@proof-holdings/mcp-server 1.0.0 → 1.1.0

package/dist/tools/delegation-verify.js

@@ -0,0 +1,192 @@
+import { z } from 'zod';
+import { verifyDelegation, verifyPublishedDelegation } from '@proof-holdings/delegation-verifier';
+import { jsonResult, errorResult } from '../types.js';
+import { FAILURE_REASON_OUTCOME } from './delegation-verify-outcomes.js';
+/**
+ * The FIRST CONSUMER of the issuer-agnostic reference verifier (m-delegation-verifier-ref).
+ *
+ * Two things make this tool different from every other tool in this server:
+ *
+ *   1. It needs no API key. Verifying someone else's delegation is not a customer operation —
+ *      it runs entirely against public surfaces (the issuer's JWKS, its status list and its
+ *      public token-status endpoint). An agent evaluating a third-party MCP server can call
+ *      this before it has an account with anyone.
+ *   2. `delegate` AND `expected_principal` are both REQUIRED, and they close two different
+ *      attacks. `delegate` is the artifact identity the CALLER resolved — the npm package it
+ *      is about to install, the endpoint it is about to call — never a field copied out of the
+ *      ARTIFACT being checked, because a published token is a bearer artifact anyone can paste
+ *      into their own card, and a name in that artifact's own package.json or manifest is just
+ *      as self-declared as one in its card. The comment used to say "the card" alone; a live
+ *      agent read `package.json` instead, matched the artifact against itself, and accused a
+ *      real publisher of acting without authority. The rule now lives in both tool descriptions
+ *      where an agent can actually read it, not only here.
+ *
+ *      `expected_principal` is the domain the caller expects to stand behind it: an issuer binds
+ *      `delegate` to nothing, so ANY domain owner can mint a genuine, signature-valid delegation
+ *      naming someone else's package. Without both pins, a `verified: true` here would mean only
+ *      "some domain said something about some artifact" — which is what an agent would then act on.
+ *
+ * The trust policy is stated HERE, explicitly, rather than defaulted inside the library — the
+ * library ships with no trust list at all, which is what makes it a verifier rather than a
+ * client. This server trusts proof.holdings because it is proof.holdings' own server.
+ */
+const delegateTypeEnum = z.enum(['url', 'purl']);
+function proofHoldingsTrust(baseUrl) {
+    const origin = baseUrl.replace(/\/+$/, '');
+    return {
+        issuer: 'proof.holdings',
+        jwksUri: `${origin}/.well-known/jwks.json`,
+        // The only PUBLIC surface that resolves the control-proof cascade: a delegation is worth
+        // no more than the domain proof under it, and the status list carries each row's own bit.
+        statusEndpoint: `${origin}/api/v1/proofs/validate`,
+    };
+}
+/**
+ * The single-artifact verification core, factored out so `verify_delegation` (one item) and
+ * `verify_delegations` (a batch of up to 50, h-proof-checker-mcp) share exactly one call into
+ * the reference verifier. Callers must already have checked `card` XOR `token` — this function
+ * does not, so it stays usable per-item inside a batch loop without duplicating that guard.
+ */
+export function verifyOneDelegation(item, baseUrl) {
+    const verifyOptions = {
+        trustedIssuers: [proofHoldingsTrust(baseUrl)],
+        delegate: item.delegate,
+        expectedPrincipal: item.expected_principal,
+        ...(item.required_scopes ? { requiredScopes: item.required_scopes } : {}),
+        statusCheck: item.check_status === false ? 'skip' : 'required',
+    };
+    return item.card !== undefined
+        ? verifyPublishedDelegation(item.card, verifyOptions)
+        : verifyDelegation(item.token, verifyOptions);
+}
+export function registerTools(tool, options) {
+    tool('verify_delegation', "Verify a Proof of Delegation — the attestation that a domain authorized a specific agent artifact. Pass either the artifact's card (MCP server.json / A2A agent card) or a raw delegation token, PLUS two facts you established yourself: the artifact identity you resolved (the package you are installing, the endpoint you are calling) and the domain you expect to stand behind it. Both are required — a token can be copied into someone else's card, and any domain owner can mint a valid delegation naming someone else's package, so a verdict without both pins would mean 'some domain said something about some artifact'. WHERE THE IDENTITY MAY COME FROM: it is the artifact you are acting on, and never a value read from inside the artifact you are checking. A name in the artifact's own package.json, card or manifest is self-declared and editable by whoever ships it, so checking it against the delegation compares the artifact with itself. Resolve it afresh at call time instead of reusing a value from earlier in this conversation, which may already be stale. When no independently resolvable identity exists — a local or unpublished artifact — you have nothing to compare against, and that is the honest answer: report it rather than a mismatch, because a mismatch here reads as an accusation against the domain named in the delegation. The verifier walks signature → principal → delegate → revocation status, including the cascade down to the domain control proof. Requires no API key. What a verified result means: the expected domain's controller authorized this artifact for these scopes — NOT that the artifact is safe, audited or endorsed.", {
+        card: z
+            .record(z.unknown())
+            .optional()
+            .describe('The MCP server card or A2A agent card to read the delegation from'),
+        token: z.string().optional().describe('A raw delegation token, when you already have it instead of a card'),
+        delegate: z
+            .object({
+            type: delegateTypeEnum.describe('Identifier type: https URL or package URL (purl)'),
+            value: z.string().min(1).max(2048).describe('The artifact identifier YOU resolved — never a value read from inside the artifact you are checking, and resolved afresh rather than carried over from earlier in the conversation'),
+        })
+            .describe('The artifact identity you resolved independently. Required: this comparison is what defeats a copied token.'),
+        expected_principal: z
+            .string()
+            .min(1)
+            .max(253)
+            .describe('Required. The domain you expect to have authorized this artifact (e.g. postmarkapp.com) — an issuer binds the artifact to nothing, so any domain owner can mint a valid delegation for someone else\'s package. Without this pin the answer is only "some domain claims this".'),
+        required_scopes: z
+            .array(z.string().min(1).max(64))
+            .min(1)
+            .max(32)
+            .optional()
+            .describe('Capability scopes the delegation must grant'),
+        check_status: z
+            .boolean()
+            .optional()
+            .describe('Default true. When false the signature and claims are checked but revocation is NOT — treat the result as "not revoked-checked", never as "not revoked".'),
+    }, async (args) => {
+        const { card, token, delegate, expected_principal, required_scopes, check_status } = args;
+        if ((card === undefined) === (token === undefined)) {
+            return errorResult('invalid_arguments: supply exactly one of `card` or `token`');
+        }
+        try {
+            const result = await verifyOneDelegation({ card, token, delegate, expected_principal, required_scopes, check_status }, options.baseUrl);
+            if (!result.valid) {
+                // A verdict, not a transport failure — returned as data so an agent can branch on
+                // the reason instead of parsing an error string.
+                return jsonResult({
+                    verified: false,
+                    reason: result.reason,
+                    outcome: result.outcome,
+                    message: result.message,
+                });
+            }
+            return jsonResult({
+                verified: true,
+                status_checked: result.statusChecked,
+                principal_checked: result.principalChecked,
+                attests: `${result.delegation.principal} authorized ${result.delegation.delegate} for: ${result.delegation.scope.join(', ')}`,
+                delegation: {
+                    issuer: result.delegation.issuer,
+                    principal: result.delegation.principal,
+                    delegate: result.delegation.delegate,
+                    scope: result.delegation.scope,
+                    control_proof: result.delegation.controlProof,
+                    delegation_id: result.delegation.delegationId,
+                    issued_at: result.delegation.issuedAt.toISOString(),
+                    expires_at: result.delegation.expiresAt.toISOString(),
+                },
+                disclaimer: 'This attests domain authorization of the artifact only. It is not a statement that the artifact is safe, audited or endorsed.',
+            });
+        }
+        catch (e) {
+            return errorResult(`verification_failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    const verifyItemSchema = z
+        .object({
+        card: z
+            .record(z.unknown())
+            .optional()
+            .describe('The MCP server card or A2A agent card to read the delegation from'),
+        token: z.string().optional().describe('A raw delegation token, when you already have it instead of a card'),
+        delegate: z
+            .object({
+            type: delegateTypeEnum.describe('Identifier type: https URL or package URL (purl)'),
+            value: z.string().min(1).max(2048).describe('The artifact identifier YOU resolved — never a value read from inside the artifact you are checking, and resolved afresh rather than carried over from earlier in the conversation'),
+        })
+            .describe('The artifact identity you resolved independently. Required: this comparison is what defeats a copied token.'),
+        expected_principal: z
+            .string()
+            .min(1)
+            .max(253)
+            .describe('Required. The domain you expect to have authorized this artifact (e.g. postmarkapp.com) — an issuer binds the artifact to nothing, so any domain owner can mint a valid delegation for someone else\'s package. Without this pin the answer is only "some domain claims this".'),
+        required_scopes: z
+            .array(z.string().min(1).max(64))
+            .min(1)
+            .max(32)
+            .optional()
+            .describe('Capability scopes the delegation must grant'),
+    })
+        .refine((item) => (item.card === undefined) !== (item.token === undefined), {
+        message: 'each item must supply exactly one of `card` or `token`',
+    });
+    tool('verify_delegations', 'Batch-verify up to 50 Proof of Delegation artifacts in one call — the inventory half of the checker (h-proof-checker-mcp): re-check everything you already trust instead of one verify_delegation call per artifact. Each item takes the same shape verify_delegation requires (card XOR token, delegate, expected_principal, optional required_scopes) and follows the same rule about where identity comes from: each `delegate` is the artifact you are acting on, never a value read from inside the artifact you are checking, and resolved afresh at call time. Items are verified INDEPENDENTLY — no cross-item state, nothing persisted, one item failing never affects another item\'s result. This tool does NOT discover what you have installed and does NOT fetch anything on your behalf: it verifies material you already hold, the same trust boundary verify_delegation draws. Revocation is always checked (there is no check_status:false here — the point of a batch re-check is to see what changed since you last looked). Each result carries an `outcome`: confirmed_valid (verified), confirmed_invalid (a genuine negative verdict — revoked, expired, mismatched, malformed, and similar), no_claim_found (the artifact publishes no delegation at all — an absence, never an accusation), or unconfirmed (we could not reach the issuer or otherwise get a confident answer right now — NEVER treat this as a bad verdict). Requires no API key. `checked_at` on each result is the moment THAT item\'s own check completed, not one timestamp shared across the call.', {
+        items: z.array(verifyItemSchema).min(1).max(50).describe('1-50 artifacts to verify in this call, each shaped like a verify_delegation call'),
+    }, async (args) => {
+        const results = await Promise.all(args.items.map(async (item) => {
+            try {
+                const result = await verifyOneDelegation(item, options.baseUrl);
+                const checked_at = new Date().toISOString();
+                if (result.valid) {
+                    return {
+                        outcome: 'confirmed_valid',
+                        verified: true,
+                        status_checked: result.statusChecked,
+                        checked_at,
+                    };
+                }
+                return {
+                    outcome: FAILURE_REASON_OUTCOME[result.reason],
+                    reason: result.reason,
+                    message: result.message,
+                    verified: false,
+                    checked_at,
+                };
+            }
+            catch (e) {
+                return {
+                    outcome: 'unconfirmed',
+                    message: `verification_failed: ${e instanceof Error ? e.message : String(e)}`,
+                    verified: false,
+                    checked_at: new Date().toISOString(),
+                };
+            }
+        }));
+        return jsonResult({ results });
+    });
+}
+//# sourceMappingURL=delegation-verify.js.map

package/dist/tools/delegation-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-verify.js","sourceRoot":"","sources":["../../src/tools/delegation-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAGlG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjD,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,GAAG,MAAM,wBAAwB;QAC1C,yFAAyF;QACzF,0FAA0F;QAC1F,cAAc,EAAE,GAAG,MAAM,yBAAyB;KACnD,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0B,EAAE,OAAe;IAC7E,MAAM,aAAa,GAAkB;QACnC,cAAc,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,iBAAiB,EAAE,IAAI,CAAC,kBAAkB;QAC1C,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,WAAW,EAAE,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;KAC/D,CAAC;IAEF,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS;QAC5B,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACrD,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAe,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,OAA4B;IAC7E,IAAI,CACF,mBAAmB,EACnB,inDAAinD,EACjnD;QACE,IAAI,EAAE,CAAC;aACJ,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACnB,QAAQ,EAAE;aACV,QAAQ,CAAC,mEAAmE,CAAC;QAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QAC3G,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,kDAAkD,CAAC;YACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;SAClO,CAAC;aACD,QAAQ,CAAC,6GAA6G,CAAC;QAC1H,kBAAkB,EAAE,CAAC;aAClB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,CACP,gRAAgR,CACjR;QACH,eAAe,EAAE,CAAC;aACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,EAAE;aACV,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,YAAY,EAAE,CAAC;aACZ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,0JAA0J,CAAC;KACxK,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE1F,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC,4DAA4D,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,eAAe,EAAE,YAAY,EAAE,EAC5E,OAAO,CAAC,OAAO,CAChB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,kFAAkF;gBAClF,iDAAiD;gBACjD,OAAO,UAAU,CAAC;oBAChB,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,UAAU,CAAC;gBAChB,QAAQ,EAAE,IAAI;gBACd,cAAc,EAAE,MAAM,CAAC,aAAa;gBACpC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB;gBAC1C,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,eAAe,MAAM,CAAC,UAAU,CAAC,QAAQ,SAAS,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC7H,UAAU,EAAE;oBACV,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;oBAChC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;oBACtC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;oBACpC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;oBAC9B,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY;oBAC7C,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY;oBAC7C,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE;oBACnD,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE;iBACtD;gBACD,UAAU,EACR,+HAA+H;aAClI,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,WAAW,CAAC,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC;SACvB,MAAM,CAAC;QACN,IAAI,EAAE,CAAC;aACJ,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACnB,QAAQ,EAAE;aACV,QAAQ,CAAC,mEAAmE,CAAC;QAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QAC3G,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,kDAAkD,CAAC;YACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;SAClO,CAAC;aACD,QAAQ,CAAC,6GAA6G,CAAC;QAC1H,kBAAkB,EAAE,CAAC;aAClB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,CACP,gRAAgR,CACjR;QACH,eAAe,EAAE,CAAC;aACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,EAAE;aACV,QAAQ,CAAC,6CAA6C,CAAC;KAC3D,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE;QAC1E,OAAO,EAAE,wDAAwD;KAClE,CAAC,CAAC;IAEL,IAAI,CACF,oBAAoB,EACpB,ogDAAogD,EACpgD;QACE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAC7I,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAE5C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,OAAO;wBACL,OAAO,EAAE,iBAA0B;wBACnC,QAAQ,EAAE,IAAI;wBACd,cAAc,EAAE,MAAM,CAAC,aAAa;wBACpC,UAAU;qBACX,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,KAAK;oBACf,UAAU;iBACX,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,aAAsB;oBAC/B,OAAO,EAAE,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;oBAC7E,QAAQ,EAAE,KAAK;oBACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACrC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/delegations.d.ts

@@ -0,0 +1,4 @@
+import type { HttpClient } from '../http.js';
+import type { ToolRegistrar } from '../types.js';
+export declare function registerTools(tool: ToolRegistrar, http: HttpClient): void;
+//# sourceMappingURL=delegations.d.ts.map

package/dist/tools/delegations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegations.d.ts","sourceRoot":"","sources":["../../src/tools/delegations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAajD,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,QAsFlE"}

package/dist/tools/delegations.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+import { jsonResult, errorResult } from '../types.js';
+import { ApiError } from '../http.js';
+// Mongo ObjectId OR the public ph_dlg_* handle — mirrors delegationIdParamSchema
+// in the backend validators (this package cannot import backend src/).
+const DELEGATION_ID_REGEX = /^([0-9a-fA-F]{24}|ph_dlg_[a-f0-9]{32})$/;
+const CONTROL_PROOF_REGEX = /^ph_ctl_[a-f0-9]{32}$/;
+const delegateTypeEnum = z.enum(['url', 'purl']);
+const delegationStatusEnum = z.enum(['active', 'revoked']);
+const revokeReasonEnum = z.enum(['user_request', 'fraud', 'key_compromise', 'other']);
+export function registerTools(tool, http) {
+    tool('create_delegation', 'Create a delegation (Proof of Delegation): a control-proven domain authorizes a typed url/purl artifact for a set of capability scopes and receives a publishable signed token. The attestation is that the domain\'s controller authorized this artifact — nothing more; it says nothing about the artifact or the business behind it. Each mint is a billable proof. A requested lifetime longer than the control proof\'s remainder is rejected, never truncated. The result carries the publishable token AND the DERIVED effective_status/is_valid — the same pair the list and get tools return, so the shape does not depend on which verb produced it.', {
+        control_proof: z.string().regex(CONTROL_PROOF_REGEX).describe('Public handle (ph_ctl_<32 hex>) of YOUR active domain control proof'),
+        delegate: z.object({
+            type: delegateTypeEnum.describe('Identifier type: https URL or package URL (purl)'),
+            value: z.string().min(1).max(2048).describe('The artifact identifier (canonicalized server-side)'),
+        }).describe('The typed artifact being authorized'),
+        scope: z.array(z.string().min(1).max(64)).min(1).max(32).describe('1-32 capability scopes: lowercase kebab-case tokens, at most 64 characters each (e.g. send-email). NOT API scopes — an API-style resource:action such as payments:read is rejected with invalid_scope.'),
+        expires_in: z.number().int().positive().max(10 * 365 * 24 * 3600).optional().describe('Lifetime in seconds (must not exceed the control proof\'s remainder)'),
+    }, async (args) => {
+        try {
+            const result = await http.post('/api/v1/delegations', args);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('list_delegations', 'List your own delegations with optional filters. Each item carries the DERIVED effective_status/is_valid beside its stored status — read effective_status, since status records only whether the owner revoked the delegation themselves, so a delegation still reads active there after its domain control proof was revoked, suspended or expired, and after its OWN lifetime ran out. effective_status accounts for all of those: it reports expired once either lifetime has passed, whichever is earlier. Tokens are not included in the list — use get_delegation for the stored token. There is no public enumeration of third-party delegations.', {
+        status: delegationStatusEnum
+            .optional()
+            .describe("Filter by the delegation's OWN stored status (active|revoked). Does NOT filter the derived effective_status — status=active still returns delegations whose control proof died, and ones that simply ran out."),
+        page: z.number().int().positive().optional().describe('Page number'),
+        limit: z.number().int().min(1).max(100).optional().describe('Items per page'),
+    }, async (args) => {
+        try {
+            const query = {};
+            if (args.status !== undefined)
+                query.status = args.status;
+            if (args.page !== undefined)
+                query.page = args.page;
+            if (args.limit !== undefined)
+                query.limit = args.limit;
+            const result = await http.get('/api/v1/delegations', query);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('get_delegation', 'Get one of your delegations by Mongo id or ph_dlg_* handle. Returns the stored publishable token plus the DERIVED effective_status/is_valid — the delegation is only as live as the control proof it stands on (a revoked, suspended or expired domain proof invalidates it) and never outlives its own expires_at, whichever comes first.', {
+        id: z.string().regex(DELEGATION_ID_REGEX).describe('Delegation ID (24-hex Mongo id or ph_dlg_<32 hex> handle)'),
+    }, async ({ id }) => {
+        try {
+            const result = await http.get(`/api/v1/delegations/${encodeURIComponent(id)}`);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('revoke_delegation', 'Revoke ONE delegation. The domain control proof and sibling delegations stay valid; the revocation is mirrored into the proof registry so the CRL, status list and public status lookup all see it. Idempotent: a repeat revoke answers success with the same body, both here and through revoke_proof with the ph_dlg_ handle — unlike a PROOF, where a repeat answers already_revoked. The result carries the DERIVED effective_status/is_valid beside the stored status.', {
+        id: z.string().regex(DELEGATION_ID_REGEX).describe('Delegation ID (24-hex Mongo id or ph_dlg_<32 hex> handle)'),
+        reason: revokeReasonEnum.optional().describe('Reason for revocation'),
+    }, async ({ id, reason }) => {
+        try {
+            const body = reason !== undefined ? { reason } : undefined;
+            const result = await http.post(`/api/v1/delegations/${encodeURIComponent(id)}/revoke`, body);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+}
+//# sourceMappingURL=delegations.js.map

package/dist/tools/delegations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegations.js","sourceRoot":"","sources":["../../src/tools/delegations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AACtE,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACjD,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtF,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAgB;IACjE,IAAI,CACF,mBAAmB,EACnB,goBAAgoB,EAChoB;QACE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QACpI,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,kDAAkD,CAAC;YACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;SACnG,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QAClD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,wMAAwM,CAAC;QAC3Q,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;KAC9J,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,kBAAkB,EAClB,0nBAA0nB,EAC1nB;QACE,MAAM,EAAE,oBAAoB;aACzB,QAAQ,EAAE;aACV,QAAQ,CACP,+MAA+M,CAChN;QACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KAC9E,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,KAAK,GAA0D,EAAE,CAAC;YACxE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACpD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,gBAAgB,EAChB,4UAA4U,EAC5U;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,2DAA2D,CAAC;KAChH,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,mBAAmB,EACnB,6cAA6c,EAC7c;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QAC/G,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;KACtE,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7F,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/domains.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,QAmSlE"}
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,QAkSlE"}

package/dist/tools/domains.js

@@ -19,9 +19,8 @@ export function registerTools(tool, http) {
             throw e;
         }
     });
-    tool('add_domain', 'Add a new domain to verify ownership. Optionally specify a project, email sending intent, and verification method.', {
+    tool('add_domain', 'Add a new domain to verify ownership. Optionally specify email sending intent and verification method.', {
         domain: z.string().min(1).max(255).describe('Domain name to add (e.g. example.com)'),
-        project_id: z.string().optional().describe('Project ID to associate the domain with'),
         for_email_sending: z.boolean().optional().describe('Whether this domain is for email sending'),
         verification_method: z.enum(['auto_dns', 'manual_dns', 'http_file', 'email']).optional().describe('Preferred verification method'),
     }, async (args) => {

package/dist/tools/domains.js.map

@@ -1 +1 @@
-{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAEpG,MAAM,iBAAiB,GAAG;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACvE,WAAW,EAAE,iBAAiB;CAC/B,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAgB;IACjE,IAAI,CACF,cAAc,EACd,wGAAwG,EACxG,EAAE,EACF,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACpD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,YAAY,EACZ,oHAAoH,EACpH;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACpF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;QACrF,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QAC9F,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACnI,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,YAAY,EACZ,+GAA+G,EAC/G;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,eAAe,EACf,0DAA0D,EAC1D;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,eAAe,EACf,2GAA2G,EAC3G;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACtF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,oBAAoB,EACpB,qJAAqJ,EACrJ;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;KACxF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACjH,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,iBAAiB,EACjB,+JAA+J,EAC/J;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KAC7D,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACxH,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,sBAAsB,EACtB,mJAAmJ,EACnJ,iBAAiB,EACjB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YACxI,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,2BAA2B,EAC3B,kJAAkJ,EAClJ,iBAAiB,EACjB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7I,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,mBAAmB,EACnB,6GAA6G,EAC7G,EAAE,EACF,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC1D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,gCAAgC,EAChC,8GAA8G,EAC9G;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;YACvG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,0BAA0B,EAC1B,8HAA8H,EAC9H;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;KAC9D,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC;YAChG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,iCAAiC,EACjC,2HAA2H,EAC3H;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;YAClG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,2BAA2B,EAC3B,+FAA+F,EAC/F;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAC7E,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9G,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,qBAAqB,EACrB,8EAA8E,EAC9E;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KACnG,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACzG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,oBAAoB,EACpB,0HAA0H,EAC1H;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KAC/F,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACjG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,2BAA2B,EAC3B,iGAAiG,EACjG;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC3F,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAEpG,MAAM,iBAAiB,GAAG;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACvE,WAAW,EAAE,iBAAiB;CAC/B,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAgB;IACjE,IAAI,CACF,cAAc,EACd,wGAAwG,EACxG,EAAE,EACF,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACpD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,YAAY,EACZ,wGAAwG,EACxG;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACpF,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QAC9F,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACnI,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,YAAY,EACZ,+GAA+G,EAC/G;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,eAAe,EACf,0DAA0D,EAC1D;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,eAAe,EACf,2GAA2G,EAC3G;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACtF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,oBAAoB,EACpB,qJAAqJ,EACrJ;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;KACxF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACjH,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,iBAAiB,EACjB,+JAA+J,EAC/J;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KAC7D,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACxH,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,sBAAsB,EACtB,mJAAmJ,EACnJ,iBAAiB,EACjB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YACxI,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,2BAA2B,EAC3B,kJAAkJ,EAClJ,iBAAiB,EACjB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7I,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,mBAAmB,EACnB,6GAA6G,EAC7G,EAAE,EACF,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC1D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,gCAAgC,EAChC,8GAA8G,EAC9G;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;YACvG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,0BAA0B,EAC1B,8HAA8H,EAC9H;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;KAC9D,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC;YAChG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,iCAAiC,EACjC,2HAA2H,EAC3H;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;YAClG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,2BAA2B,EAC3B,+FAA+F,EAC/F;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAC7E,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9G,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,qBAAqB,EACrB,8EAA8E,EAC9E;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KACnG,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACzG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,oBAAoB,EACpB,0HAA0H,EAC1H;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KAC/F,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACjG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,2BAA2B,EAC3B,iGAAiG,EACjG;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC3F,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/hitl-keys.d.ts

@@ -0,0 +1,4 @@
+import type { HttpClient } from '../http.js';
+import type { ToolRegistrar } from '../types.js';
+export declare function registerTools(tool: ToolRegistrar, http: HttpClient): void;
+//# sourceMappingURL=hitl-keys.d.ts.map

package/dist/tools/hitl-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-keys.d.ts","sourceRoot":"","sources":["../../src/tools/hitl-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,QA0DlE"}

package/dist/tools/hitl-keys.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import { jsonResult, errorResult } from '../types.js';
+import { ApiError } from '../http.js';
+export function registerTools(tool, http) {
+    tool('get_hitl_keys', 'Get the encryption keypair for a HITL config. Returns public key, encrypted private key, KDF salt, and key ID (kid).', {
+        hitl_id: z.string().describe('HITL config ID'),
+    }, async ({ hitl_id }) => {
+        try {
+            const result = await http.get(`/api/v1/hitl/${encodeURIComponent(hitl_id)}/keys`);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('upload_hitl_keys', 'Upload an encryption keypair for a HITL config. The server validates the RSA-4096 public key and computes the key ID. Note: the encrypted_private_key is already encrypted client-side with the user\'s password — the server never sees the password.', {
+        hitl_id: z.string().describe('HITL config ID'),
+        public_key: z.string().describe('PEM-encoded RSA-4096 SPKI public key'),
+        encrypted_private_key: z.string().describe('JSON-serialized encrypted private key envelope (PBKDF2-SHA256+AES-256-GCM)'),
+        kdf_salt: z.string().describe('Base64url-encoded PBKDF2 salt'),
+    }, async ({ hitl_id, public_key, encrypted_private_key, kdf_salt }) => {
+        try {
+            const result = await http.put(`/api/v1/hitl/${encodeURIComponent(hitl_id)}/keys`, {
+                public_key,
+                encrypted_private_key,
+                kdf_salt,
+            });
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('delete_hitl_keys', 'Delete the encryption keypair from a HITL config. WARNING: Existing ciphertexts will become permanently unreadable.', {
+        hitl_id: z.string().describe('HITL config ID'),
+    }, async ({ hitl_id }) => {
+        try {
+            const result = await http.del(`/api/v1/hitl/${encodeURIComponent(hitl_id)}/keys`);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+}
+//# sourceMappingURL=hitl-keys.js.map

package/dist/tools/hitl-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-keys.js","sourceRoot":"","sources":["../../src/tools/hitl-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAgB;IACjE,IAAI,CACF,eAAe,EACf,sHAAsH,EACtH;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,kBAAkB,EAClB,wPAAwP,EACxP;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QACvE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACxH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC/D,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE;gBAChF,UAAU;gBACV,qBAAqB;gBACrB,QAAQ;aACT,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CACF,kBAAkB,EAClB,qHAAqH,EACrH;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KAC/C,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/hitl.d.ts

@@ -0,0 +1,4 @@
+import type { HttpClient } from '../http.js';
+import type { ToolRegistrar } from '../types.js';
+export declare function registerTools(tool: ToolRegistrar, http: HttpClient): void;
+//# sourceMappingURL=hitl.d.ts.map

package/dist/tools/hitl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl.d.ts","sourceRoot":"","sources":["../../src/tools/hitl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAwBjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,QAyKlE"}

package/dist/tools/hitl.js

@@ -0,0 +1,151 @@
+import { z } from 'zod';
+import { jsonResult, errorResult, pollUntilTerminal, BSUID_REGEX, WAIT_DEFAULT_SECONDS } from '../types.js';
+import { ApiError } from '../http.js';
+const hitlStatusEnum = z.enum(['active', 'archived']);
+const telegramChannelConfig = z.object({
+    type: z.literal('telegram'),
+    config: z.object({ chat_id: z.string().min(1).max(50) }),
+});
+const whatsappChannelConfig = z.object({
+    type: z.literal('whatsapp'),
+    config: z.object({
+        phone_number: z.string().regex(/^\+?[1-9]\d{6,14}$/).optional().describe('Phone number in E.164 format'),
+        bsuid: z.string().regex(BSUID_REGEX).optional().describe('WhatsApp Business-Scoped User ID (e.g. US.abc123...)'),
+    }).refine((data) => data.phone_number || data.bsuid, { message: 'At least one of phone_number or bsuid is required' }),
+});
+const hitlChannelSchema = z.discriminatedUnion('type', [telegramChannelConfig, whatsappChannelConfig]);
+export function registerTools(tool, http) {
+    tool('create_hitl', 'Create a HITL (Human-in-the-Loop) config. Defines which messaging channels receive approval requests and the default timeout.\n\nAgent usage: After creating a HITL config, you must call request_hitl_authorization before it can be used with create_confirmation. For Telegram channels, use create_chat_id_discovery first to discover the user\'s chat ID, then include it in the channel config.', {
+        name: z.string().min(1).max(200).describe('Human-readable name for this HITL config'),
+        channels: z.array(hitlChannelSchema).min(1).describe('Messaging channels for approval requests (telegram or whatsapp)'),
+        timeout_seconds: z.number().int().min(60).max(86400).optional().describe('Default timeout in seconds (60–86400, default: 3600)'),
+    }, async (args) => {
+        try {
+            const result = await http.post('/api/v1/hitl', args);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('get_hitl', 'Get a HITL config by ID. Returns the config including channels, timeout, and status.', {
+        id: z.string().describe('HITL config ID'),
+    }, async ({ id }) => {
+        try {
+            const result = await http.get(`/api/v1/hitl/${encodeURIComponent(id)}`);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('list_hitls', 'List HITL configs with optional filters. Returns paginated results.', {
+        status: hitlStatusEnum.optional().describe('Filter by status (active or archived)'),
+        environment: z.enum(['production', 'test']).optional().describe('Filter by environment (production or test)'),
+        page: z.number().int().positive().optional().describe('Page number'),
+        limit: z.number().int().min(1).max(100).optional().describe('Items per page'),
+    }, async (args) => {
+        try {
+            const query = {};
+            if (args.status !== undefined)
+                query.status = args.status;
+            if (args.environment !== undefined)
+                query.environment = args.environment;
+            if (args.page !== undefined)
+                query.page = args.page;
+            if (args.limit !== undefined)
+                query.limit = args.limit;
+            const result = await http.get('/api/v1/hitl', query);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('update_hitl', 'Update a HITL config. Can change name, channels, or timeout.', {
+        id: z.string().describe('HITL config ID'),
+        name: z.string().min(1).max(200).nullable().optional().describe('New name (null to clear)'),
+        channels: z.array(hitlChannelSchema).min(1).optional().describe('Updated channels'),
+        timeout_seconds: z.number().int().min(60).max(86400).optional().describe('Updated timeout in seconds (60–86400)'),
+    }, async ({ id, ...body }) => {
+        try {
+            const result = await http.patch(`/api/v1/hitl/${encodeURIComponent(id)}`, body);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('delete_hitl', 'Delete (archive) a HITL config. Sets status to archived. Cannot be used for new confirmations after deletion.', {
+        id: z.string().describe('HITL config ID to delete'),
+    }, async ({ id }) => {
+        try {
+            const result = await http.del(`/api/v1/hitl/${encodeURIComponent(id)}`);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('request_hitl_authorization', 'Request authorization for a HITL config. Sends consent requests to all configured channels (Telegram/WhatsApp). Users must approve before confirmations can be sent.\n\nAgent usage: This must be completed before create_confirmation will work for this HITL config. The consent request is DELIVERED to each channel — the response carries no link to show. It returns `authorizations` — one entry per resolved recipient, each with its `channel`, `recipient`, `authorization_id` and `status` — plus a `message`. Read the entries rather than assuming: `status: \'pending\'` means consent was just sent and the user must approve in Telegram/WhatsApp itself, while `status: \'active\'` means that recipient had already authorized and nothing was sent to them. An EMPTY array does not mean everyone is authorized — it means no recipient could be resolved at all (usually a HITL config bound to a missing or inactive circle, or channels whose recipient is blank), so nobody was asked and waiting for an approval would hang forever. Do not relay `message` on that branch: it reads \'All channels already have active or pending authorizations\', which is exactly the wrong conclusion. Read the array. After requesting, you can proceed once the user confirms they have approved.', {
+        id: z.string().describe('HITL config ID to request authorization for'),
+    }, async ({ id }) => {
+        try {
+            const result = await http.post(`/api/v1/hitl/${encodeURIComponent(id)}/authorize`, {});
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('create_chat_id_discovery', 'Create a Telegram chat ID discovery token. Returns a deep_link, qr_code (base64 PNG), and qr_text (UTF-8 text QR for terminal display). The user opens the link in Telegram, which reveals their chat ID for HITL config setup.\n\nAgent usage: pass the response\'s `deep_link` to render_auth_link so the user can click or scan it. Never hand `qr_text` to a link renderer — it is that same link already rendered as QR art. Print it verbatim inside a fenced code block only when a real terminal needs the QR. Then poll poll_chat_id_discovery with the returned token until the chat_id appears. Use the discovered chat_id when creating a HITL config with a Telegram channel.', {}, async () => {
+        try {
+            const result = await http.post('/api/v1/hitl/chat-id-discovery', {});
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('poll_chat_id_discovery', 'Poll a chat ID discovery token. Returns the discovered Telegram chat ID, user ID, and username once the user interacts with the bot.', {
+        token: z.string().describe('Discovery token from create_chat_id_discovery'),
+    }, async ({ token }) => {
+        try {
+            const result = await http.get(`/api/v1/hitl/chat-id-discovery/${encodeURIComponent(token)}`);
+            return jsonResult(result);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+    tool('wait_for_chat_id_discovery', 'Poll a chat ID discovery token until the user interacts with the Telegram bot. Uses exponential backoff (2s initial, 1.5x, 30s max) with jitter.\n\nAgent usage: Call this after create_chat_id_discovery. Present the discovery response\'s `deep_link` with render_auth_link first, then poll with the returned token. Terminal states: "completed" (chat_id discovered — use it when creating a HITL config with a Telegram channel), "expired". While "pending", the user has not yet opened the Telegram link.', {
+        token: z.string().describe('Discovery token from create_chat_id_discovery'),
+        timeout_seconds: z.number().int().min(1).max(600).optional().describe(`Maximum wait time in seconds (default: ${WAIT_DEFAULT_SECONDS}, max: 600). Keep it under your MCP client's request timeout (the SDK default is 60 s) — a longer wait is cut off by the client while the server is still polling. On timeout the tool answers status "pending"; call it again with the same identifier.`),
+    }, async ({ token, timeout_seconds }) => {
+        try {
+            return await pollUntilTerminal(() => http.get(`/api/v1/hitl/chat-id-discovery/${encodeURIComponent(token)}`), ['completed', 'expired'], timeout_seconds ?? WAIT_DEFAULT_SECONDS, `chat ID discovery ${token}`);
+        }
+        catch (e) {
+            if (e instanceof ApiError)
+                return errorResult(`${e.code}: ${e.message}`);
+            throw e;
+        }
+    });
+}
+//# sourceMappingURL=hitl.js.map