
+const PRICING_UNITS = new Set(['open', 'minute', 'event', 'session']);
+const DELIVERY_TRANSPORTS = new Set(['mcp-streamable-http', 'webhook-http']);
+/* -------------------------------------------------------------------------- */
+/* Internal helpers                                                           */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name issue
+ * @description Construct a `PremiumValidationIssue` with the given path, severity, and message.
+ *
+ * @param path      - JSON path to the offending field (e.g. `capabilities[0].pricing.tier`).
+ * @param severity  - `error` or `warning`.
+ * @param message   - Human-readable explanation.
+ * @returns A `PremiumValidationIssue` object.
+ *
+ * @internal
+ */
+function issue(path, severity, message) {
+    return { path, severity, message };
+}
+/**
+ * @name isRecord
+ * @description Type guard: is the value a plain object (not array, not null)?
+ *
+ * @param value - Unknown input to test.
+ * @returns True if `value` is a non-null, non-array object.
+ *
+ * @internal
+ */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * @name pushUnknownKeyIssues
+ * @description Detect and report any keys not in the allowed set.
+ *
+ * Unknown fields are rejected as errors so private provider secrets or
+ * executable code cannot leak through manifests.
+ *
+ * @param issues      - Accumulating issue array (mutated in place).
+ * @param value       - The object to check.
+ * @param allowedKeys - Set of permitted key names.
+ * @param path        - JSON path prefix for error reporting.
+ *
+ * @internal
+ */
+function pushUnknownKeyIssues(issues, value, allowedKeys, path) {
+    for (const key of Object.keys(value)) {
+        if (!allowedKeys.has(key)) {
+            issues.push(issue(path === '$' ? key : `${path}.${key}`, 'error', 'Unknown fields are rejected so private provider secrets or executable code cannot leak through manifests.'));
+        }
+    }
+}
+/**
+ * @name pushSchemaIssues
+ * @description Validate that a JSON Schema field meets strict requirements:
+ * must be an object, root type must be `object`, must have a `properties`
+ * object (warning), and must set `additionalProperties: false` (error).
+ *
+ * @param issues - Accumulating issue array (mutated in place).
+ * @param schema - The schema value to check.
+ * @param path   - JSON path to the schema field.
+ *
+ * @internal
+ */
+function pushSchemaIssues(issues, schema, path) {
+    if (!isRecord(schema)) {
+        issues.push(issue(path, 'error', 'Schema must be a JSON object.'));
+        return;
+    }
+    if (schema.type !== 'object') {
+        issues.push(issue(path, 'error', 'Schema root must declare type: object so MCP clients can validate arguments.'));
+    }
+    if (!isRecord(schema.properties)) {
+        issues.push(issue(path, 'warning', 'Schema should include a properties object with described fields.'));
+    }
+    if (schema.additionalProperties !== false) {
+        issues.push(issue(path, 'error', 'Schema root must set additionalProperties: false for strict agent/runtime validation.'));
+    }
+}
+/* -------------------------------------------------------------------------- */
+/* Capability validation                                                      */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name validateCapability
+ * @description Validate a single capability object within a manifest.
+ *
+ * Checks: id format, type, title, description length, status, requiresProvider
+ * boolean, providerEnv array format + consistency, input/output schemas,
+ * pricing policy (tier, model, unit, price bounds, settlement), and delivery
+ * contract (transport, events, latency, replay window).
+ *
+ * @param capability - Unknown capability value to validate.
+ * @param index      - Array index for error path reporting.
+ * @returns Array of `PremiumValidationIssue` entries (may be empty if valid).
+ *
+ * @internal
+ */
+function validateCapability(capability, index) {
+    const issues = [];
+    const base = `capabilities[${index}]`;
+    if (!isRecord(capability)) {
+        return [issue(base, 'error', 'Capability must be an object.')];
+    }
+    const candidate = capability;
+    // Reject unknown keys to prevent secret/code leakage.
+    pushUnknownKeyIssues(issues, capability, CAPABILITY_KEYS, base);
+    // Identity and type checks.
+    if (typeof candidate.id !== 'string' || !CAPABILITY_ID_PATTERN.test(candidate.id)) {
+        issues.push(issue(`${base}.id`, 'error', 'Capability id must be lowercase and may contain letters, numbers, dot, colon, or dash.'));
+    }
+    if (!['stream', 'webhook', 'tool'].includes(String(candidate.type))) {
+        issues.push(issue(`${base}.type`, 'error', 'Capability type must be stream, webhook, or tool.'));
+    }
+    if (typeof candidate.title !== 'string' || candidate.title.length < 4) {
+        issues.push(issue(`${base}.title`, 'error', 'Capability title must be a human-readable label.'));
+    }
+    if (typeof candidate.description !== 'string' || candidate.description.length < 40) {
+        issues.push(issue(`${base}.description`, 'error', 'Capability description must explain the agent use case and payment boundary.'));
+    }
+    if (!['available', 'requires-provider', 'planned'].includes(String(candidate.status))) {
+        issues.push(issue(`${base}.status`, 'error', 'Capability status must be available, requires-provider, or planned.'));
+    }
+    if (typeof candidate.requiresProvider !== 'boolean') {
+        issues.push(issue(`${base}.requiresProvider`, 'error', 'requiresProvider must explicitly be true or false so runtimes know whether activation is possible.'));
+    }
+    // Provider env var validation: names must be uppercase env var patterns,
+    // never secret values or URLs. If any env vars are declared, requiresProvider
+    // must be true.
+    if (!Array.isArray(candidate.providerEnv)) {
+        issues.push(issue(`${base}.providerEnv`, 'error', 'providerEnv must be an array, empty when no external provider configuration is needed.'));
+    }
+    else {
+        candidate.providerEnv.forEach((envName, envIndex) => {
+            if (typeof envName !== 'string' || !ENV_NAME_PATTERN.test(envName)) {
+                issues.push(issue(`${base}.providerEnv[${envIndex}]`, 'error', 'providerEnv entries must be uppercase environment variable names, never secret values or URLs.'));
+            }
+        });
+        if (candidate.providerEnv.length > 0 && candidate.requiresProvider !== true) {
+            issues.push(issue(`${base}.requiresProvider`, 'error', 'Capabilities with providerEnv entries must set requiresProvider:true.'));
+        }
+    }
+    // Input/output JSON Schema validation.
+    pushSchemaIssues(issues, candidate.inputSchema, `${base}.inputSchema`);
+    pushSchemaIssues(issues, candidate.outputSchema, `${base}.outputSchema`);
+    // Pricing policy validation.
+    if (!isRecord(candidate.pricing)) {
+        issues.push(issue(`${base}.pricing`, 'error', 'Pricing policy is required for x402/pay.sh metering.'));
+    }
+    else {
+        pushUnknownKeyIssues(issues, candidate.pricing, PRICING_KEYS, `${base}.pricing`);
+        if (!PRICING_TIERS.has(String(candidate.pricing.tier))) {
+            issues.push(issue(`${base}.pricing.tier`, 'error', 'Pricing tier must be premium-stream, premium-webhook, or premium-tool.'));
+        }
+        if (!PRICING_MODELS.has(String(candidate.pricing.model))) {
+            issues.push(issue(`${base}.pricing.model`, 'error', 'Pricing model must be x402-per-open, x402-per-minute, x402-per-event, or x402-session.'));
+        }
+        if (!PRICING_UNITS.has(String(candidate.pricing.unit))) {
+            issues.push(issue(`${base}.pricing.unit`, 'error', 'Pricing unit must be open, minute, event, or session.'));
+        }
+        const unitPriceUsd = Number(candidate.pricing.unitPriceUsd);
+        const minUnits = Number(candidate.pricing.minUnits);
+        const maxUnits = Number(candidate.pricing.maxUnits);
+        if (!Number.isFinite(unitPriceUsd) || unitPriceUsd <= 0) {
+            issues.push(issue(`${base}.pricing.unitPriceUsd`, 'error', 'unitPriceUsd must be a positive number.'));
+        }
+        if (!Number.isInteger(minUnits) || minUnits < 1 || !Number.isInteger(maxUnits) || maxUnits < minUnits) {
+            issues.push(issue(`${base}.pricing.units`, 'error', 'minUnits and maxUnits must be positive integers with maxUnits >= minUnits.'));
+        }
+        if (!['x402', 'pay.sh'].includes(String(candidate.pricing.settlement))) {
+            issues.push(issue(`${base}.pricing.settlement`, 'error', 'settlement must be x402 or pay.sh.'));
+        }
+    }
+    // Delivery contract validation.
+    if (!isRecord(candidate.delivery)) {
+        issues.push(issue(`${base}.delivery`, 'error', 'Delivery contract is required for stream/webhook capabilities.'));
+    }
+    else {
+        pushUnknownKeyIssues(issues, candidate.delivery, DELIVERY_KEYS, `${base}.delivery`);
+        if (!DELIVERY_TRANSPORTS.has(String(candidate.delivery.transport))) {
+            issues.push(issue(`${base}.delivery.transport`, 'error', 'Delivery transport must be mcp-streamable-http or webhook-http.'));
+        }
+        if (!Array.isArray(candidate.delivery.events) || candidate.delivery.events.length === 0) {
+            issues.push(issue(`${base}.delivery.events`, 'error', 'Delivery events must list at least one exact event id.'));
+        }
+        else {
+            candidate.delivery.events.forEach((eventName, eventIndex) => {
+                if (typeof eventName !== 'string' || eventName.trim().length < 3) {
+                    issues.push(issue(`${base}.delivery.events[${eventIndex}]`, 'error', 'Delivery event ids must be non-empty strings.'));
+                }
+            });
+        }
+        const latencyTargetMs = Number(candidate.delivery.latencyTargetMs);
+        const replayWindowSeconds = Number(candidate.delivery.replayWindowSeconds);
+        if (!Number.isInteger(latencyTargetMs) || latencyTargetMs < 100 || latencyTargetMs > 60_000) {
+            issues.push(issue(`${base}.delivery.latencyTargetMs`, 'error', 'latencyTargetMs must be an integer between 100 and 60000.'));
+        }
+        if (!Number.isInteger(replayWindowSeconds) || replayWindowSeconds < 30 || replayWindowSeconds > 86_400) {
+            issues.push(issue(`${base}.delivery.replayWindowSeconds`, 'error', 'replayWindowSeconds must be an integer between 30 and 86400.'));
+        }
+    }
+    return issues;
+}
+/* -------------------------------------------------------------------------- */
+/* Public API                                                                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name validatePremiumPluginManifest
+ * @description Validate an unknown value as a `PremiumPluginManifest`.
+ *
+ * Top-level checks: object shape, id format, semver version, title, description
+ * length, publisher, visibility enum, and at least one capability. Each
+ * capability is then validated by `validateCapability`.
+ *
+ * @param manifest - Unknown JSON value (from filesystem or MCP tool argument).
+ * @returns `PremiumValidationReport` with `valid`, `errors[]`, and `warnings[]`.
+ *
+ * @usedBy
+ *   - `private-manifest-loader.ts` → validates each `.json` file from disk.
+ *   - `premium-tools.ts` → MCP tool `sap_premium_validate_plugin_manifest`.
+ */
+export function validatePremiumPluginManifest(manifest) {
+    const issues = [];
+    if (!isRecord(manifest)) {
+        return {
+            valid: false,
+            errors: [issue('$', 'error', 'Premium plugin manifest must be an object.')],
+            warnings: [],
+        };
+    }
+    const candidate = manifest;
+    // Reject unknown top-level keys.
+    pushUnknownKeyIssues(issues, manifest, PLUGIN_KEYS, '$');
+    // Identity and metadata checks.
+    if (typeof candidate.id !== 'string' || !PLUGIN_ID_PATTERN.test(candidate.id)) {
+        issues.push(issue('id', 'error', 'Plugin id must be lowercase and may contain letters, numbers, dot, or dash.'));
+    }
+    if (typeof candidate.version !== 'string' || !SEMVER_PATTERN.test(candidate.version)) {
+        issues.push(issue('version', 'error', 'Version must be semver, for example 1.0.0 or 1.0.0-rc.1.'));
+    }
+    if (typeof candidate.title !== 'string' || candidate.title.length < 4) {
+        issues.push(issue('title', 'error', 'Title must be a human-readable plugin name.'));
+    }
+    if (typeof candidate.description !== 'string' || candidate.description.length < 60) {
+        issues.push(issue('description', 'error', 'Description must explain what the plugin sells and which agents should use it.'));
+    }
+    if (typeof candidate.publisher !== 'string' || candidate.publisher.length < 2) {
+        issues.push(issue('publisher', 'error', 'Publisher is required for registry and enterprise review.'));
+    }
+    if (!['public', 'private', 'enterprise'].includes(String(candidate.visibility))) {
+        issues.push(issue('visibility', 'error', 'Visibility must be public, private, or enterprise.'));
+    }
+    // Capabilities array: must be non-empty, each entry validated individually.
+    if (!Array.isArray(candidate.capabilities) || candidate.capabilities.length === 0) {
+        issues.push(issue('capabilities', 'error', 'At least one premium capability is required.'));
+    }
+    else {
+        candidate.capabilities.forEach((capability, index) => issues.push(...validateCapability(capability, index)));
+    }
+    return {
+        valid: issues.every(candidateIssue => candidateIssue.severity !== 'error'),
+        errors: issues.filter(candidateIssue => candidateIssue.severity === 'error'),
+        warnings: issues.filter(candidateIssue => candidateIssue.severity === 'warning'),
+    };
+}
+//# sourceMappingURL=plugin-validator.js.map

package/dist/premium/plugin-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-validator.js","sourceRoot":"","sources":["../../src/premium/plugin-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,6FAA6F;AAC7F,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AACzD,uEAAuE;AACvE,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;AAClH,2EAA2E;AAC3E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI;IACJ,MAAM;IACN,OAAO;IACP,aAAa;IACb,QAAQ;IACR,kBAAkB;IAClB,aAAa;IACb,aAAa;IACb,cAAc;IACd,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AACH,oEAAoE;AACpE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9G,uEAAuE;AACvE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEjG,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AACrF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;AACvG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACtE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC,CAAC;AAE7E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,KAAK,CAAC,IAAY,EAAE,QAA6B,EAAE,OAAe;IACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAC3B,MAAgC,EAChC,KAA8B,EAC9B,WAAwB,EACxB,IAAY;IAEZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,2GAA2G,CAAC,CAAC,CAAC;QAClL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,MAAgC,EAAE,MAAe,EAAE,IAAY;IACvF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,8EAA8E,CAAC,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,kEAAkE,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,uFAAuF,CAAC,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB,CAAC,UAAmB,EAAE,KAAa;IAC5D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,gBAAgB,KAAK,GAAG,CAAC;IAEtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,SAAS,GAAG,UAAkD,CAAC;IAErE,sDAAsD;IACtD,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAEhE,4BAA4B;IAC5B,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE,OAAO,EAAE,wFAAwF,CAAC,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,EAAE,OAAO,EAAE,mDAAmD,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,OAAO,EAAE,kDAAkD,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,cAAc,EAAE,OAAO,EAAE,8EAA8E,CAAC,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,qEAAqE,CAAC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,mBAAmB,EAAE,OAAO,EAAE,oGAAoG,CAAC,CAAC,CAAC;IAChK,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB;IAChB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,cAAc,EAAE,OAAO,EAAE,wFAAwF,CAAC,CAAC,CAAC;IAC/I,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAClD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,gBAAgB,QAAQ,GAAG,EAAE,OAAO,EAAE,gGAAgG,CAAC,CAAC,CAAC;YACpK,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,mBAAmB,EAAE,OAAO,EAAE,uEAAuE,CAAC,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IACvE,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IAEzE,6BAA6B;IAC7B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,EAAE,sDAAsD,CAAC,CAAC,CAAC;IACzG,CAAC;SAAM,CAAC;QACN,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,eAAe,EAAE,OAAO,EAAE,wEAAwE,CAAC,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,gBAAgB,EAAE,OAAO,EAAE,wFAAwF,CAAC,CAAC,CAAC;QACjJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,eAAe,EAAE,OAAO,EAAE,uDAAuD,CAAC,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,uBAAuB,EAAE,OAAO,EAAE,yCAAyC,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACtG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,gBAAgB,EAAE,OAAO,EAAE,4EAA4E,CAAC,CAAC,CAAC;QACrI,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,qBAAqB,EAAE,OAAO,EAAE,oCAAoC,CAAC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,WAAW,EAAE,OAAO,EAAE,gEAAgE,CAAC,CAAC,CAAC;IACpH,CAAC;SAAM,CAAC;QACN,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;QACpF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,qBAAqB,EAAE,OAAO,EAAE,iEAAiE,CAAC,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE,OAAO,EAAE,wDAAwD,CAAC,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE;gBAC1D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,oBAAoB,UAAU,GAAG,EAAE,OAAO,EAAE,+CAA+C,CAAC,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,GAAG,IAAI,eAAe,GAAG,MAAM,EAAE,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,2BAA2B,EAAE,OAAO,EAAE,2DAA2D,CAAC,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,GAAG,EAAE,IAAI,mBAAmB,GAAG,MAAM,EAAE,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,+BAA+B,EAAE,OAAO,EAAE,8DAA8D,CAAC,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAiB;IAC7D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAE5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,4CAA4C,CAAC,CAAC;YAC3E,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAA0C,CAAC;IAE7D,iCAAiC;IACjC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAEzD,gCAAgC;IAChC,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,6EAA6E,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,0DAA0D,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,6CAA6C,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,gFAAgF,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,2DAA2D,CAAC,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,oDAAoD,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,8CAA8C,CAAC,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC5E,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,KAAK,SAAS,CAAC;KACjF,CAAC;AACJ,CAAC"}

package/dist/premium/private-manifest-loader.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @name premium/private-manifest-loader
+ * @description Filesystem loader for private/enterprise premium plugin manifests.
+ *
+ * When `SAP_MCP_ENABLE_PREMIUM_PLUGINS=true` and `SAP_MCP_PLUGIN_DIR` is set,
+ * this module scans the configured directory (and its `manifests/` subdirectory)
+ * for `.json` files, validates each against `validatePremiumPluginManifest`,
+ * and returns sanitized `PremiumPluginManifest` objects.
+ *
+ * Security guarantees:
+ *   - Manifests are data only — no code is ever executed from plugin files.
+ *   - Provider secrets are never read from or stored in manifests.
+ *   - Symlink escaping is prevented via `realpathSync` + prefix checks.
+ *   - File count (100) and per-file size (256 KB) are capped.
+ *   - Every loaded manifest is sanitized to strip any extraneous fields before
+ *     being returned to callers.
+ *
+ * @flow
+ *   1. `builtin-plugins.ts:listPremiumPlugins()` calls
+ *      `loadPrivatePremiumPluginManifests()` to merge private manifests into
+ *      the discovery catalog.
+ *   2. `builtin-plugins.ts:premiumPrivatePluginSupport()` calls
+ *      `loadPrivatePremiumPluginReport()` for diagnostic output.
+ *   3. Internally: `loadPrivatePremiumPluginReport()` scans the plugin dir,
+ *      reads + validates each `.json` file, and returns accepted/rejected lists.
+ *   4. `loadPrivatePremiumPluginManifests()` returns only the accepted manifests,
+ *      deep-cloned to prevent external mutation.
+ *
+ * @env SAP_MCP_ENABLE_PREMIUM_PLUGINS — Must be `true` or `1` to enable loading.
+ * @env SAP_MCP_PLUGIN_DIR              — Filesystem path to the plugin directory.
+ * @env SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY — If `true`/`1`, private/enterprise
+ *      plugins appear in public discovery responses.
+ *
+ * @module premium/private-manifest-loader
+ */
+import type { PremiumPluginManifest, PremiumValidationIssue } from './types.js';
+/**
+ * @name PrivatePremiumPluginLoadReport
+ * @description Diagnostic report returned by `loadPrivatePremiumPluginReport`.
+ *
+ * @property enabled               - Whether private plugin loading is enabled.
+ * @property exposePrivateDiscovery - Whether private plugins appear in discovery.
+ * @property pluginDirConfigured    - Whether `SAP_MCP_PLUGIN_DIR` is set.
+ * @property loadedManifests        - Successfully validated and sanitized manifests.
+ * @property rejectedManifests      - Files that failed validation or loading,
+ *   with reason and optional validation errors.
+ *
+ * @usedBy `builtin-plugins.ts:premiumPrivatePluginSupport` (diagnostic output).
+ */
+export interface PrivatePremiumPluginLoadReport {
+    enabled: boolean;
+    exposePrivateDiscovery: boolean;
+    pluginDirConfigured: boolean;
+    loadedManifests: PremiumPluginManifest[];
+    rejectedManifests: Array<{
+        file: string;
+        reason: string;
+        errors?: PremiumValidationIssue[];
+    }>;
+}
+/**
+ * @name privatePremiumPluginsEnabled
+ * @description Check whether private plugin loading is enabled via env var.
+ *
+ * @returns `true` if `SAP_MCP_ENABLE_PREMIUM_PLUGINS` is `true` or `1`.
+ *
+ * @usedBy `loadPrivatePremiumPluginReport` (gate check).
+ */
+export declare function privatePremiumPluginsEnabled(): boolean;
+/**
+ * @name premiumDiscoveryIncludesPrivate
+ * @description Check whether private/enterprise plugins should appear in
+ * public discovery responses.
+ *
+ * @returns `true` if `SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY` is `true` or `1`.
+ *
+ * @usedBy `builtin-plugins.ts:listPremiumPlugins` (visibility filter default).
+ */
+export declare function premiumDiscoveryIncludesPrivate(): boolean;
+/**
+ * @name loadPrivatePremiumPluginReport
+ * @description Scan, validate, and load private premium plugin manifests from
+ * the configured plugin directory.
+ *
+ * Steps:
+ *   1. Check if loading is enabled (`SAP_MCP_ENABLE_PREMIUM_PLUGINS`).
+ *   2. Check if `SAP_MCP_PLUGIN_DIR` is configured and exists.
+ *   3. Discover `.json` files in the root and `manifests/` subdirectory.
+ *   4. For each file: check size, parse JSON, validate with
+ *      `validatePremiumPluginManifest`, sanitize if valid.
+ *   5. Accepted manifests go into `loadedManifests`; rejected ones into
+ *      `rejectedManifests` with a reason string.
+ *
+ * @returns A `PrivatePremiumPluginLoadReport` with loaded and rejected manifests.
+ *
+ * @usedBy
+ *   - `builtin-plugins.ts:loadPrivatePremiumPluginManifests` (accepted only).
+ *   - `builtin-plugins.ts:premiumPrivatePluginSupport` (diagnostic counts).
+ */
+export declare function loadPrivatePremiumPluginReport(): PrivatePremiumPluginLoadReport;
+/**
+ * @name loadPrivatePremiumPluginManifests
+ * @description Return only the successfully loaded private plugin manifests,
+ * deep-cloned to prevent external mutation.
+ *
+ * @returns Array of `PremiumPluginManifest` clones (empty if disabled or no dir).
+ *
+ * @usedBy `builtin-plugins.ts:listPremiumPlugins` (merged with built-in plugins).
+ */
+export declare function loadPrivatePremiumPluginManifests(): PremiumPluginManifest[];
+//# sourceMappingURL=private-manifest-loader.d.ts.map

package/dist/premium/private-manifest-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-manifest-loader.d.ts","sourceRoot":"","sources":["../../src/premium/private-manifest-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAehF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB,EAAE,OAAO,CAAC;IAChC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,iBAAiB,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,sBAAsB,EAAE,CAAC;KACnC,CAAC,CAAC;CACJ;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAwGD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,8BAA8B,IAAI,8BAA8B,CA0D/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,EAAE,CAE3E"}