@oobe-protocol-labs/sap-mcp-server 0.9.16 → 0.9.20

package/dist/premium/private-manifest-loader.js

@@ -0,0 +1,285 @@
+/**
+ * @name premium/private-manifest-loader
+ * @description Filesystem loader for private/enterprise premium plugin manifests.
+ *
+ * When `SAP_MCP_ENABLE_PREMIUM_PLUGINS=true` and `SAP_MCP_PLUGIN_DIR` is set,
+ * this module scans the configured directory (and its `manifests/` subdirectory)
+ * for `.json` files, validates each against `validatePremiumPluginManifest`,
+ * and returns sanitized `PremiumPluginManifest` objects.
+ *
+ * Security guarantees:
+ *   - Manifests are data only — no code is ever executed from plugin files.
+ *   - Provider secrets are never read from or stored in manifests.
+ *   - Symlink escaping is prevented via `realpathSync` + prefix checks.
+ *   - File count (100) and per-file size (256 KB) are capped.
+ *   - Every loaded manifest is sanitized to strip any extraneous fields before
+ *     being returned to callers.
+ *
+ * @flow
+ *   1. `builtin-plugins.ts:listPremiumPlugins()` calls
+ *      `loadPrivatePremiumPluginManifests()` to merge private manifests into
+ *      the discovery catalog.
+ *   2. `builtin-plugins.ts:premiumPrivatePluginSupport()` calls
+ *      `loadPrivatePremiumPluginReport()` for diagnostic output.
+ *   3. Internally: `loadPrivatePremiumPluginReport()` scans the plugin dir,
+ *      reads + validates each `.json` file, and returns accepted/rejected lists.
+ *   4. `loadPrivatePremiumPluginManifests()` returns only the accepted manifests,
+ *      deep-cloned to prevent external mutation.
+ *
+ * @env SAP_MCP_ENABLE_PREMIUM_PLUGINS — Must be `true` or `1` to enable loading.
+ * @env SAP_MCP_PLUGIN_DIR              — Filesystem path to the plugin directory.
+ * @env SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY — If `true`/`1`, private/enterprise
+ *      plugins appear in public discovery responses.
+ *
+ * @module premium/private-manifest-loader
+ */
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { basename, extname, join, resolve } from 'node:path';
+import { validatePremiumPluginManifest } from './plugin-validator.js';
+/* -------------------------------------------------------------------------- */
+/* Limits                                                                     */
+/* -------------------------------------------------------------------------- */
+/** @description Maximum number of manifest files scanned per plugin directory. */
+const MAX_PRIVATE_MANIFEST_FILES = 100;
+/** @description Maximum size per manifest file (256 KB). Rejects oversized files. */
+const MAX_PRIVATE_MANIFEST_BYTES = 256 * 1024;
+/* -------------------------------------------------------------------------- */
+/* Internal helpers                                                           */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name cloneManifest
+ * @description Deep-clone a manifest via JSON serialization.
+ *
+ * Ensures callers cannot mutate the internal loaded manifest objects.
+ *
+ * @param manifest - The manifest to clone.
+ * @returns A deep copy of the manifest.
+ *
+ * @internal
+ */
+function cloneManifest(manifest) {
+    return JSON.parse(JSON.stringify(manifest));
+}
+/**
+ * @name boolEnv
+ * @description Read a boolean env var (accepts `true` or `1`).
+ *
+ * @param name - The environment variable name.
+ * @returns `true` if the env var is set to `true` or `1`, otherwise `false`.
+ *
+ * @internal
+ */
+function boolEnv(name) {
+    return process.env[name] === 'true' || process.env[name] === '1';
+}
+/* -------------------------------------------------------------------------- */
+/* Public env-var helpers                                                     */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name privatePremiumPluginsEnabled
+ * @description Check whether private plugin loading is enabled via env var.
+ *
+ * @returns `true` if `SAP_MCP_ENABLE_PREMIUM_PLUGINS` is `true` or `1`.
+ *
+ * @usedBy `loadPrivatePremiumPluginReport` (gate check).
+ */
+export function privatePremiumPluginsEnabled() {
+    return boolEnv('SAP_MCP_ENABLE_PREMIUM_PLUGINS');
+}
+/**
+ * @name premiumDiscoveryIncludesPrivate
+ * @description Check whether private/enterprise plugins should appear in
+ * public discovery responses.
+ *
+ * @returns `true` if `SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY` is `true` or `1`.
+ *
+ * @usedBy `builtin-plugins.ts:listPremiumPlugins` (visibility filter default).
+ */
+export function premiumDiscoveryIncludesPrivate() {
+    return boolEnv('SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY');
+}
+/* -------------------------------------------------------------------------- */
+/* Internal directory & file helpers                                          */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name configuredPluginDir
+ * @description Resolve the configured plugin directory from `SAP_MCP_PLUGIN_DIR`.
+ *
+ * @returns The absolute resolved path, or `null` if the env var is unset/empty.
+ *
+ * @internal
+ */
+function configuredPluginDir() {
+    const raw = process.env.SAP_MCP_PLUGIN_DIR;
+    if (!raw || !raw.trim())
+        return null;
+    return resolve(raw.trim());
+}
+/**
+ * @name sanitizeManifest
+ * @description Strip a loaded manifest to only the known fields, discarding
+ * any extraneous properties that may have been present in the JSON file.
+ *
+ * This is a defense-in-depth measure: even though `validatePremiumPluginManifest`
+ * already rejects unknown fields, sanitization ensures the in-memory object
+ * only contains the exact fields defined by `PremiumPluginManifest`.
+ *
+ * @param manifest - The raw parsed manifest.
+ * @returns A sanitized `PremiumPluginManifest` with only known fields.
+ *
+ * @internal
+ */
+function sanitizeManifest(manifest) {
+    return {
+        id: manifest.id,
+        version: manifest.version,
+        title: manifest.title,
+        description: manifest.description,
+        publisher: manifest.publisher,
+        visibility: manifest.visibility,
+        capabilities: manifest.capabilities.map(capability => ({
+            id: capability.id,
+            type: capability.type,
+            title: capability.title,
+            description: capability.description,
+            status: capability.status,
+            requiresProvider: capability.requiresProvider,
+            providerEnv: [...capability.providerEnv],
+            inputSchema: JSON.parse(JSON.stringify(capability.inputSchema)),
+            outputSchema: JSON.parse(JSON.stringify(capability.outputSchema)),
+            pricing: { ...capability.pricing },
+            delivery: {
+                transport: capability.delivery.transport,
+                events: [...capability.delivery.events],
+                latencyTargetMs: capability.delivery.latencyTargetMs,
+                replayWindowSeconds: capability.delivery.replayWindowSeconds,
+            },
+        })),
+    };
+}
+/**
+ * @name discoverManifestFiles
+ * @description Scan the plugin directory root and its `manifests/` subdirectory
+ * for `.json` files, preventing symlink escaping via `realpathSync`.
+ *
+ * Only files whose real path starts with the root directory's real path are
+ * included. The result is deduplicated and sorted. Scanning stops after
+ * `MAX_PRIVATE_MANIFEST_FILES` files are found.
+ *
+ * @param root - The absolute real path of the plugin directory.
+ * @returns Array of absolute real file paths to `.json` manifest files.
+ *
+ * @internal
+ */
+function discoverManifestFiles(root) {
+    const roots = [root, join(root, 'manifests')];
+    const files = [];
+    for (const candidateRoot of roots) {
+        if (!existsSync(candidateRoot))
+            continue;
+        const rootRealPath = realpathSync(candidateRoot);
+        for (const entry of readdirSync(candidateRoot, { withFileTypes: true })) {
+            if (!entry.isFile() || extname(entry.name) !== '.json')
+                continue;
+            const filePath = join(candidateRoot, entry.name);
+            const fileRealPath = realpathSync(filePath);
+            // Symlink escape prevention: file must be under the root directory.
+            if (!fileRealPath.startsWith(`${rootRealPath}/`))
+                continue;
+            files.push(fileRealPath);
+            if (files.length >= MAX_PRIVATE_MANIFEST_FILES)
+                return files;
+        }
+    }
+    return [...new Set(files)].sort();
+}
+/* -------------------------------------------------------------------------- */
+/* Public API                                                                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * @name loadPrivatePremiumPluginReport
+ * @description Scan, validate, and load private premium plugin manifests from
+ * the configured plugin directory.
+ *
+ * Steps:
+ *   1. Check if loading is enabled (`SAP_MCP_ENABLE_PREMIUM_PLUGINS`).
+ *   2. Check if `SAP_MCP_PLUGIN_DIR` is configured and exists.
+ *   3. Discover `.json` files in the root and `manifests/` subdirectory.
+ *   4. For each file: check size, parse JSON, validate with
+ *      `validatePremiumPluginManifest`, sanitize if valid.
+ *   5. Accepted manifests go into `loadedManifests`; rejected ones into
+ *      `rejectedManifests` with a reason string.
+ *
+ * @returns A `PrivatePremiumPluginLoadReport` with loaded and rejected manifests.
+ *
+ * @usedBy
+ *   - `builtin-plugins.ts:loadPrivatePremiumPluginManifests` (accepted only).
+ *   - `builtin-plugins.ts:premiumPrivatePluginSupport` (diagnostic counts).
+ */
+export function loadPrivatePremiumPluginReport() {
+    const enabled = privatePremiumPluginsEnabled();
+    const exposePrivateDiscovery = premiumDiscoveryIncludesPrivate();
+    const pluginDir = configuredPluginDir();
+    const report = {
+        enabled,
+        exposePrivateDiscovery,
+        pluginDirConfigured: Boolean(pluginDir),
+        loadedManifests: [],
+        rejectedManifests: [],
+    };
+    // Early exit if loading is disabled or no plugin directory is configured.
+    if (!enabled || !pluginDir)
+        return report;
+    // Plugin directory configured but missing on disk.
+    if (!existsSync(pluginDir)) {
+        report.rejectedManifests.push({ file: basename(pluginDir), reason: 'plugin_dir_not_found' });
+        return report;
+    }
+    const pluginDirRealPath = realpathSync(pluginDir);
+    // Process each discovered manifest file.
+    for (const filePath of discoverManifestFiles(pluginDirRealPath)) {
+        try {
+            const stats = statSync(filePath);
+            if (!stats.isFile())
+                continue;
+            // Reject oversized files to prevent abuse.
+            if (stats.size > MAX_PRIVATE_MANIFEST_BYTES) {
+                report.rejectedManifests.push({ file: basename(filePath), reason: 'manifest_too_large' });
+                continue;
+            }
+            // Parse and validate the manifest JSON.
+            const parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+            const validation = validatePremiumPluginManifest(parsed);
+            if (!validation.valid) {
+                report.rejectedManifests.push({
+                    file: basename(filePath),
+                    reason: 'validation_failed',
+                    errors: validation.errors,
+                });
+                continue;
+            }
+            // Sanitize and accept the manifest.
+            report.loadedManifests.push(sanitizeManifest(parsed));
+        }
+        catch (error) {
+            report.rejectedManifests.push({
+                file: basename(filePath),
+                reason: error instanceof Error ? error.message : 'unknown_manifest_load_error',
+            });
+        }
+    }
+    return report;
+}
+/**
+ * @name loadPrivatePremiumPluginManifests
+ * @description Return only the successfully loaded private plugin manifests,
+ * deep-cloned to prevent external mutation.
+ *
+ * @returns Array of `PremiumPluginManifest` clones (empty if disabled or no dir).
+ *
+ * @usedBy `builtin-plugins.ts:listPremiumPlugins` (merged with built-in plugins).
+ */
+export function loadPrivatePremiumPluginManifests() {
+    return loadPrivatePremiumPluginReport().loadedManifests.map(cloneManifest);
+}
+//# sourceMappingURL=private-manifest-loader.js.map

package/dist/premium/private-manifest-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-manifest-loader.js","sourceRoot":"","sources":["../../src/premium/private-manifest-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAGtE,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,qFAAqF;AACrF,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;AA+B9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,QAA+B;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAA0B,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;AACnE,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,OAAO,CAAC,gCAAgC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;AAC7D,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CAAC,QAA+B;IACvD,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACrD,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC;YACxC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAA4B;YAC1F,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAA4B;YAC5F,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE;YAClC,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS;gBACxC,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACvC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,mBAAmB,EAAE,UAAU,CAAC,QAAQ,CAAC,mBAAmB;aAC7D;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,aAAa,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,SAAS;QACzC,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACjD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO;gBAAE,SAAS;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE5C,oEAAoE;YACpE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC;gBAAE,SAAS;YAE3D,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,IAAI,0BAA0B;gBAAE,OAAO,KAAK,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,OAAO,GAAG,4BAA4B,EAAE,CAAC;IAC/C,MAAM,sBAAsB,GAAG,+BAA+B,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAmC;QAC7C,OAAO;QACP,sBAAsB;QACtB,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC;QACvC,eAAe,EAAE,EAAE;QACnB,iBAAiB,EAAE,EAAE;KACtB,CAAC;IAEF,0EAA0E;IAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IAE1C,mDAAmD;IACnD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAElD,yCAAyC;IACzC,KAAK,MAAM,QAAQ,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAE9B,2CAA2C;YAC3C,IAAI,KAAK,CAAC,IAAI,GAAG,0BAA0B,EAAE,CAAC;gBAC5C,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YAED,wCAAwC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAY,CAAC;YACrE,MAAM,UAAU,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC5B,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;oBACxB,MAAM,EAAE,mBAAmB;oBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,oCAAoC;YACpC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAA+B,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC;gBAC5B,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBACxB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO,8BAA8B,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC7E,CAAC"}

package/dist/premium/provider-bridge.d.ts

@@ -0,0 +1,109 @@
+/**
+ * @name premium/provider-bridge
+ * @description Dynamic loader and connection manager for premium provider adapters.
+ *
+ * Provider adapters live in the private subrepo (`sap-mcp-premium-private/providers/`).
+ * The public server loads them dynamically only when `SAP_MCP_ENABLE_PREMIUM_PLUGINS=true`
+ * and the corresponding provider env vars are configured.
+ *
+ * The bridge maintains a registry of active adapters keyed by `pluginId:capabilityId`,
+ * handles connect/disconnect lifecycle, and exposes health status to the metrics
+ * and monitoring layer.
+ *
+ * Security: adapters are loaded from the configured `SAP_MCP_PLUGIN_DIR` only.
+ * No code is ever loaded from MCP tool input or user-supplied JSON.
+ *
+ * @flow
+ *   1. `stream-broker.ts` / `webhook-engine.ts` need events for a capability.
+ *   2. → `getProviderAdapter(pluginId, capabilityId)` returns the adapter.
+ *   3. If not loaded, `loadProviderAdapter()` dynamically imports from the
+ *      private subrepo providers directory.
+ *   4. Adapter `connect()` is called once, then `subscribe()` returns an
+ *      async iterable of events.
+ *   5. `disconnectAllProviders()` is called on graceful shutdown.
+ *
+ * @module premium/provider-bridge
+ */
+import type { PremiumProviderAdapter, ProviderEvent, ProviderHealth } from './types.js';
+/**
+ * @name loadProviderAdapter
+ * @description Dynamically load a provider adapter from the private subrepo.
+ *
+ * The adapter module must be located at:
+ *   `<SAP_MCP_PLUGIN_DIR>/providers/<pluginId>/<capabilityId>.js`
+ * (or `.ts` if running via tsx/ts-node).
+ *
+ * The module must export a default factory function that returns a
+ * `PremiumProviderAdapter`:
+ *
+ * ```ts
+ * export default function createAdapter(): PremiumProviderAdapter { ... }
+ * ```
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns The loaded and connected `PremiumProviderAdapter`, or `null` if
+ *   private plugins are disabled, the dir is not configured, or the module
+ *   is not found.
+ *
+ * @usedBy `getProviderAdapter`
+ */
+export declare function loadProviderAdapter(pluginId: string, capabilityId: string): Promise<PremiumProviderAdapter | null>;
+/**
+ * @name getProviderAdapter
+ * @description Get or load a provider adapter for a plugin/capability pair.
+ *
+ * If the adapter is already in the registry, returns it directly.
+ * Otherwise, attempts to load it from the private subrepo.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns The `PremiumProviderAdapter`, or `null` if not available.
+ *
+ * @usedBy `stream-broker.ts`, `webhook-engine.ts`
+ */
+export declare function getProviderAdapter(pluginId: string, capabilityId: string): Promise<PremiumProviderAdapter | null>;
+/**
+ * @name getProviderHealth
+ * @description Get health status for a specific provider adapter.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns `ProviderHealth` if the adapter is loaded, otherwise a default unhealthy status.
+ *
+ * @usedBy `metrics.ts`
+ */
+export declare function getProviderHealth(pluginId: string, capabilityId: string): Promise<ProviderHealth>;
+/**
+ * @name getAllProviderHealth
+ * @description Get health status for all loaded provider adapters.
+ *
+ * @returns Record keyed by `pluginId:capabilityId` → `ProviderHealth`.
+ *
+ * @usedBy `metrics.ts`
+ */
+export declare function getAllProviderHealth(): Promise<Record<string, ProviderHealth>>;
+/**
+ * @name subscribeToProvider
+ * @description Subscribe to events from a provider adapter with filters.
+ *
+ * Convenience wrapper that loads the adapter and returns the async iterable.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @param filters      — Filter object passed to the adapter's `subscribe()`.
+ * @returns Async iterable of `ProviderEvent`, or `null` if the adapter is not available.
+ *
+ * @usedBy `stream-broker.ts`, `webhook-engine.ts`
+ */
+export declare function subscribeToProvider(pluginId: string, capabilityId: string, filters: Record<string, unknown>): Promise<AsyncIterable<ProviderEvent> | null>;
+/**
+ * @name disconnectAllProviders
+ * @description Disconnect all loaded provider adapters gracefully.
+ *
+ * Called during server shutdown to clean up connections.
+ *
+ * @usedBy `remote/server.ts` shutdown handler
+ */
+export declare function disconnectAllProviders(): Promise<void>;
+//# sourceMappingURL=provider-bridge.d.ts.map

package/dist/premium/provider-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-bridge.d.ts","sourceRoot":"","sources":["../../src/premium/provider-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAqCxF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA6CxC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAMxC;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC,CAczB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAapF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAK9C;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAS5D"}

package/dist/premium/provider-bridge.js

@@ -0,0 +1,239 @@
+/**
+ * @name premium/provider-bridge
+ * @description Dynamic loader and connection manager for premium provider adapters.
+ *
+ * Provider adapters live in the private subrepo (`sap-mcp-premium-private/providers/`).
+ * The public server loads them dynamically only when `SAP_MCP_ENABLE_PREMIUM_PLUGINS=true`
+ * and the corresponding provider env vars are configured.
+ *
+ * The bridge maintains a registry of active adapters keyed by `pluginId:capabilityId`,
+ * handles connect/disconnect lifecycle, and exposes health status to the metrics
+ * and monitoring layer.
+ *
+ * Security: adapters are loaded from the configured `SAP_MCP_PLUGIN_DIR` only.
+ * No code is ever loaded from MCP tool input or user-supplied JSON.
+ *
+ * @flow
+ *   1. `stream-broker.ts` / `webhook-engine.ts` need events for a capability.
+ *   2. → `getProviderAdapter(pluginId, capabilityId)` returns the adapter.
+ *   3. If not loaded, `loadProviderAdapter()` dynamically imports from the
+ *      private subrepo providers directory.
+ *   4. Adapter `connect()` is called once, then `subscribe()` returns an
+ *      async iterable of events.
+ *   5. `disconnectAllProviders()` is called on graceful shutdown.
+ *
+ * @module premium/provider-bridge
+ */
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { findPremiumCapability } from './builtin-plugins.js';
+import { privatePremiumPluginsEnabled } from './private-manifest-loader.js';
+/**
+ * @description Registry of active provider adapters keyed by `pluginId:capabilityId`.
+ */
+const adapterRegistry = new Map();
+/**
+ * @name adapterKey
+ * @description Build the registry key for a plugin/capability pair.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns The registry key string.
+ *
+ * @internal
+ */
+function adapterKey(pluginId, capabilityId) {
+    return `${pluginId}:${capabilityId}`;
+}
+/**
+ * @name configuredPluginDir
+ * @description Resolve the configured plugin directory from `SAP_MCP_PLUGIN_DIR`.
+ *
+ * @returns The absolute resolved path, or `null` if the env var is unset/empty.
+ *
+ * @internal
+ */
+function configuredPluginDir() {
+    const raw = process.env.SAP_MCP_PLUGIN_DIR;
+    if (!raw || !raw.trim())
+        return null;
+    return resolve(raw.trim());
+}
+/**
+ * @name loadProviderAdapter
+ * @description Dynamically load a provider adapter from the private subrepo.
+ *
+ * The adapter module must be located at:
+ *   `<SAP_MCP_PLUGIN_DIR>/providers/<pluginId>/<capabilityId>.js`
+ * (or `.ts` if running via tsx/ts-node).
+ *
+ * The module must export a default factory function that returns a
+ * `PremiumProviderAdapter`:
+ *
+ * ```ts
+ * export default function createAdapter(): PremiumProviderAdapter { ... }
+ * ```
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns The loaded and connected `PremiumProviderAdapter`, or `null` if
+ *   private plugins are disabled, the dir is not configured, or the module
+ *   is not found.
+ *
+ * @usedBy `getProviderAdapter`
+ */
+export async function loadProviderAdapter(pluginId, capabilityId) {
+    if (!privatePremiumPluginsEnabled())
+        return null;
+    const pluginDir = configuredPluginDir();
+    if (!pluginDir)
+        return null;
+    // Resolve the capability to check it exists and get provider env requirements.
+    const resolved = findPremiumCapability(pluginId, capabilityId);
+    if (!resolved)
+        return null;
+    // Check that all required provider env vars are set.
+    const providerReady = resolved.capability.providerEnv.every(envName => Boolean(process.env[envName]));
+    if (!providerReady)
+        return null;
+    const key = adapterKey(pluginId, capabilityId);
+    const existing = adapterRegistry.get(key);
+    if (existing)
+        return existing;
+    // Try .js first (built), then .ts (dev).
+    const jsPath = join(pluginDir, 'providers', pluginId, `${capabilityId}.js`);
+    const tsPath = join(pluginDir, 'providers', pluginId, `${capabilityId}.ts`);
+    let modulePath = null;
+    if (existsSync(jsPath)) {
+        modulePath = jsPath;
+    }
+    else if (existsSync(tsPath)) {
+        modulePath = tsPath;
+    }
+    else {
+        return null;
+    }
+    try {
+        const moduleUrl = pathToFileURL(modulePath).href;
+        const imported = await import(moduleUrl);
+        if (typeof imported.default !== 'function')
+            return null;
+        const adapter = imported.default();
+        if (!adapter || typeof adapter.connect !== 'function')
+            return null;
+        await adapter.connect();
+        adapterRegistry.set(key, adapter);
+        return adapter;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * @name getProviderAdapter
+ * @description Get or load a provider adapter for a plugin/capability pair.
+ *
+ * If the adapter is already in the registry, returns it directly.
+ * Otherwise, attempts to load it from the private subrepo.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns The `PremiumProviderAdapter`, or `null` if not available.
+ *
+ * @usedBy `stream-broker.ts`, `webhook-engine.ts`
+ */
+export async function getProviderAdapter(pluginId, capabilityId) {
+    const key = adapterKey(pluginId, capabilityId);
+    const existing = adapterRegistry.get(key);
+    if (existing)
+        return existing;
+    return loadProviderAdapter(pluginId, capabilityId);
+}
+/**
+ * @name getProviderHealth
+ * @description Get health status for a specific provider adapter.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @returns `ProviderHealth` if the adapter is loaded, otherwise a default unhealthy status.
+ *
+ * @usedBy `metrics.ts`
+ */
+export async function getProviderHealth(pluginId, capabilityId) {
+    const adapter = adapterRegistry.get(adapterKey(pluginId, capabilityId));
+    if (!adapter) {
+        return { healthy: false, lastError: 'Adapter not loaded.' };
+    }
+    try {
+        return await adapter.health();
+    }
+    catch (error) {
+        return {
+            healthy: false,
+            lastError: error instanceof Error ? error.message : 'Unknown provider health error.',
+        };
+    }
+}
+/**
+ * @name getAllProviderHealth
+ * @description Get health status for all loaded provider adapters.
+ *
+ * @returns Record keyed by `pluginId:capabilityId` → `ProviderHealth`.
+ *
+ * @usedBy `metrics.ts`
+ */
+export async function getAllProviderHealth() {
+    const results = {};
+    for (const [key, adapter] of adapterRegistry.entries()) {
+        try {
+            results[key] = await adapter.health();
+        }
+        catch (error) {
+            results[key] = {
+                healthy: false,
+                lastError: error instanceof Error ? error.message : 'Unknown provider health error.',
+            };
+        }
+    }
+    return results;
+}
+/**
+ * @name subscribeToProvider
+ * @description Subscribe to events from a provider adapter with filters.
+ *
+ * Convenience wrapper that loads the adapter and returns the async iterable.
+ *
+ * @param pluginId     - The premium plugin id.
+ * @param capabilityId - The capability id within the plugin.
+ * @param filters      — Filter object passed to the adapter's `subscribe()`.
+ * @returns Async iterable of `ProviderEvent`, or `null` if the adapter is not available.
+ *
+ * @usedBy `stream-broker.ts`, `webhook-engine.ts`
+ */
+export async function subscribeToProvider(pluginId, capabilityId, filters) {
+    const adapter = await getProviderAdapter(pluginId, capabilityId);
+    if (!adapter)
+        return null;
+    return adapter.subscribe(filters);
+}
+/**
+ * @name disconnectAllProviders
+ * @description Disconnect all loaded provider adapters gracefully.
+ *
+ * Called during server shutdown to clean up connections.
+ *
+ * @usedBy `remote/server.ts` shutdown handler
+ */
+export async function disconnectAllProviders() {
+    for (const [key, adapter] of adapterRegistry.entries()) {
+        try {
+            await adapter.disconnect();
+        }
+        catch {
+            // Best-effort disconnect — ignore errors during shutdown.
+        }
+        adapterRegistry.delete(key);
+    }
+}
+//# sourceMappingURL=provider-bridge.js.map

package/dist/premium/provider-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-bridge.js","sourceRoot":"","sources":["../../src/premium/provider-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E;;GAEG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkC,CAAC;AAElE;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,QAAgB,EAAE,YAAoB;IACxD,OAAO,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,YAAoB;IAEpB,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,qDAAqD;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC;IAE5E,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAA+C,CAAC;QACvF,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAExD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAEnE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,OAAO,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;SACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,GAAG;gBACb,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;aACrF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,YAAoB,EACpB,OAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}