@raytio/mcp-server 9.1.0 → 9.2.0

package/README.md

@@ -14,6 +14,8 @@ This server exposes Raytio platform capabilities to AI agents via MCP. Tools are
 | **PPM** — Project & Program Management | Read and update Raytio work items and activities with semantic status transitions. |
 | **PRM** — Party Relationship Management | Manage parties (organisations, groups, and people) that the business entity interacts with. |
 | **WRM** — Worker Relationship Management | Manage AI worker identities, model stacks, MCP tool registrations, roles, role memories, and agent run steps/artifacts. |
+| **FXM** — Funds Transfer Management | Bounded reads over funds accounts, balances, transactions, statuses, parties, access consents, and external payer payment methods (card / IBAN / fingerprint columns redacted; payment-processor credentials hard-excluded upstream); dedicated tools for registering / deactivating payment methods and granting / revoking funds-account access consents. |
+| **CMM** — Cash Management Module | Bounded reads over bank accounts and their operating-unit uses (bank-account-number / IBAN redacted); dedicated tools for registering / deactivating bank accounts and enabling AR / AP / payroll / treasury uses. |
 
 All user data flowing through DSM is encrypted end-to-end using Raytio's Maxcryptor system (AES-256-GCM + WADEK key wrapping).
 

package/dist/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG3C;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAkD3C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,YAAsB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAqE9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,IAAI,EAAE,EACtB,YAAY,EAAE,wBAAwB,EACtC,MAAM,GAAE,YAAsB,GAC7B,IAAI,EAAE,CA8BR"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG3C;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAoD3C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,YAAsB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAqE9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,IAAI,EAAE,EACtB,YAAY,EAAE,wBAAwB,EACtC,MAAM,GAAE,YAAsB,GAC7B,IAAI,EAAE,CA8BR"}

package/dist/authorization.js

@@ -12,6 +12,8 @@ const READONLY_PARENTS = {
     'sfa-readonly': 'sfa',
     'fgl-readonly': 'fgl',
     'fnd-readonly': 'fnd',
+    'fxm-readonly': 'fxm',
+    'cmm-readonly': 'cmm',
 };
 function parseSpec(spec) {
     if (!spec)

package/dist/authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAwB7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,SAAS,SAAS,CAAC,IAA+B;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,aAAuB,EACvB,WAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B,EAC1B,OAA2B,EAC3B,SAAuB,OAAO;IAE9B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,qCAAqC,CAC5F,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,YAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,wBAAwB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,4CAA4C,MAAM,EAAE,CAAC;QACpE,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,KAAK,CACV,uBAAuB,YAAY,CAAC,IAAI,mDAAmD,CAC5F,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,IAAI;YAChB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CACV,iEAAiE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CACrG,CAAC;IACF,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,IAAI;QAChB,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAsB,EACtB,YAAsC,EACtC,SAAuB,OAAO;IAE9B,MAAM,OAAO,GAAW,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,EAAE,CACpF;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,CAAC,KAAK,CACV,4BAA4B,IAAI,CAAC,IAAI,2BAA2B,MAAM,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,qCAAqC,MAAM,IAAI,KAAK,CAAC,MAAM,QAAQ,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAwB7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,SAAS,SAAS,CAAC,IAA+B;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,aAAuB,EACvB,WAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B,EAC1B,OAA2B,EAC3B,SAAuB,OAAO;IAE9B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,qCAAqC,CAC5F,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,YAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,wBAAwB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,4CAA4C,MAAM,EAAE,CAAC;QACpE,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,KAAK,CACV,uBAAuB,YAAY,CAAC,IAAI,mDAAmD,CAC5F,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,IAAI;YAChB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CACV,iEAAiE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CACrG,CAAC;IACF,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,IAAI;QAChB,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAsB,EACtB,YAAsC,EACtC,SAAuB,OAAO;IAE9B,MAAM,OAAO,GAAW,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,EAAE,CACpF;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,CAAC,KAAK,CACV,4BAA4B,IAAI,CAAC,IAAI,2BAA2B,MAAM,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,qCAAqC,MAAM,IAAI,KAAK,CAAC,MAAM,QAAQ,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/generated-reads/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/generated-reads/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,2CAA2C,CAAC;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAIvD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAqB,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAerD,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEjE;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAIrE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,WAAW,GACX,YAAY,GACZ,cAAc,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,kBAAuB,GAC/B,mBAAmB,CASrB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAe3E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAQtC;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAE5C"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/generated-reads/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,2CAA2C,CAAC;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAIvD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAqB,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAwBrD,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEjE;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAIrE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,WAAW,GACX,YAAY,GACZ,cAAc,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,kBAAuB,GAC/B,mBAAmB,CASrB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAe3E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAQtC;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAE5C"}

package/dist/generated-reads/guardrails.js

@@ -74,6 +74,15 @@ export const SENSITIVE_FIELD_PATTERNS = [
     /(^|_)credentials?$/i,
     /(^|_)cvv$/i,
     /(^|_)pin(_hash)?$/i,
+    // WI-0003505 (FXM/CMM): bank account and card secrets. Full account /
+    // card numbers, IBAN, and card fingerprints uniquely identify a payment
+    // instrument and must never leave the server. `card_last_4_digits` is
+    // intentionally PCI-safe display data and is NOT matched — the pattern
+    // requires `card_number` exactly, and IBAN/fingerprint are self-contained.
+    /(^|_)bank_account_number$/i,
+    /(^|_)card_number$/i,
+    /(^|_)card_fingerprint$/i,
+    /^iban$/i,
 ];
 /** `true` when the resource's declared sensitivity is `sensitive` or `restricted`. */
 export function isSensitiveResource(resource) {

package/dist/generated-reads/guardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/generated-reads/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,iCAAiC;IACjC,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,oBAAoB;IACpB,8BAA8B;IAC9B,qBAAqB;IACrB,YAAY;IACZ,oBAAoB;CACrB,CAAC;AAEF,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAyB;IACtD,OAAO,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,MAAM;SACnB,GAAG,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,OAAO,QAAQ,CAAC,MAAM;SACnB,GAAG,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAsCD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,WAAW,KAAK,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAClD,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC,CACxC,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5E,oEAAoE;QACpE,sCAAsC;QACtC,OAAO;IACT,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,qEAAqE;IACrE,6BAA6B;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAI,GAAM;IACjC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC9E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAI,IAAS;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/generated-reads/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,iCAAiC;IACjC,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,oBAAoB;IACpB,8BAA8B;IAC9B,qBAAqB;IACrB,YAAY;IACZ,oBAAoB;IACpB,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,4BAA4B;IAC5B,oBAAoB;IACpB,yBAAyB;IACzB,SAAS;CACV,CAAC;AAEF,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAyB;IACtD,OAAO,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,MAAM;SACnB,GAAG,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,OAAO,QAAQ,CAAC,MAAM;SACnB,GAAG,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAsCD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,WAAW,KAAK,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAClD,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC,CACxC,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5E,oEAAoE;QACpE,sCAAsC;QACtC,OAAO;IACT,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,qEAAqE;IACrE,6BAA6B;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAI,GAAM;IACjC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC9E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAI,IAAS;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC"}

package/dist/tools/_shared/side-effect.d.ts

@@ -3,13 +3,14 @@ import { z } from 'zod';
  * Shared side-effect helpers for MCP write tools.
  *
  * Every side-effecting tool — command dispatch, provisioning, external
- * sync, outbound communication, permission grant — needs the same three
- * primitives so the caller contract is predictable across modules:
+ * sync, outbound communication, permission grant, payment/settlement —
+ * needs the same three primitives so the caller contract is predictable
+ * across modules:
  *
  *  - `confirm: true` on consequential paths so a model cannot invoke
  *    them accidentally;
  *  - a caller-supplied `reason` on state transitions that leave an
- *    audit trail (revoke, unassign, cancel);
+ *    audit trail (revoke, unassign, deactivate, cancel);
  *  - an optional `idempotency_key` forwarded as an `Idempotency-Key`
  *    header so retries converge on the original result rather than
  *    creating a duplicate row / grant / message.

package/dist/tools/_shared/side-effect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"side-effect.d.ts","sourceRoot":"","sources":["../../../src/tools/_shared/side-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,oBAAoB,4BAa9B,CAAC;AAEJ;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED,eAAO,MAAM,iBAAiB,oBAY3B,CAAC;AAEJ,eAAO,MAAM,YAAY,aAG2B,CAAC"}
+{"version":3,"file":"side-effect.d.ts","sourceRoot":"","sources":["../../../src/tools/_shared/side-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,oBAAoB,4BAa9B,CAAC;AAEJ;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED,eAAO,MAAM,iBAAiB,oBAY3B,CAAC;AAEJ,eAAO,MAAM,YAAY,aAG2B,CAAC"}

package/dist/tools/_shared/side-effect.js

@@ -3,13 +3,14 @@ import { z } from 'zod';
  * Shared side-effect helpers for MCP write tools.
  *
  * Every side-effecting tool — command dispatch, provisioning, external
- * sync, outbound communication, permission grant — needs the same three
- * primitives so the caller contract is predictable across modules:
+ * sync, outbound communication, permission grant, payment/settlement —
+ * needs the same three primitives so the caller contract is predictable
+ * across modules:
  *
  *  - `confirm: true` on consequential paths so a model cannot invoke
  *    them accidentally;
  *  - a caller-supplied `reason` on state transitions that leave an
- *    audit trail (revoke, unassign, cancel);
+ *    audit trail (revoke, unassign, deactivate, cancel);
  *  - an optional `idempotency_key` forwarded as an `Idempotency-Key`
  *    header so retries converge on the original result rather than
  *    creating a duplicate row / grant / message.
@@ -51,8 +52,8 @@ export const confirmFlagSchema = z
     }),
 })
     .describe('Must be `true` to execute. Present so a model cannot accidentally grant a ' +
-    'permission, revoke a role, or transition a security session without an ' +
-    'explicit confirmation step.');
+    'permission, revoke a role, register a payment instrument, or transition a ' +
+    'security session without an explicit confirmation step.');
 export const reasonSchema = z
     .string()
     .min(4, 'reason must be at least 4 characters')

package/dist/tools/_shared/side-effect.js.map

@@ -1 +1 @@
-{"version":3,"file":"side-effect.js","sourceRoot":"","sources":["../../../src/tools/_shared/side-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,qBAAqB,EACrB,qFAAqF,CACtF;KACA,QAAQ,EAAE;KACV,QAAQ,CACP,iFAAiF;IAC/E,4EAA4E;IAC5E,+CAA+C,CAClD,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,cAAkC;IAElC,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,OAAO,CAAC,IAAI,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EACL,oFAAoF;YAClF,6BAA6B;KAClC,CAAC;CACH,CAAC;KACD,QAAQ,CACP,4EAA4E;IAC1E,yEAAyE;IACzE,6BAA6B,CAChC,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sCAAsC,CAAC;KAC9C,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC"}
+{"version":3,"file":"side-effect.js","sourceRoot":"","sources":["../../../src/tools/_shared/side-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,qBAAqB,EACrB,qFAAqF,CACtF;KACA,QAAQ,EAAE;KACV,QAAQ,CACP,iFAAiF;IAC/E,4EAA4E;IAC5E,+CAA+C,CAClD,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,cAAkC;IAElC,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,OAAO,CAAC,IAAI,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EACL,oFAAoF;YAClF,6BAA6B;KAClC,CAAC;CACH,CAAC;KACD,QAAQ,CACP,4EAA4E;IAC1E,4EAA4E;IAC5E,yDAAyD,CAC5D,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sCAAsC,CAAC;KAC9C,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC"}

package/dist/tools/_shared/soft-deactivate.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+import { ToolContext } from '../registry.js';
+import { ToolResponse } from '../types.js';
+type Row = Record<string, any>;
+/**
+ * `end_date` input for soft-deactivate tools. Persist views only return
+ * rows where `start_date <= now() AND end_date > now()`, so ending a
+ * record's validity removes it from every read, including history.
+ * Deactivation therefore uses `active = false` and leaves `end_date`
+ * alone unless the caller explicitly asks for it.
+ */
+export declare const softDeactivateEndDateSchema: z.ZodOptional<z.ZodString>;
+export interface SoftDeactivateOptions {
+    /** PostgREST resource, e.g. `cmm_bank_accounts`. */
+    table: string;
+    id: string;
+    /** Human label used in error messages, e.g. `CMM bank account`. */
+    label: string;
+    /** Verb used in failure messages, e.g. `deactivate`. */
+    verb: string;
+    /** `true` when the row is already in the target state; the tool then returns it unchanged. */
+    isDone: (row: Row) => boolean;
+    /** Fields to set, computed from the current row. */
+    changes: (row: Row) => Record<string, unknown>;
+    /** Metadata key the caller's reason is stored under. */
+    reasonKey: string;
+    reason: string;
+    endDate?: string;
+    idempotencyKey?: string;
+    /** Shapes the returned row, e.g. `redactRow`. */
+    present?: (row: Row) => unknown;
+}
+/**
+ * Read-then-patch soft deactivation shared by revoke / deactivate tools.
+ *
+ * Reading first lets the tool merge the reason into the existing
+ * `metadata` instead of replacing it, and makes retries converge: a row
+ * already in the target state is returned as-is, so a repeat call keeps
+ * the original reason rather than overwriting it.
+ */
+export declare function softDeactivate(ctx: ToolContext, opts: SoftDeactivateOptions): Promise<ToolResponse<unknown>>;
+export {};
+//# sourceMappingURL=soft-deactivate.d.ts.map

package/dist/tools/_shared/soft-deactivate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soft-deactivate.d.ts","sourceRoot":"","sources":["../../../src/tools/_shared/soft-deactivate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAa,YAAY,EAAkC,MAAM,aAAa,CAAC;AAGtF,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAE/B;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,4BAOrC,CAAC;AAEJ,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;IAC9B,oDAAoD;IACpD,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAwBhC"}

package/dist/tools/_shared/soft-deactivate.js

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { writeHeadersWithIdempotency } from './side-effect.js';
+/**
+ * `end_date` input for soft-deactivate tools. Persist views only return
+ * rows where `start_date <= now() AND end_date > now()`, so ending a
+ * record's validity removes it from every read, including history.
+ * Deactivation therefore uses `active = false` and leaves `end_date`
+ * alone unless the caller explicitly asks for it.
+ */
+export const softDeactivateEndDateSchema = z
+    .string()
+    .min(1)
+    .optional()
+    .describe('Optional ISO 8601 date the record stops being valid. Leave unset to keep the record ' +
+    'visible as inactive; an end_date at or before now hides the record from every read.');
+/**
+ * Read-then-patch soft deactivation shared by revoke / deactivate tools.
+ *
+ * Reading first lets the tool merge the reason into the existing
+ * `metadata` instead of replacing it, and makes retries converge: a row
+ * already in the target state is returned as-is, so a repeat call keeps
+ * the original reason rather than overwriting it.
+ */
+export async function softDeactivate(ctx, opts) {
+    const present = opts.present ?? ((row) => row);
+    const notFound = () => errorResponse(API_ERROR, `${opts.label} ${opts.id} not found or not accessible`);
+    const resource = `${ctx.apiClient.dbBasePath}/${opts.table}?id=eq.${opts.id}`;
+    try {
+        const current = await ctx.apiClient.get(`${resource}&select=*`);
+        if (!current || current.length === 0)
+            return notFound();
+        const row = current[0];
+        if (opts.isDone(row))
+            return successResponse(present(row));
+        const body = {
+            ...opts.changes(row),
+            metadata: { ...(row.metadata ?? {}), [opts.reasonKey]: opts.reason },
+        };
+        if (opts.endDate !== undefined)
+            body.end_date = opts.endDate;
+        const rows = await ctx.apiClient.patch(`${resource}&select=*`, body, {
+            headers: writeHeadersWithIdempotency(opts.idempotencyKey),
+        });
+        if (!rows || rows.length === 0)
+            return notFound();
+        return successResponse(present(rows[0]));
+    }
+    catch (error) {
+        return errorResponse(API_ERROR, `Failed to ${opts.verb} ${opts.label}: ${error.message}`);
+    }
+}
+//# sourceMappingURL=soft-deactivate.js.map

package/dist/tools/_shared/soft-deactivate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soft-deactivate.js","sourceRoot":"","sources":["../../../src/tools/_shared/soft-deactivate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAgB,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAI/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,QAAQ,EAAE;KACV,QAAQ,CACP,sFAAsF;IACpF,qFAAqF,CACxF,CAAC;AAuBJ;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgB,EAChB,IAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAQ,GAAG,QAAQ,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3D,MAAM,IAAI,GAA4B;YACpC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YACpB,QAAQ,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE;SACrE,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAQ,GAAG,QAAQ,WAAW,EAAE,IAAI,EAAE;YAC1E,OAAO,EAAE,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,EAAE,CAAC;QAClD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,aAAa,CAAC,SAAS,EAAE,aAAa,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/tools/cmm/cmm-bank-account-deactivate.d.ts

@@ -0,0 +1,14 @@
+import { Tool } from '../registry.js';
+/**
+ * Deactivate a bank account (`cmm_bank_accounts`).
+ *
+ * Soft-delete via `active=false`; the caller `reason` is merged into the
+ * row's `metadata` audit trail. Requires `confirm: true`. Downstream
+ * FAR/FAP/CMM flows must stop selecting the row via the `active` filter;
+ * the row itself is retained for history. An already inactive account
+ * is returned unchanged, so retries keep the original reason.
+ *
+ * Response is redacted (bank_account_number / iban stripped).
+ */
+export declare const cmmBankAccountDeactivateTool: Tool;
+//# sourceMappingURL=cmm-bank-account-deactivate.d.ts.map

package/dist/tools/cmm/cmm-bank-account-deactivate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmm-bank-account-deactivate.d.ts","sourceRoot":"","sources":["../../../src/tools/cmm/cmm-bank-account-deactivate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,IAyC1C,CAAC"}

package/dist/tools/cmm/cmm-bank-account-deactivate.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { cap } from '../../capabilities/tool-capability.js';
+import { redactRow } from '../../generated-reads/guardrails.js';
+import { confirmFlagSchema, idempotencyKeySchema, reasonSchema, } from '../_shared/side-effect.js';
+import { softDeactivate, softDeactivateEndDateSchema } from '../_shared/soft-deactivate.js';
+/**
+ * Deactivate a bank account (`cmm_bank_accounts`).
+ *
+ * Soft-delete via `active=false`; the caller `reason` is merged into the
+ * row's `metadata` audit trail. Requires `confirm: true`. Downstream
+ * FAR/FAP/CMM flows must stop selecting the row via the `active` filter;
+ * the row itself is retained for history. An already inactive account
+ * is returned unchanged, so retries keep the original reason.
+ *
+ * Response is redacted (bank_account_number / iban stripped).
+ */
+export const cmmBankAccountDeactivateTool = {
+    name: 'cmm_bank_account_deactivate',
+    description: 'Deactivate a bank account (cmm_bank_accounts). Sets active=false and records the reason ' +
+        'on the audit trail. Requires confirm=true and a `reason`. Retry-safe: an already inactive ' +
+        'account is returned unchanged.',
+    inputSchema: z.object({
+        id: z.string().min(1).describe('UUID of the cmm_bank_accounts row to deactivate'),
+        reason: reasonSchema.describe('Human-readable justification recorded on the audit trail'),
+        end_date: softDeactivateEndDateSchema,
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('cmm_bank_accounts', 'UPDATE')],
+    sideEffect: 'state_change',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        return softDeactivate(ctx, {
+            table: 'cmm_bank_accounts',
+            id: input.id,
+            label: 'CMM bank account',
+            verb: 'deactivate',
+            isDone: (row) => row.active === false,
+            changes: () => ({ active: false }),
+            reasonKey: 'deactivation_reason',
+            reason: input.reason,
+            endDate: input.end_date,
+            idempotencyKey: input.idempotency_key,
+            present: redactRow,
+        });
+    },
+};
+//# sourceMappingURL=cmm-bank-account-deactivate.js.map

package/dist/tools/cmm/cmm-bank-account-deactivate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmm-bank-account-deactivate.js","sourceRoot":"","sources":["../../../src/tools/cmm/cmm-bank-account-deactivate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAS;IAChD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,0FAA0F;QAC1F,4FAA4F;QAC5F,gCAAgC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QACjF,MAAM,EAAE,YAAY,CAAC,QAAQ,CAC3B,0DAA0D,CAC3D;QACD,QAAQ,EAAE,2BAA2B;QACrC,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAClD,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAMb,CAAC;QACF,OAAO,cAAc,CAAC,GAAG,EAAE;YACzB,KAAK,EAAE,mBAAmB;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;YACrC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAClC,SAAS,EAAE,qBAAqB;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,cAAc,EAAE,KAAK,CAAC,eAAe;YACrC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/tools/cmm/cmm-bank-account-register.d.ts

@@ -0,0 +1,15 @@
+import { Tool } from '../registry.js';
+/**
+ * Register a bank account (`cmm_bank_accounts`) at the legal-entity
+ * level.
+ *
+ * Provisioning: creates a bank-account row that downstream FAR/FAP/CMM
+ * flows will attach payments to. Requires `confirm: true` because the
+ * row carries a full account number and IBAN — the guardrail redacts
+ * these from any response, so a caller registering an account cannot
+ * even read back the value they just supplied. Persist enforces a unique
+ * `(tenant_id, bank_account_number)` index, so a repeat registration fails
+ * with a conflict instead of creating a second account.
+ */
+export declare const cmmBankAccountRegisterTool: Tool;
+//# sourceMappingURL=cmm-bank-account-register.d.ts.map

package/dist/tools/cmm/cmm-bank-account-register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmm-bank-account-register.d.ts","sourceRoot":"","sources":["../../../src/tools/cmm/cmm-bank-account-register.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,IA+FxC,CAAC"}

package/dist/tools/cmm/cmm-bank-account-register.js

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { redactRow } from '../../generated-reads/guardrails.js';
+import { confirmFlagSchema, idempotencyKeySchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Register a bank account (`cmm_bank_accounts`) at the legal-entity
+ * level.
+ *
+ * Provisioning: creates a bank-account row that downstream FAR/FAP/CMM
+ * flows will attach payments to. Requires `confirm: true` because the
+ * row carries a full account number and IBAN — the guardrail redacts
+ * these from any response, so a caller registering an account cannot
+ * even read back the value they just supplied. Persist enforces a unique
+ * `(tenant_id, bank_account_number)` index, so a repeat registration fails
+ * with a conflict instead of creating a second account.
+ */
+export const cmmBankAccountRegisterTool = {
+    name: 'cmm_bank_account_register',
+    description: 'Register a bank account (cmm_bank_accounts). Stores the account details at the ' +
+        'legal-entity level. Requires confirm=true. bank_account_number is unique per tenant: ' +
+        'registering an existing number fails with a conflict rather than creating a duplicate. ' +
+        'Response is redacted (bank_account_number/iban removed).',
+    inputSchema: z.object({
+        account_owner_party_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the party (legal entity) that owns the account'),
+        bank_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the bank (a prm_parties row) the account is held at'),
+        bank_branch_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the bank branch (a prm_parties row)'),
+        bank_account_name: z
+            .string()
+            .min(1)
+            .max(255)
+            .describe('Human-readable account label'),
+        bank_account_number: z
+            .string()
+            .min(1)
+            .max(64)
+            .describe('Bank-issued account number. Redacted from every read; supplied on register only.'),
+        currency_code: z
+            .string()
+            .regex(/^[A-Z]{3}$/, 'currency_code must be a 3-letter uppercase ISO 4217 code'),
+        account_classification: z.string().max(64).optional(),
+        account_type: z.string().max(64).optional(),
+        account_holder_id: z.string().min(1).optional(),
+        account_holder_name: z.string().max(255).optional(),
+        iban: z
+            .string()
+            .min(15)
+            .max(34)
+            .regex(/^[A-Z0-9]+$/, 'IBAN must be uppercase alphanumeric')
+            .optional()
+            .describe('International Bank Account Number. Redacted from every read.'),
+        description: z.string().max(500).optional(),
+        start_date: z.string().min(1).optional().describe('ISO 8601 effective start'),
+        end_date: z.string().min(1).optional().describe('ISO 8601 planned end date'),
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema.describe('Optional. Forwarded as an Idempotency-Key header, but Persist does not enforce it ' +
+            'yet; duplicates are prevented by the unique index instead.'),
+    }),
+    capabilities: [cap('cmm_bank_accounts', 'INSERT')],
+    sideEffect: 'provisioning',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            account_owner_party_id: input.account_owner_party_id,
+            bank_id: input.bank_id,
+            bank_branch_id: input.bank_branch_id,
+            bank_account_name: input.bank_account_name,
+            bank_account_number: input.bank_account_number,
+            currency_code: input.currency_code,
+        };
+        for (const field of [
+            'account_classification',
+            'account_type',
+            'account_holder_id',
+            'account_holder_name',
+            'iban',
+            'description',
+            'start_date',
+            'end_date',
+        ]) {
+            if (input[field] !== undefined)
+                body[field] = input[field];
+        }
+        try {
+            const rows = await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/cmm_bank_accounts?select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            return successResponse(redactRow(rows[0]));
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to register CMM bank account: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=cmm-bank-account-register.js.map

package/dist/tools/cmm/cmm-bank-account-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmm-bank-account-register.js","sourceRoot":"","sources":["../../../src/tools/cmm/cmm-bank-account-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAS;IAC9C,IAAI,EAAE,2BAA2B;IACjC,WAAW,EACT,iFAAiF;QACjF,uFAAuF;QACvF,yFAAyF;QACzF,0DAA0D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,sBAAsB,EAAE,CAAC;aACtB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,wDAAwD,CAAC;QACrE,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,6DAA6D,CAAC;QAC1E,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,iBAAiB,EAAE,CAAC;aACjB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,CAAC,8BAA8B,CAAC;QAC3C,mBAAmB,EAAE,CAAC;aACnB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,CACP,kFAAkF,CACnF;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,KAAK,CAAC,YAAY,EAAE,0DAA0D,CAAC;QAClF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACnD,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,EAAE,CAAC;aACP,GAAG,CAAC,EAAE,CAAC;aACP,KAAK,CAAC,aAAa,EAAE,qCAAqC,CAAC;aAC3D,QAAQ,EAAE;aACV,QAAQ,CAAC,8DAA8D,CAAC;QAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC5E,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAC5C,oFAAoF;YAClF,4DAA4D,CAC/D;KACF,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAClD,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,MAAM,IAAI,GAAwB;YAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,MAAM,KAAK,IAAI;YAClB,wBAAwB;YACxB,cAAc;YACd,mBAAmB;YACnB,qBAAqB;YACrB,MAAM;YACN,aAAa;YACb,YAAY;YACZ,UAAU;SACX,EAAE,CAAC;YACF,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,6BAA6B,EACxD,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,wCAAwC,KAAK,CAAC,OAAO,EAAE,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/cmm/cmm-bank-account-use-register.d.ts

@@ -0,0 +1,13 @@
+import { Tool } from '../registry.js';
+/**
+ * Register a bank-account use (`cmm_bank_account_uses`).
+ *
+ * Enabling AR / AP / payroll / treasury on a bank account is what turns
+ * a stored account into a live target for FAR receipts, FAP payments,
+ * or payroll disbursements. Requires `confirm: true` because a
+ * mis-enabled use routes money to the wrong instrument. Persist enforces
+ * a unique `(tenant_id, org_id, bank_account_id)` index, so a repeat
+ * registration fails with a conflict instead of creating a second use.
+ */
+export declare const cmmBankAccountUseRegisterTool: Tool;
+//# sourceMappingURL=cmm-bank-account-use-register.d.ts.map

package/dist/tools/cmm/cmm-bank-account-use-register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmm-bank-account-use-register.d.ts","sourceRoot":"","sources":["../../../src/tools/cmm/cmm-bank-account-use-register.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAStC;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,EAAE,IAgE3C,CAAC"}

package/dist/tools/cmm/cmm-bank-account-use-register.js

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Register a bank-account use (`cmm_bank_account_uses`).
+ *
+ * Enabling AR / AP / payroll / treasury on a bank account is what turns
+ * a stored account into a live target for FAR receipts, FAP payments,
+ * or payroll disbursements. Requires `confirm: true` because a
+ * mis-enabled use routes money to the wrong instrument. Persist enforces
+ * a unique `(tenant_id, org_id, bank_account_id)` index, so a repeat
+ * registration fails with a conflict instead of creating a second use.
+ */
+export const cmmBankAccountUseRegisterTool = {
+    name: 'cmm_bank_account_use_register',
+    description: 'Register a bank-account use (cmm_bank_account_uses) — enables AR/AP/payroll/treasury ' +
+        'on a stored account. Requires confirm=true. (org_id, bank_account_id) is unique: ' +
+        'registering it again fails with a conflict rather than creating a duplicate.',
+    inputSchema: z.object({
+        bank_account_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the cmm_bank_accounts row this use attaches to'),
+        org_id: z
+            .string()
+            .min(1)
+            .optional()
+            .describe('UUID of the owning organisation (hrm_organizations_c)'),
+        ap_use_enabled: z.boolean().optional().describe('Enable accounts-payable outflows'),
+        ar_use_enabled: z.boolean().optional().describe('Enable accounts-receivable receipts'),
+        payroll_use_enabled: z.boolean().optional().describe('Enable payroll disbursements'),
+        treasury_use_enabled: z.boolean().optional().describe('Enable treasury operations'),
+        primary_flag: z.boolean().optional().describe('Mark as the org\'s primary bank account'),
+        pooled_account: z.boolean().optional().describe('Treat as a pooled/shared account'),
+        start_date: z.string().min(1).optional().describe('ISO 8601 effective start'),
+        end_date: z.string().min(1).optional().describe('ISO 8601 planned end date'),
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema.describe('Optional. Forwarded as an Idempotency-Key header, but Persist does not enforce it ' +
+            'yet; duplicates are prevented by the unique index instead.'),
+    }),
+    capabilities: [cap('cmm_bank_account_uses', 'INSERT')],
+    sideEffect: 'provisioning',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = { bank_account_id: input.bank_account_id };
+        for (const field of [
+            'org_id',
+            'ap_use_enabled',
+            'ar_use_enabled',
+            'payroll_use_enabled',
+            'treasury_use_enabled',
+            'primary_flag',
+            'pooled_account',
+            'start_date',
+            'end_date',
+        ]) {
+            if (input[field] !== undefined)
+                body[field] = input[field];
+        }
+        try {
+            const rows = await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/cmm_bank_account_uses?select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to register CMM bank account use: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=cmm-bank-account-use-register.js.map

package/dist/tools/cmm/cmm-bank-account-use-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmm-bank-account-use-register.js","sourceRoot":"","sources":["../../../src/tools/cmm/cmm-bank-account-use-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAS;IACjD,IAAI,EAAE,+BAA+B;IACrC,WAAW,EACT,uFAAuF;QACvF,mFAAmF;QACnF,8EAA8E;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC;aACf,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,wDAAwD,CAAC;QACrE,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,uDAAuD,CAAC;QACpE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACnF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACtF,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACpF,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACnF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;QACxF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACnF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC5E,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAC5C,oFAAoF;YAClF,4DAA4D,CAC/D;KACF,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,MAAM,IAAI,GAAwB,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7E,KAAK,MAAM,KAAK,IAAI;YAClB,QAAQ;YACR,gBAAgB;YAChB,gBAAgB;YAChB,qBAAqB;YACrB,sBAAsB;YACtB,cAAc;YACd,gBAAgB;YAChB,YAAY;YACZ,UAAU;SACX,EAAE,CAAC;YACF,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,iCAAiC,EAC5D,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/cmm/generated-reads.d.ts

@@ -0,0 +1,5 @@
+import { Tool } from '../registry.js';
+import { CatalogueReport } from '../../generated-reads/index.js';
+export declare const cmmGeneratedReadReport: CatalogueReport;
+export declare const cmmGeneratedReadTools: Tool[];
+//# sourceMappingURL=generated-reads.d.ts.map

package/dist/tools/cmm/generated-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.d.ts","sourceRoot":"","sources":["../../../src/tools/cmm/generated-reads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAGL,eAAe,EAChB,MAAM,gCAAgC,CAAC;AAuBxC,eAAO,MAAM,sBAAsB,EAAE,eAIjC,CAAC;AAEL,eAAO,MAAM,qBAAqB,EAAE,IAAI,EAGvC,CAAC"}

package/dist/tools/cmm/generated-reads.js

@@ -0,0 +1,26 @@
+import { buildGeneratedReadCatalogue, buildGeneratedReadCatalogueReport, } from '../../generated-reads/index.js';
+import { loadPersistResourceContract } from '../../contracts/persist-resource-contract.js';
+/**
+ * Bounded read tools for the CMM (Cash Management Module) module
+ * (WI-0003505).
+ *
+ * CMM currently exposes two resources — `cmm_bank_accounts` and
+ * `cmm_bank_account_uses` — both classified `sensitive` because a bank
+ * account row carries account numbers / IBAN. The schema-driven read
+ * framework opts them in here so callers can list bank accounts and
+ * their uses, and the sensitive-field guardrail redacts
+ * `bank_account_number` / `iban` / `card_*` before any row leaves the
+ * server (see the WI-0003505 pattern extensions in `guardrails.ts`).
+ *
+ * Every write on either resource goes through a dedicated tool
+ * (`cmm_bank_account_register` / `_deactivate` / `cmm_bank_account_use_register`);
+ * generic CRUD wrappers are refused by the framework for sensitive
+ * resources.
+ */
+const contract = loadPersistResourceContract();
+export const cmmGeneratedReadReport = buildGeneratedReadCatalogueReport(contract, {
+    modules: ['cmm'],
+    includeSensitive: true,
+});
+export const cmmGeneratedReadTools = buildGeneratedReadCatalogue(contract, { modules: ['cmm'], includeSensitive: true });
+//# sourceMappingURL=generated-reads.js.map

package/dist/tools/cmm/generated-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.js","sourceRoot":"","sources":["../../../src/tools/cmm/generated-reads.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAE3F;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAE/C,MAAM,CAAC,MAAM,sBAAsB,GACjC,iCAAiC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAW,2BAA2B,CACtE,QAAQ,EACR,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC7C,CAAC"}