@solongate/core 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -86,6 +86,14 @@ interface PolicyRule {
         readonly allowed?: readonly string[];
         readonly denied?: readonly string[];
     };
+    readonly filenameConstraints?: {
+        readonly allowed?: readonly string[];
+        readonly denied?: readonly string[];
+    };
+    readonly urlConstraints?: {
+        readonly allowed?: readonly string[];
+        readonly denied?: readonly string[];
+    };
     readonly enabled: boolean;
     readonly createdAt: string;
     readonly updatedAt: string;
@@ -138,6 +146,26 @@ declare const PolicyRuleSchema: z.ZodObject<{
         allowed?: string[] | undefined;
         denied?: string[] | undefined;
     }>>;
+    filenameConstraints: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    }, {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    }>>;
+    urlConstraints: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    }, {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    }>>;
     enabled: z.ZodDefault<z.ZodBoolean>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
@@ -163,6 +191,14 @@ declare const PolicyRuleSchema: z.ZodObject<{
         allowed?: string[] | undefined;
         denied?: string[] | undefined;
     } | undefined;
+    filenameConstraints?: {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    } | undefined;
+    urlConstraints?: {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    } | undefined;
 }, {
     id: string;
     description: string;
@@ -184,6 +220,14 @@ declare const PolicyRuleSchema: z.ZodObject<{
         allowed?: string[] | undefined;
         denied?: string[] | undefined;
     } | undefined;
+    filenameConstraints?: {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    } | undefined;
+    urlConstraints?: {
+        allowed?: string[] | undefined;
+        denied?: string[] | undefined;
+    } | undefined;
     enabled?: boolean | undefined;
 }>;
 declare const PolicySetSchema: z.ZodObject<{
@@ -226,6 +270,26 @@ declare const PolicySetSchema: z.ZodObject<{
             allowed?: string[] | undefined;
             denied?: string[] | undefined;
         }>>;
+        filenameConstraints: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        }, {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        }>>;
+        urlConstraints: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        }, {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        }>>;
         enabled: z.ZodDefault<z.ZodBoolean>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
@@ -251,6 +315,14 @@ declare const PolicySetSchema: z.ZodObject<{
             allowed?: string[] | undefined;
             denied?: string[] | undefined;
         } | undefined;
+        filenameConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
+        urlConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
     }, {
         id: string;
         description: string;
@@ -272,6 +344,14 @@ declare const PolicySetSchema: z.ZodObject<{
             allowed?: string[] | undefined;
             denied?: string[] | undefined;
         } | undefined;
+        filenameConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
+        urlConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
         enabled?: boolean | undefined;
     }>, "many">;
     createdAt: z.ZodString;
@@ -305,6 +385,14 @@ declare const PolicySetSchema: z.ZodObject<{
             allowed?: string[] | undefined;
             denied?: string[] | undefined;
         } | undefined;
+        filenameConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
+        urlConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
     }[];
 }, {
     name: string;
@@ -334,6 +422,14 @@ declare const PolicySetSchema: z.ZodObject<{
             allowed?: string[] | undefined;
             denied?: string[] | undefined;
         } | undefined;
+        filenameConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
+        urlConstraints?: {
+            allowed?: string[] | undefined;
+            denied?: string[] | undefined;
+        } | undefined;
         enabled?: boolean | undefined;
     }[];
 }>;

package/dist/index.js

@@ -188,6 +188,14 @@ var PolicyRuleSchema = z.object({
     allowed: z.array(z.string()).optional(),
     denied: z.array(z.string()).optional()
   }).optional(),
+  filenameConstraints: z.object({
+    allowed: z.array(z.string()).optional(),
+    denied: z.array(z.string()).optional()
+  }).optional(),
+  urlConstraints: z.object({
+    allowed: z.array(z.string()).optional(),
+    denied: z.array(z.string()).optional()
+  }).optional(),
   enabled: z.boolean().default(true),
   createdAt: z.string().datetime(),
   updatedAt: z.string().datetime()

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/trust.ts","../src/permissions.ts","../src/policy.ts","../src/tool.ts","../src/context.ts","../src/constants.ts","../src/mcp-types.ts","../src/schema-validator.ts","../src/input-guard.ts","../src/capability-token.ts"],"names":["z","maxChildDepth"],"mappings":";;;AAIO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CACE,OAAA,EACA,IAAA,EACA,OAAA,GAAmC,EAAC,EACpC;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACxC,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,SAAS,CAAA;AAC3C,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,GAAkC;AAChC,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AACF;AAGO,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EACpD,WAAA,CACE,QAAA,EACA,MAAA,EACA,OAAA,GAAmC,EAAC,EACpC;AACA,IAAA,KAAA;AAAA,MACE,CAAA,iCAAA,EAAoC,QAAQ,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA;AAAA,MACxD,eAAA;AAAA,MACA,EAAE,QAAA,EAAU,MAAA,EAAQ,GAAG,OAAA;AAAQ,KACjC;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAA,EACvD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,SAAS,kBAAkB,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AAAA,EACd;AACF;AAGO,IAAM,qBAAA,GAAN,cAAoC,cAAA,CAAe;AAAA,EACxD,WAAA,CACE,UACA,gBAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,sCAAsC,QAAQ,CAAA,GAAA,EAAM,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MAC/E,0BAAA;AAAA,MACA,EAAE,UAAU,gBAAA;AAAiB,KAC/B;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,cAAA,CAAe;AAAA,EACjD,WAAA,CAAY,UAAkB,cAAA,EAAwB;AACpD,IAAA,KAAA;AAAA,MACE,CAAA,8BAAA,EAAiC,QAAQ,CAAA,OAAA,EAAU,cAAc,CAAA,IAAA,CAAA;AAAA,MACjE,qBAAA;AAAA,MACA,EAAE,UAAU,cAAA;AAAe,KAC7B;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;AAGO,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EACpD,WAAA,CAAY,UAAkB,UAAA,EAAoB;AAChD,IAAA,KAAA;AAAA,MACE,CAAA,MAAA,EAAS,QAAQ,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,CAAA;AAAA,MACrD,gBAAA;AAAA,MACA,EAAE,UAAU,UAAA;AAAW,KACzB;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAGO,IAAM,wBAAA,GAAN,cAAuC,cAAA,CAAe;AAAA,EAC3D,WAAA,CAAY,SAAiB,KAAA,EAAe;AAC1C,IAAA,KAAA;AAAA,MACE,kCAAkC,OAAO,CAAA,CAAA;AAAA,MACzC,sBAAA;AAAA,MACA,EAAE,KAAA;AAAM,KACV;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CACE,UACA,OAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,QAAQ,CAAA,GAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,WAAW,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MACrF,qBAAA;AAAA,MACA,EAAE,QAAA,EAAU,WAAA,EAAa,OAAA,CAAQ,QAAQ,OAAA;AAAQ,KACnD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAGO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CACE,SAAA,EACA,UAAA,EACA,OAAA,GAAmC,EAAC,EACpC;AACA,IAAA,KAAA;AAAA,MACE,wBAAwB,SAAS,CAAA,EAAG,aAAa,CAAA,OAAA,EAAU,UAAU,MAAM,EAAE,CAAA,CAAA;AAAA,MAC7E,eAAA;AAAA,MACA,EAAE,SAAA,EAAW,UAAA,EAAY,GAAG,OAAA;AAAQ,KACtC;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF;;;AChIO,IAAM,UAAA,GAAa;AAAA,EACxB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,OAAA,EAAS;AACX;AAQO,SAAS,kBAAkB,KAAA,EAAqC;AACrE,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,MAAA,CAAO,OAAO,UAAU,CAAA,CAAE,SAAS,KAAmB,CAAA;AAE1D;AAOO,SAAS,qBAAA,CACd,MACA,EAAA,EACM;AACN,EAAA,IAAI,EAAA,KAAO,WAAW,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,oBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,IAAA,KAAS,UAAA,CAAW,QAAA,IAAY,EAAA,KAAO,WAAW,SAAA,EAAW;AAC/D,IAAA;AAAA,EACF;AACA,EAAA,IAAI,IAAA,KAAS,UAAA,CAAW,SAAA,IAAa,EAAA,KAAO,WAAW,QAAA,EAAU;AAC/D,IAAA;AAAA,EACF;AACA,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA;AAAA,EACF;AACA,EAAA,MAAM,IAAI,oBAAA;AAAA,IACR,CAAA,8BAAA,EAAiC,IAAI,CAAA,IAAA,EAAO,EAAE,CAAA;AAAA,GAChD;AACF;ACpDO,IAAM,UAAA,GAAa;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,KAAA,EAAO,OAAA;AAAA,EACP,OAAA,EAAS;AACX;AAIO,IAAM,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAC;AAM5D,SAAS,oBACd,WAAA,EACe;AACf,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAI,IAAI,WAAW,CAAA;AAC5B;AAGO,IAAM,iBAAgC,MAAA,CAAO,MAAA;AAAA,sBAC9C,GAAA;AACN;AAGO,IAAM,YAA2B,MAAA,CAAO,MAAA;AAAA,kBAC7C,IAAI,GAAA,CAAgB,CAAC,UAAA,CAAW,IAAI,CAAC;AACvC;AAEO,SAAS,aAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,WAAA,CAAY,IAAI,QAAQ,CAAA;AACjC;AAEO,SAAS,iBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,SAAS,KAAA,CAAM,CAAC,MAAM,WAAA,CAAY,GAAA,CAAI,CAAC,CAAC,CAAA;AACjD;AAGO,SAAS,oBAAoB,MAAA,EAA4B;AAC9D,EAAA,IACE,MAAA,CAAO,WAAW,YAAY,CAAA,IAC9B,OAAO,UAAA,CAAW,UAAU,CAAA,IAC5B,MAAA,KAAW,YAAA,EACX;AACA,IAAA,OAAO,UAAA,CAAW,IAAA;AAAA,EACpB;AACA,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,OAAO,UAAA,CAAW,OAAA;AAAA,EACpB;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA;AACpB;AC3DO,IAAM,YAAA,GAAe;AAAA,EAC1B,KAAA,EAAO,OAAA;AAAA,EACP,IAAA,EAAM;AACR;AA+CO,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EACvC,EAAA,EAAIA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAC7B,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,IAAI,CAAA;AAAA,EAChC,QAAQA,CAAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,MAAM,CAAC,CAAA;AAAA,EAChC,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAK,CAAA,CAAE,QAAQ,GAAI,CAAA;AAAA,EACzD,WAAA,EAAaA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACtC,YAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAC,CAAA;AAAA,EAC/C,mBAAmBA,CAAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,UAAA,EAAY,SAAS,CAAC,CAAA;AAAA,EAC9D,qBAAqBA,CAAAA,CAAE,MAAA,CAAOA,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACpD,eAAA,EAAiBA,EACd,MAAA,CAAO;AAAA,IACN,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACtC,QAAQA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACrC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,aAAA,EAAeA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,GACrC,EACA,QAAA,EAAS;AAAA,EACZ,kBAAA,EAAoBA,EACjB,MAAA,CAAO;AAAA,IACN,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACtC,QAAQA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAAS,GACtC,EACA,QAAA,EAAS;AAAA,EACZ,OAAA,EAASA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACjC,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC;AAEM,IAAM,eAAA,GAAkBA,EAAE,MAAA,CAAO;AAAA,EACtC,EAAA,EAAIA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAC7B,IAAA,EAAMA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAC/B,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,IAAI,CAAA;AAAA,EAChC,SAASA,CAAAA,CAAE,MAAA,GAAS,GAAA,EAAI,CAAE,IAAI,CAAC,CAAA;AAAA,EAC/B,KAAA,EAAOA,CAAAA,CAAE,KAAA,CAAM,gBAAgB,CAAA;AAAA,EAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC;;;AChEM,SAAS,qBACd,MAAA,EAEgB;AAChB,EAAA,OAAO;AAAA,IACL,gBAAgB,EAAC;AAAA,IACjB,oBAAoB,EAAC;AAAA,IACrB,cAAA,EAAgB,IAAA;AAAA,IAChB,qBAAA,EAAuB,IAAA;AAAA,IACvB,kBAAA,EAAoB,EAAA;AAAA,IACpB,GAAG;AAAA,GACL;AACF;;;AChBO,SAAS,sBACd,MAAA,EAEiB;AACjB,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,WAAA;AAAA,IACZ,kBAAA,sBAAwB,GAAA,EAAI;AAAA,IAC5B,SAAA,EAAW,IAAA;AAAA,IACX,UAAU,EAAC;AAAA,IACX,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IAClC,GAAG;AAAA,GACL;AACF;;;ACrCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,kBAAA,GAAqB;AAG3B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,oBAAA,GAAuB;AAG7B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,6BAAA,GAAgC;AAGtC,IAAM,yBAAA,GAA4B;AAGlC,IAAM,2BAAA,GAA8B,IAAI,EAAA,GAAK;AAG7C,IAAM,4BAAA,GAA+B;AAKrC,IAAM,sBAAA,GAAyB;AAG/B,IAAM,6BAAA,GAAgC;AAGtC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,yBAAA,GAA4B;AAKlC,IAAM,yBAAA,GAA4B;AAGlC,IAAM,uBAAA,GAA0B;AAGhC,IAAM,qBAAA,GAAwB;AAK9B,IAAM,oBAAA,GAAuB;AAG7B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,6BAAA,GAAgC;AAAA,EAC3C,cAAA,EACE,2FAAA;AAAA,EACF,sBAAA,EACE,oFAAA;AAAA,EACF,kBAAA,EACE,6EAAA;AAAA,EACF,sBAAA,EACE,iFAAA;AAAA,EACF,eAAA,EACE,yFAAA;AAAA,EACF,mBAAA,EACE;AACJ;;;AC7CO,SAAS,uBACd,MAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACnB,KAAA,EAAO,eAAA;AAAA,UACP,OAAA,EAAS,MAAA;AAAA,UACT,IAAA,EAAM;AAAA,SACP;AAAA;AACH,KACF;AAAA,IACA,OAAA,EAAS;AAAA,GACX;AACF;AC1BA,IAAM,eAAA,GAAoD;AAAA,EACxD,QAAA,EAAU,kBAAA;AAAA,EACV,YAAA,EAAc,wBAAA;AAAA,EACd,YAAA,EAAc;AAChB,CAAA;AAWO,SAAS,iBAAA,CACd,MAAA,EACA,KAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,SAAmB,EAAC;AAG1B,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AACzD,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,CAAC,SAAS,CAAA,EAAG,WAAW,IAAA,EAAK;AAAA,EAC9D;AAGA,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACvD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,CAAC,UAAU,CAAA,EAAG,WAAW,IAAA,EAAK;AAAA,EAC/D;AAGA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA;AAErC,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,KAAA,CAAM,MAAA,EAAQ;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,GAAS,IAAI,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC5D,MAAA,MAAA,CAAO,KAAK,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAW,IAAA,EAAK;AAAA,EACjD;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAA;AAAA,IACP,QAAQ,EAAC;AAAA,IACT,WAAW,MAAA,CAAO;AAAA,GACpB;AACF;AAMO,SAAS,mBACd,KAAA,EACmD;AACnD,EAAA,OAAOA,CAAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA,EAAO;AAChC;AAKA,SAAS,cAAA,CAAe,OAAgB,QAAA,EAAiC;AACvE,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,oCAAA;AAAA,EACT;AAEA,EAAA,MAAM,YAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAU,CAAA,CAAE,MAAA;AACvD,EAAA,IAAI,YAAY,QAAA,EAAU;AACxB,IAAA,OAAO,CAAA,WAAA,EAAc,SAAS,CAAA,uBAAA,EAA0B,QAAQ,CAAA,MAAA,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,eAAA,CAAgB,OAAgB,QAAA,EAAiC;AACxE,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,KAAA,EAAO,CAAC,CAAA;AACnC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,OAAO,CAAA,YAAA,EAAe,KAAK,CAAA,iBAAA,EAAoB,QAAQ,CAAA,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAA,CAAa,OAAgB,YAAA,EAA8B;AAClE,EAAA,IAAI,YAAA,GAAe,qBAAqB,CAAA,EAAG;AACzC,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACtE,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAIC,iBAAgB,YAAA,GAAe,CAAA;AACnC,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,UAAA,GAAa,YAAA,CAAa,IAAA,EAAM,YAAA,GAAe,CAAC,CAAA;AACtD,MAAA,IAAI,UAAA,GAAaA,cAAAA,EAAeA,cAAAA,GAAgB,UAAA;AAAA,IAClD;AACA,IAAA,OAAOA,cAAAA;AAAA,EACT;AAEA,EAAA,IAAI,gBAAgB,YAAA,GAAe,CAAA;AACnC,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,KAAgC,CAAA,EAAG;AAC/D,IAAA,MAAM,UAAA,GAAa,YAAA;AAAA,MAChB,MAAkC,GAAG,CAAA;AAAA,MACtC,YAAA,GAAe;AAAA,KACjB;AACA,IAAA,IAAI,UAAA,GAAa,eAAe,aAAA,GAAgB,UAAA;AAAA,EAClD;AACA,EAAA,OAAO,aAAA;AACT;;;AChGO,IAAM,0BAAA,GACX,OAAO,MAAA,CAAO;AAAA,EACZ,aAAA,EAAe,IAAA;AAAA,EACf,cAAA,EAAgB,IAAA;AAAA,EAChB,aAAA,EAAe,IAAA;AAAA,EACf,WAAA,EAAa,IAAA;AAAA,EACb,YAAA,EAAc,IAAA;AAAA,EACd,IAAA,EAAM,IAAA;AAAA,EACN,YAAA,EAAc;AAChB,CAAC;AAIH,IAAM,uBAAA,GAA0B;AAAA,EAC9B,QAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEA,IAAM,eAAA,GAAkB;AAAA,EACtB,gBAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,wBAAA;AAAA,EACA,wBAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA;AAAA,EACA,cAAA;AAAA;AAAA,EACA,qBAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,gBAAA;AAAA;AAAA,EACA,UAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,oBAAoB,KAAA,EAAwB;AAC1D,EAAA,KAAA,MAAW,WAAW,uBAAA,EAAyB;AAC7C,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,wBAAA,GAA2B;AAAA,EAC/B,QAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,IAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,qBAAqB,KAAA,EAAwB;AAC3D,EAAA,KAAA,MAAW,WAAW,wBAAA,EAA0B;AAC9C,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,uBAAA,GAA0B,CAAA;AAEzB,SAAS,oBAAoB,KAAA,EAAwB;AAE1D,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG,OAAO,IAAA;AAGjC,EAAA,MAAM,iBAAiB,KAAA,CAAM,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAG,MAAA;AACjD,EAAA,IAAI,aAAA,GAAgB,yBAAyB,OAAO,IAAA;AAEpD,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,aAAA,GAAgB;AAAA,EACpB,0BAAA;AAAA,EACA,4CAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA;AAAA,EACA,2CAAA;AAAA;AAAA,EACA,uCAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,6BAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA;AAAA,EAEA,sBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,+BAAA;AAAA;AAAA,EACA,6BAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EACA,iDAAA;AAAA;AAAA,EACA,kCAAA;AAAA;AAAA,EACA,kCAAA;AAAA;AAAA;AAAA,EAEA,4BAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAMA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,kCAAkC,CAAA;AAC5D,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,CAAM,CAAC,GAAG,OAAO,KAAA;AAEhC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,CAAC,GAAG,EAAE,CAAA;AACrC,EAAA,IAAI,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,YAAY,OAAO,KAAA;AAGnD,EAAA,OACG,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACpC,OAAA,IAAW,aAAc,OAAA,IAAW,SAAA;AAAA,EACpC,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACpC,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACpC,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACrC,OAAA,KAAY,CAAA;AAEhB;AAEO,SAAS,WAAW,KAAA,EAAwB;AACjD,EAAA,KAAA,MAAW,WAAW,aAAA,EAAe;AACnC,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AAEA,EAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,sBAAA,GAAyB;AAAA,EAC7B,sCAAA;AAAA;AAAA,EACA,kEAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,eAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,oBAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,mBAAmB,KAAA,EAAwB;AACzD,EAAA,KAAA,MAAW,WAAW,sBAAA,EAAwB;AAC5C,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACT;AAIO,SAAS,iBAAA,CACd,KAAA,EACA,SAAA,GAAoB,IAAA,EACX;AACT,EAAA,OAAO,MAAM,MAAA,IAAU,SAAA;AACzB;AASA,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,4BAAA,GAA+B,EAAA;AAE9B,SAAS,mBAAmB,KAAA,EAAwB;AACzD,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,4BAAA,EAA8B,OAAO,IAAA;AAExD,EAAA,MAAM,OAAA,GAAU,wBAAwB,KAAK,CAAA;AAC7C,EAAA,OAAO,OAAA,IAAW,iBAAA;AACpB;AAEA,SAAS,wBAAwB,GAAA,EAAqB;AACpD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAoB;AACrC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAA,CAAK,IAAI,IAAA,EAAA,CAAO,IAAA,CAAK,IAAI,IAAI,CAAA,IAAK,KAAK,CAAC,CAAA;AAAA,EAC1C;AAEA,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,MAAM,GAAA,CAAI,MAAA;AAChB,EAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,EAAO,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,GAAQ,GAAA;AAClB,IAAA,IAAI,IAAI,CAAA,EAAG;AACT,MAAA,OAAA,IAAW,CAAA,GAAI,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA;AAAA,IAC5B;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAQO,SAAS,aAAA,CACd,KAAA,EACA,KAAA,EACA,MAAA,GAA2B,0BAAA,EACP;AACpB,EAAA,MAAM,UAA4B,EAAC;AAEnC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAE7B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,KAAA,EAAO,MAAM,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AAAA,EACnC;AAEA,EAAA,IAAI,MAAA,CAAO,aAAA,IAAiB,mBAAA,CAAoB,KAAK,CAAA,EAAG;AACtD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,gBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,cAAA,IAAkB,oBAAA,CAAqB,KAAK,CAAA,EAAG;AACxD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,iBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,aAAA,IAAiB,mBAAA,CAAoB,KAAK,CAAA,EAAG;AACtD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,gBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,CAAC,iBAAA,CAAkB,KAAA,EAAO,MAAA,CAAO,WAAW,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,iBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,OAAA,CAAA;AAAA,MACvB,WAAA,EAAa,CAAA,gCAAA,EAAmC,MAAA,CAAO,WAAW,CAAA;AAAA,KACnE,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,kBAAA,CAAmB,KAAK,CAAA,EAAG;AACrD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,cAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,UAAA,CAAW,KAAK,CAAA,EAAG;AACpC,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,MAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,kBAAA,CAAmB,KAAK,CAAA,EAAG;AACpD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,eAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAA,EAAQ;AAC/C;AAKA,SAAS,cAAA,CACP,QAAA,EACA,GAAA,EACA,MAAA,EACoB;AACpB,EAAA,MAAM,UAA4B,EAAC;AAEnC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAA,EAAK,GAAA,CAAI,CAAC,CAAA,EAAG,MAAM,CAAA;AAChE,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAAA,IAChC;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,cAAc,CAAA,EAAG,QAAQ,IAAI,GAAG,CAAA,CAAA,EAAI,KAAK,MAAM,CAAA;AAC9D,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAA,EAAQ;AAC/C;AAEA,SAAS,QAAA,CAAS,KAAa,MAAA,EAAwB;AACrD,EAAA,OAAO,GAAA,CAAI,SAAS,MAAA,GAAS,GAAA,CAAI,MAAM,CAAA,EAAG,MAAM,IAAI,KAAA,GAAQ,GAAA;AAC9D;;;ACnVO,IAAM,yBAAA,GAA4B;AAClC,IAAM,eAAA,GAAkB;AACxB,IAAM,iBAAA,GAAoB","file":"index.js","sourcesContent":["/**\n * Base error class for all SolonGate security errors.\n * Every error includes a machine-readable code for programmatic handling.\n */\nexport class SolonGateError extends Error {\n  public readonly code: string;\n  public readonly timestamp: string;\n  public readonly details: Record<string, unknown>;\n\n  constructor(\n    message: string,\n    code: string,\n    details: Record<string, unknown> = {},\n  ) {\n    super(message);\n    this.name = 'SolonGateError';\n    this.code = code;\n    this.timestamp = new Date().toISOString();\n    this.details = Object.freeze({ ...details });\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n\n  /**\n   * Serializable representation for logging and API responses.\n   * Never includes stack traces (information leakage prevention).\n   */\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      timestamp: this.timestamp,\n      details: this.details,\n    };\n  }\n}\n\n/** Thrown when a tool call is denied by policy. */\nexport class PolicyDeniedError extends SolonGateError {\n  constructor(\n    toolName: string,\n    reason: string,\n    details: Record<string, unknown> = {},\n  ) {\n    super(\n      `Policy denied execution of tool \"${toolName}\": ${reason}`,\n      'POLICY_DENIED',\n      { toolName, reason, ...details },\n    );\n    this.name = 'PolicyDeniedError';\n  }\n}\n\n/** Thrown when a trust level escalation is attempted illegally. */\nexport class TrustEscalationError extends SolonGateError {\n  constructor(message: string) {\n    super(message, 'TRUST_ESCALATION');\n    this.name = 'TrustEscalationError';\n  }\n}\n\n/** Thrown when tool input fails schema validation. */\nexport class SchemaValidationError extends SolonGateError {\n  constructor(\n    toolName: string,\n    validationErrors: readonly string[],\n  ) {\n    super(\n      `Schema validation failed for tool \"${toolName}\": ${validationErrors.join('; ')}`,\n      'SCHEMA_VALIDATION_FAILED',\n      { toolName, validationErrors },\n    );\n    this.name = 'SchemaValidationError';\n  }\n}\n\n/** Thrown when a tool exceeds its rate limit. */\nexport class RateLimitError extends SolonGateError {\n  constructor(toolName: string, limitPerMinute: number) {\n    super(\n      `Rate limit exceeded for tool \"${toolName}\": max ${limitPerMinute}/min`,\n      'RATE_LIMIT_EXCEEDED',\n      { toolName, limitPerMinute },\n    );\n    this.name = 'RateLimitError';\n  }\n}\n\n/** Thrown when a tool is not found in the registry. */\nexport class ToolNotFoundError extends SolonGateError {\n  constructor(toolName: string, serverName: string) {\n    super(\n      `Tool \"${toolName}\" not found on server \"${serverName}\"`,\n      'TOOL_NOT_FOUND',\n      { toolName, serverName },\n    );\n    this.name = 'ToolNotFoundError';\n  }\n}\n\n/** Thrown when an unsafe configuration is detected. */\nexport class UnsafeConfigurationError extends SolonGateError {\n  constructor(message: string, field: string) {\n    super(\n      `Unsafe configuration detected: ${message}`,\n      'UNSAFE_CONFIGURATION',\n      { field },\n    );\n    this.name = 'UnsafeConfigurationError';\n  }\n}\n\n/** Thrown when input guard detects dangerous patterns. */\nexport class InputGuardError extends SolonGateError {\n  constructor(\n    toolName: string,\n    threats: readonly { type: string; field: string; description: string }[],\n  ) {\n    super(\n      `Input guard blocked tool \"${toolName}\": ${threats.map(t => t.description).join('; ')}`,\n      'INPUT_GUARD_BLOCKED',\n      { toolName, threatCount: threats.length, threats },\n    );\n    this.name = 'InputGuardError';\n  }\n}\n\n/** Thrown when a network operation fails (API calls, cloud sync, etc.). */\nexport class NetworkError extends SolonGateError {\n  constructor(\n    operation: string,\n    statusCode?: number,\n    details: Record<string, unknown> = {},\n  ) {\n    super(\n      `Network error during ${operation}${statusCode ? ` (HTTP ${statusCode})` : ''}`,\n      'NETWORK_ERROR',\n      { operation, statusCode, ...details },\n    );\n    this.name = 'NetworkError';\n  }\n}\n","import { TrustEscalationError } from './errors.js';\n\n/**\n * Trust levels in the SolonGate security model.\n *\n * Core threat model principle: LLMs are UNTRUSTED by default.\n * Trust is never assumed - it must be explicitly granted and is\n * always scoped to specific capabilities.\n *\n * UNTRUSTED: Default for all LLM-originated requests. No permissions.\n * VERIFIED: Passed schema validation and policy evaluation. May execute within granted scope.\n * TRUSTED: System-internal only. NEVER assignable to LLM-originated requests.\n */\nexport const TrustLevel = {\n  UNTRUSTED: 'UNTRUSTED',\n  VERIFIED: 'VERIFIED',\n  TRUSTED: 'TRUSTED',\n} as const;\n\nexport type TrustLevel = (typeof TrustLevel)[keyof typeof TrustLevel];\n\n/**\n * Validates that a trust level is a legitimate enum value.\n * Prevents type confusion attacks where a string bypasses checks.\n */\nexport function isValidTrustLevel(value: unknown): value is TrustLevel {\n  return (\n    typeof value === 'string' &&\n    Object.values(TrustLevel).includes(value as TrustLevel)\n  );\n}\n\n/**\n * Asserts that a trust level transition is valid.\n * UNTRUSTED -> VERIFIED (via policy evaluation) is the only escalation path.\n * TRUSTED is never reachable from external requests.\n */\nexport function assertValidTransition(\n  from: TrustLevel,\n  to: TrustLevel,\n): void {\n  if (to === TrustLevel.TRUSTED) {\n    throw new TrustEscalationError(\n      'Cannot escalate to TRUSTED level. TRUSTED is reserved for system-internal operations.',\n    );\n  }\n  if (from === TrustLevel.VERIFIED && to === TrustLevel.UNTRUSTED) {\n    return; // Downgrade is always allowed (fail-safe)\n  }\n  if (from === TrustLevel.UNTRUSTED && to === TrustLevel.VERIFIED) {\n    return; // Normal escalation via policy evaluation\n  }\n  if (from === to) {\n    return; // No-op\n  }\n  throw new TrustEscalationError(\n    `Invalid trust transition from ${from} to ${to}`,\n  );\n}\n","import { z } from 'zod';\n\n/**\n * Permission types are ALWAYS evaluated independently.\n * Having READ does NOT imply WRITE or EXECUTE.\n */\nexport const Permission = {\n  READ: 'READ',\n  WRITE: 'WRITE',\n  EXECUTE: 'EXECUTE',\n} as const;\n\nexport type Permission = (typeof Permission)[keyof typeof Permission];\n\nexport const PermissionSchema = z.enum(['READ', 'WRITE', 'EXECUTE']);\n\n/** Immutable set of permissions granted to a specific scope. */\nexport type PermissionSet = ReadonlySet<Permission>;\n\n/** Creates an immutable permission set from an array. */\nexport function createPermissionSet(\n  permissions: Permission[],\n): PermissionSet {\n  for (const p of permissions) {\n    PermissionSchema.parse(p);\n  }\n  return new Set(permissions) as ReadonlySet<Permission>;\n}\n\n/** Empty permission set - the default for all new tools (default-deny). */\nexport const NO_PERMISSIONS: PermissionSet = Object.freeze(\n  new Set<Permission>(),\n) as ReadonlySet<Permission>;\n\n/** Read-only permission set - the maximum default for new tools. */\nexport const READ_ONLY: PermissionSet = Object.freeze(\n  new Set<Permission>([Permission.READ]),\n) as ReadonlySet<Permission>;\n\nexport function hasPermission(\n  permissions: PermissionSet,\n  required: Permission,\n): boolean {\n  return permissions.has(required);\n}\n\nexport function hasAllPermissions(\n  permissions: PermissionSet,\n  required: Permission[],\n): boolean {\n  return required.every((p) => permissions.has(p));\n}\n\n/** Maps MCP protocol methods to SolonGate permission types. */\nexport function permissionForMethod(method: string): Permission {\n  if (\n    method.startsWith('resources/') ||\n    method.startsWith('prompts/') ||\n    method === 'tools/list'\n  ) {\n    return Permission.READ;\n  }\n  if (method === 'tools/call') {\n    return Permission.EXECUTE;\n  }\n  // Default to EXECUTE for unknown methods (most restrictive)\n  return Permission.EXECUTE;\n}\n","import { z } from 'zod';\nimport type { Permission } from './permissions.js';\nimport type { TrustLevel } from './trust.js';\n\n/**\n * Policy effect: the only two outcomes of policy evaluation.\n * No \"MAYBE\" or \"CONDITIONAL\" - binary security decisions only.\n */\nexport const PolicyEffect = {\n  ALLOW: 'ALLOW',\n  DENY: 'DENY',\n} as const;\n\nexport type PolicyEffect = (typeof PolicyEffect)[keyof typeof PolicyEffect];\n\n/**\n * A single policy rule that matches against execution requests.\n * Rules are evaluated by priority order. First matching rule wins.\n * If NO rule matches, the result is DENY (default-deny).\n */\nexport interface PolicyRule {\n  readonly id: string;\n  readonly description: string;\n  readonly effect: PolicyEffect;\n  readonly priority: number;\n  readonly toolPattern: string;\n  readonly permission: Permission;\n  readonly minimumTrustLevel: TrustLevel;\n  readonly argumentConstraints?: Record<string, unknown>;\n  readonly pathConstraints?: {\n    readonly allowed?: readonly string[];\n    readonly denied?: readonly string[];\n    readonly rootDirectory?: string;\n    readonly allowSymlinks?: boolean;\n  };\n  readonly commandConstraints?: {\n    readonly allowed?: readonly string[];\n    readonly denied?: readonly string[];\n  };\n  readonly enabled: boolean;\n  readonly createdAt: string;\n  readonly updatedAt: string;\n}\n\n/**\n * A versioned, ordered set of policy rules.\n * Modifications create new sets (immutable by convention).\n */\nexport interface PolicySet {\n  readonly id: string;\n  readonly name: string;\n  readonly description: string;\n  readonly version: number;\n  readonly rules: readonly PolicyRule[];\n  readonly createdAt: string;\n  readonly updatedAt: string;\n}\n\nexport const PolicyRuleSchema = z.object({\n  id: z.string().min(1).max(256),\n  description: z.string().max(1024),\n  effect: z.enum(['ALLOW', 'DENY']),\n  priority: z.number().int().min(0).max(10000).default(1000),\n  toolPattern: z.string().min(1).max(512),\n  permission: z.enum(['READ', 'WRITE', 'EXECUTE']),\n  minimumTrustLevel: z.enum(['UNTRUSTED', 'VERIFIED', 'TRUSTED']),\n  argumentConstraints: z.record(z.unknown()).optional(),\n  pathConstraints: z\n    .object({\n      allowed: z.array(z.string()).optional(),\n      denied: z.array(z.string()).optional(),\n      rootDirectory: z.string().optional(),\n      allowSymlinks: z.boolean().optional(),\n    })\n    .optional(),\n  commandConstraints: z\n    .object({\n      allowed: z.array(z.string()).optional(),\n      denied: z.array(z.string()).optional(),\n    })\n    .optional(),\n  enabled: z.boolean().default(true),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\n\nexport const PolicySetSchema = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(256),\n  description: z.string().max(2048),\n  version: z.number().int().min(0),\n  rules: z.array(PolicyRuleSchema),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\n\n/** The result of evaluating a policy against a request. */\nexport interface PolicyDecision {\n  readonly effect: PolicyEffect;\n  readonly matchedRule: PolicyRule | null;\n  readonly reason: string;\n  readonly timestamp: string;\n  readonly evaluationTimeMs: number;\n  readonly metadata?: {\n    readonly evaluatedRules: number;\n    readonly ruleIds: readonly string[];\n    readonly requestContext: {\n      readonly tool: string;\n      readonly arguments: readonly string[];\n    };\n  };\n}\n","import type { Permission } from './permissions.js';\n\n/**\n * Declares a tool's capabilities and security requirements.\n * Wraps MCP tool definitions with SolonGate-specific metadata.\n */\nexport interface ToolCapability {\n  readonly name: string;\n  readonly description: string;\n  readonly serverName: string;\n\n  /** Maximum permissions this tool CAN request (capability ceiling). */\n  readonly maxPermissions: readonly Permission[];\n\n  /** Default permissions when no explicit policy exists. Must be empty in Phase 0 (default-deny). */\n  readonly defaultPermissions: readonly Permission[];\n\n  readonly inputSchema: Record<string, unknown>;\n\n  /** Tools with side effects cannot be READ-only. */\n  readonly hasSideEffects: boolean;\n\n  /** Sensitive data access affects audit log redaction behavior. */\n  readonly accessesSensitiveData: boolean;\n\n  /** Max calls per minute. 0 = unlimited. */\n  readonly rateLimitPerMinute: number;\n}\n\n/** Creates a ToolCapability with the most restrictive secure defaults. */\nexport function createToolCapability(\n  params: Pick<ToolCapability, 'name' | 'description' | 'serverName' | 'inputSchema'> &\n    Partial<Omit<ToolCapability, 'name' | 'description' | 'serverName' | 'inputSchema'>>,\n): ToolCapability {\n  return {\n    maxPermissions: [],\n    defaultPermissions: [],\n    hasSideEffects: true,\n    accessesSensitiveData: true,\n    rateLimitPerMinute: 60,\n    ...params,\n  };\n}\n","import type { TrustLevel } from './trust.js';\nimport type { PermissionSet } from './permissions.js';\n\n/**\n * SecurityContext represents the security state of a single request.\n * Created fresh for each MCP request and NEVER reused.\n * All fields are readonly - state transitions create new contexts.\n */\nexport interface SecurityContext {\n  readonly requestId: string;\n  readonly trustLevel: TrustLevel;\n  readonly grantedPermissions: PermissionSet;\n  readonly sessionId: string | null;\n  readonly createdAt: string;\n  readonly metadata: Readonly<Record<string, unknown>>;\n  readonly capabilityToken?: string;\n}\n\n/** Extends SecurityContext with tool-specific execution information. */\nexport interface ExecutionContext extends SecurityContext {\n  readonly toolName: string;\n  readonly serverName: string;\n  readonly arguments: Readonly<Record<string, unknown>>;\n}\n\n/** Creates a new SecurityContext with default-deny settings. */\nexport function createSecurityContext(\n  params: Pick<SecurityContext, 'requestId'> &\n    Partial<Omit<SecurityContext, 'requestId' | 'createdAt' | 'trustLevel' | 'grantedPermissions'>>,\n): SecurityContext {\n  return {\n    trustLevel: 'UNTRUSTED',\n    grantedPermissions: new Set(),\n    sessionId: null,\n    metadata: {},\n    createdAt: new Date().toISOString(),\n    ...params,\n  };\n}\n","/** Default policy effect when no rule matches: DENY */\nexport const DEFAULT_POLICY_EFFECT = 'DENY' as const;\n\n/** Maximum number of rules in a single PolicySet */\nexport const MAX_RULES_PER_POLICY_SET = 1000;\n\n/** Maximum depth for nested argument validation */\nexport const MAX_ARGUMENT_DEPTH = 10;\n\n/** Maximum size of tool arguments in bytes */\nexport const MAX_ARGUMENTS_SIZE_BYTES = 1_048_576; // 1MB\n\n/** Maximum length of a tool name */\nexport const MAX_TOOL_NAME_LENGTH = 256;\n\n/** Maximum length of a server name */\nexport const MAX_SERVER_NAME_LENGTH = 256;\n\n/** Default rate limit per tool per minute */\nexport const DEFAULT_RATE_LIMIT_PER_MINUTE = 60;\n\n/** Maximum rate limit per tool per minute */\nexport const MAX_RATE_LIMIT_PER_MINUTE = 10_000;\n\n/** Security context timeout in milliseconds (5 minutes) */\nexport const SECURITY_CONTEXT_TIMEOUT_MS = 5 * 60 * 1000;\n\n/** Policy evaluation timeout in milliseconds (100ms) */\nexport const POLICY_EVALUATION_TIMEOUT_MS = 100;\n\n// --- Input Guard Constants ---\n\n/** Default maximum length per string argument */\nexport const INPUT_GUARD_MAX_LENGTH = 4096;\n\n/** Shannon entropy threshold for encoded payload detection */\nexport const INPUT_GUARD_ENTROPY_THRESHOLD = 4.5;\n\n/** Minimum string length before entropy check applies */\nexport const INPUT_GUARD_MIN_ENTROPY_LENGTH = 32;\n\n/** Maximum wildcards allowed per value */\nexport const INPUT_GUARD_MAX_WILDCARDS = 3;\n\n// --- Token Constants ---\n\n/** Default capability token TTL in seconds */\nexport const TOKEN_DEFAULT_TTL_SECONDS = 30;\n\n/** Minimum secret key length for HMAC signing */\nexport const TOKEN_MIN_SECRET_LENGTH = 32;\n\n/** Maximum token age before forced expiry (5 minutes) */\nexport const TOKEN_MAX_AGE_SECONDS = 300;\n\n// --- Rate Limiter Constants ---\n\n/** Default sliding window size in milliseconds (1 minute) */\nexport const RATE_LIMIT_WINDOW_MS = 60_000;\n\n/** Maximum entries to keep per tool before cleanup */\nexport const RATE_LIMIT_MAX_ENTRIES = 10_000;\n\n/** Warning messages for unsafe configurations. */\nexport const UNSAFE_CONFIGURATION_WARNINGS = {\n  WILDCARD_ALLOW:\n    'Wildcard ALLOW rules grant permission to ALL tools. This bypasses the default-deny model.',\n  TRUSTED_LEVEL_EXTERNAL:\n    'Setting trust level to TRUSTED for external requests bypasses all security checks.',\n  WRITE_WITHOUT_READ:\n    'Granting WRITE without READ is unusual and may indicate a misconfiguration.',\n  EXECUTE_WITHOUT_REVIEW:\n    'EXECUTE permission allows tools to perform arbitrary actions. Review carefully.',\n  RATE_LIMIT_ZERO:\n    'A rate limit of 0 means unlimited calls. This removes protection against runaway loops.',\n  DISABLED_VALIDATION:\n    'Disabling schema validation removes input sanitization protections.',\n} as const;\n","/**\n * Types that bridge between the MCP protocol and SolonGate's type system.\n * Adapts MCP SDK types without creating a hard dependency.\n */\n\nexport interface McpToolDefinition {\n  readonly name: string;\n  readonly description?: string;\n  readonly inputSchema: {\n    readonly type: 'object';\n    readonly properties?: Record<string, unknown>;\n    readonly required?: readonly string[];\n  };\n}\n\nexport interface McpCallToolParams {\n  readonly name: string;\n  readonly arguments?: Record<string, unknown>;\n}\n\nexport interface McpCallToolResult {\n  readonly content: readonly McpToolResultContent[];\n  readonly isError?: boolean;\n  readonly structuredContent?: unknown;\n}\n\nexport type McpToolResultContent =\n  | { readonly type: 'text'; readonly text: string }\n  | { readonly type: 'image'; readonly data: string; readonly mimeType: string }\n  | { readonly type: 'resource'; readonly resource: unknown };\n\n/** Wraps denied tool calls in MCP error responses. */\nexport function createDeniedToolResult(\n  reason: string,\n): McpCallToolResult {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: JSON.stringify({\n          error: 'POLICY_DENIED',\n          message: reason,\n          hint: 'This tool call was blocked by SolonGate security policy. Check your policy configuration.',\n        }),\n      },\n    ],\n    isError: true,\n  };\n}\n","import { z, type ZodTypeAny } from 'zod';\nimport { MAX_ARGUMENT_DEPTH, MAX_ARGUMENTS_SIZE_BYTES } from './constants.js';\n\n/**\n * Result of schema validation.\n * Always includes structured errors for programmatic handling.\n */\nexport interface SchemaValidationResult {\n  readonly valid: boolean;\n  readonly errors: readonly string[];\n  readonly sanitized: Readonly<Record<string, unknown>> | null;\n}\n\n/**\n * Options for schema validation behavior.\n */\nexport interface SchemaValidatorOptions {\n  readonly maxDepth?: number;\n  readonly maxSizeBytes?: number;\n  readonly stripUnknown?: boolean;\n}\n\nconst DEFAULT_OPTIONS: Required<SchemaValidatorOptions> = {\n  maxDepth: MAX_ARGUMENT_DEPTH,\n  maxSizeBytes: MAX_ARGUMENTS_SIZE_BYTES,\n  stripUnknown: false,\n};\n\n/**\n * Validates tool input against a Zod schema with strict security enforcement.\n *\n * - Unknown fields are REJECTED (no additionalProperties)\n * - Type mismatches are REJECTED\n * - Required fields are ENFORCED\n * - Recursive depth is limited\n * - Argument size is limited\n */\nexport function validateToolInput(\n  schema: ZodTypeAny,\n  input: unknown,\n  options?: SchemaValidatorOptions,\n): SchemaValidationResult {\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const errors: string[] = [];\n\n  // 1. Size check - prevent oversized payloads\n  const sizeError = checkInputSize(input, opts.maxSizeBytes);\n  if (sizeError) {\n    return { valid: false, errors: [sizeError], sanitized: null };\n  }\n\n  // 2. Depth check - prevent deeply nested structures\n  const depthError = checkInputDepth(input, opts.maxDepth);\n  if (depthError) {\n    return { valid: false, errors: [depthError], sanitized: null };\n  }\n\n  // 3. Schema validation using Zod strict mode\n  const result = schema.safeParse(input);\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      const path = issue.path.length > 0 ? issue.path.join('.') : 'root';\n      errors.push(`${path}: ${issue.message}`);\n    }\n    return { valid: false, errors, sanitized: null };\n  }\n\n  return {\n    valid: true,\n    errors: [],\n    sanitized: result.data as Readonly<Record<string, unknown>>,\n  };\n}\n\n/**\n * Creates a strict Zod object schema that rejects unknown fields.\n * Wraps z.object().strict() for convenience.\n */\nexport function createStrictSchema(\n  shape: Record<string, ZodTypeAny>,\n): z.ZodObject<Record<string, ZodTypeAny>, 'strict'> {\n  return z.object(shape).strict();\n}\n\n/**\n * Checks if input size exceeds the maximum allowed bytes.\n */\nfunction checkInputSize(input: unknown, maxBytes: number): string | null {\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(input);\n  } catch {\n    return 'Input cannot be serialized to JSON';\n  }\n\n  const sizeBytes = new TextEncoder().encode(serialized).length;\n  if (sizeBytes > maxBytes) {\n    return `Input size ${sizeBytes} bytes exceeds maximum ${maxBytes} bytes`;\n  }\n  return null;\n}\n\n/**\n * Checks if input exceeds maximum nesting depth.\n * Prevents stack overflow and denial-of-service via deeply nested objects.\n */\nfunction checkInputDepth(input: unknown, maxDepth: number): string | null {\n  const depth = measureDepth(input, 0);\n  if (depth > maxDepth) {\n    return `Input depth ${depth} exceeds maximum ${maxDepth}`;\n  }\n  return null;\n}\n\nfunction measureDepth(value: unknown, currentDepth: number): number {\n  if (currentDepth > MAX_ARGUMENT_DEPTH + 1) {\n    return currentDepth; // Early exit to prevent stack overflow\n  }\n\n  if (value === null || value === undefined || typeof value !== 'object') {\n    return currentDepth;\n  }\n\n  if (Array.isArray(value)) {\n    let maxChildDepth = currentDepth + 1;\n    for (const item of value) {\n      const childDepth = measureDepth(item, currentDepth + 1);\n      if (childDepth > maxChildDepth) maxChildDepth = childDepth;\n    }\n    return maxChildDepth;\n  }\n\n  let maxChildDepth = currentDepth + 1;\n  for (const key of Object.keys(value as Record<string, unknown>)) {\n    const childDepth = measureDepth(\n      (value as Record<string, unknown>)[key],\n      currentDepth + 1,\n    );\n    if (childDepth > maxChildDepth) maxChildDepth = childDepth;\n  }\n  return maxChildDepth;\n}\n","/**\n * Input Guard: detects and blocks dangerous patterns in tool arguments.\n *\n * Prevents physical execution of injected instructions by checking for:\n * - Path traversal attacks (../, ..\\, encoded variants)\n * - Shell injection (;, |, &, `, $(), etc.)\n * - Wildcard abuse (**, recursive globs)\n * - Excessive length\n * - High-entropy payloads (potential encoded exploits)\n */\n\n/** Threat type detected by input guard. */\nexport type ThreatType =\n  | 'PATH_TRAVERSAL'\n  | 'SHELL_INJECTION'\n  | 'WILDCARD_ABUSE'\n  | 'LENGTH_EXCEEDED'\n  | 'HIGH_ENTROPY'\n  | 'SSRF'\n  | 'SQL_INJECTION';\n\n/** A detected threat with details. */\nexport interface DetectedThreat {\n  readonly type: ThreatType;\n  readonly field: string;\n  readonly value: string;\n  readonly description: string;\n}\n\n/** Result of sanitization check. */\nexport interface SanitizationResult {\n  readonly safe: boolean;\n  readonly threats: readonly DetectedThreat[];\n}\n\n/** Configuration for input guard checks. */\nexport interface InputGuardConfig {\n  readonly pathTraversal: boolean;\n  readonly shellInjection: boolean;\n  readonly wildcardAbuse: boolean;\n  readonly lengthLimit: number;\n  readonly entropyLimit: boolean;\n  readonly ssrf: boolean;\n  readonly sqlInjection: boolean;\n}\n\nexport const DEFAULT_INPUT_GUARD_CONFIG: Readonly<InputGuardConfig> =\n  Object.freeze({\n    pathTraversal: true,\n    shellInjection: true,\n    wildcardAbuse: true,\n    lengthLimit: 4096,\n    entropyLimit: true,\n    ssrf: true,\n    sqlInjection: true,\n  });\n\n// --- Path Traversal Detection ---\n\nconst PATH_TRAVERSAL_PATTERNS = [\n  /\\.\\.\\//,          // ../\n  /\\.\\.\\\\/,          // ..\\\n  /%2e%2e/i,         // URL-encoded ..\n  /%2e\\./i,          // partial URL-encoded\n  /\\.%2e/i,          // partial URL-encoded\n  /%252e%252e/i,     // double URL-encoded\n  /\\.\\.\\0/,          // null byte variant\n];\n\nconst SENSITIVE_PATHS = [\n  /\\/etc\\/passwd/i,\n  /\\/etc\\/shadow/i,\n  /\\/proc\\//i,\n  /\\/dev\\//i,\n  /c:\\\\windows\\\\system32/i,\n  /c:\\\\windows\\\\syswow64/i,\n  /\\/root\\//i,\n  /~\\//,\n  /\\.env(\\.|$)/i,                    // .env, .env.local, .env.production\n  /\\.aws\\/credentials/i,            // AWS credentials\n  /\\.ssh\\/id_/i,                     // SSH keys\n  /\\.kube\\/config/i,                 // Kubernetes config\n  /wp-config\\.php/i,                 // WordPress config\n  /\\.git\\/config/i,                  // Git config\n  /\\.npmrc/i,                        // npm credentials\n  /\\.pypirc/i,                       // PyPI credentials\n];\n\nexport function detectPathTraversal(value: string): boolean {\n  for (const pattern of PATH_TRAVERSAL_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  for (const pattern of SENSITIVE_PATHS) {\n    if (pattern.test(value)) return true;\n  }\n  return false;\n}\n\n// --- Shell Injection Detection ---\n\nconst SHELL_INJECTION_PATTERNS = [\n  /[;|&`]/,          // Command separators and backtick execution\n  /\\$\\(/,            // Command substitution $(...)\n  /\\$\\{/,            // Variable expansion ${...}\n  />\\s*/,            // Output redirect\n  /<\\s*/,            // Input redirect\n  /&&/,              // AND chaining\n  /\\|\\|/,            // OR chaining\n  /\\beval\\b/i,       // eval command\n  /\\bexec\\b/i,       // exec command\n  /\\bsystem\\b/i,     // system call\n  /%0a/i,            // URL-encoded newline\n  /%0d/i,            // URL-encoded carriage return\n  /%09/i,            // URL-encoded tab\n  /\\r\\n/,            // CRLF injection\n  /\\n/,              // Newline (command separator on Unix)\n];\n\nexport function detectShellInjection(value: string): boolean {\n  for (const pattern of SHELL_INJECTION_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  return false;\n}\n\n// --- Wildcard Abuse Detection ---\n\nconst MAX_WILDCARDS_PER_VALUE = 3;\n\nexport function detectWildcardAbuse(value: string): boolean {\n  // Block recursive globs\n  if (value.includes('**')) return true;\n\n  // Count wildcards\n  const wildcardCount = (value.match(/\\*/g) || []).length;\n  if (wildcardCount > MAX_WILDCARDS_PER_VALUE) return true;\n\n  return false;\n}\n\n// --- SSRF Detection ---\n\nconst SSRF_PATTERNS = [\n  /^https?:\\/\\/localhost\\b/i,\n  /^https?:\\/\\/127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/,\n  /^https?:\\/\\/0\\.0\\.0\\.0/,\n  /^https?:\\/\\/\\[::1\\]/,                         // IPv6 loopback\n  /^https?:\\/\\/10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/,  // 10.x.x.x\n  /^https?:\\/\\/172\\.(1[6-9]|2\\d|3[01])\\./,       // 172.16-31.x.x\n  /^https?:\\/\\/192\\.168\\./,                       // 192.168.x.x\n  /^https?:\\/\\/169\\.254\\./,                       // Link-local / AWS metadata\n  /metadata\\.google\\.internal/i,                  // GCP metadata\n  /^https?:\\/\\/metadata\\b/i,                      // Generic metadata endpoint\n  // IPv6 bypass patterns\n  /^https?:\\/\\/\\[fe80:/i,                         // IPv6 link-local\n  /^https?:\\/\\/\\[fc00:/i,                         // IPv6 unique local\n  /^https?:\\/\\/\\[fd[0-9a-f]{2}:/i,               // IPv6 unique local (fd00::/8)\n  /^https?:\\/\\/\\[::ffff:127\\./i,                  // IPv4-mapped IPv6 loopback\n  /^https?:\\/\\/\\[::ffff:10\\./i,                   // IPv4-mapped IPv6 private\n  /^https?:\\/\\/\\[::ffff:172\\.(1[6-9]|2\\d|3[01])\\./i, // IPv4-mapped IPv6 private\n  /^https?:\\/\\/\\[::ffff:192\\.168\\./i,             // IPv4-mapped IPv6 private\n  /^https?:\\/\\/\\[::ffff:169\\.254\\./i,             // IPv4-mapped IPv6 link-local\n  // Hex IP bypass (e.g., 0x7f000001 = 127.0.0.1)\n  /^https?:\\/\\/0x[0-9a-f]+\\b/i,\n  // Octal IP bypass (e.g., 0177.0.0.1 = 127.0.0.1)\n  /^https?:\\/\\/0[0-7]{1,3}\\./,\n];\n\n/**\n * Detects decimal IP representation (e.g., http://2130706433 = 127.0.0.1).\n * Converts decimal to IPv4 and checks if it's in a private/loopback range.\n */\nfunction detectDecimalIP(value: string): boolean {\n  const match = value.match(/^https?:\\/\\/(\\d{8,10})(?:[:/]|$)/);\n  if (!match || !match[1]) return false;\n\n  const decimal = parseInt(match[1], 10);\n  if (isNaN(decimal) || decimal > 0xffffffff) return false;\n\n  // Check private/loopback ranges\n  return (\n    (decimal >= 0x7f000000 && decimal <= 0x7fffffff) || // 127.0.0.0/8\n    (decimal >= 0x0a000000 && decimal <= 0x0affffff) || // 10.0.0.0/8\n    (decimal >= 0xac100000 && decimal <= 0xac1fffff) || // 172.16.0.0/12\n    (decimal >= 0xc0a80000 && decimal <= 0xc0a8ffff) || // 192.168.0.0/16\n    (decimal >= 0xa9fe0000 && decimal <= 0xa9feffff) || // 169.254.0.0/16\n    decimal === 0                                        // 0.0.0.0\n  );\n}\n\nexport function detectSSRF(value: string): boolean {\n  for (const pattern of SSRF_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  // Check for decimal IP bypass\n  if (detectDecimalIP(value)) return true;\n  return false;\n}\n\n// --- SQL Injection Detection ---\n\nconst SQL_INJECTION_PATTERNS = [\n  /'\\s{0,20}(OR|AND)\\s{0,20}'.{0,200}'/i,  // ' OR '1'='1 — bounded to prevent ReDoS\n  /'\\s{0,10};\\s{0,10}(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|EXEC)/i, // '; DROP TABLE\n  /UNION\\s+(ALL\\s+)?SELECT/i,       // UNION SELECT\n  /--\\s*$/m,                         // SQL comment at end of line\n  /\\/\\*.{0,500}?\\*\\//,              // SQL block comment — bounded + non-greedy\n  /\\bSLEEP\\s*\\(/i,                  // Time-based injection\n  /\\bBENCHMARK\\s*\\(/i,              // MySQL benchmark\n  /\\bWAITFOR\\s+DELAY/i,             // MSSQL delay\n  /\\b(LOAD_FILE|INTO\\s+OUTFILE|INTO\\s+DUMPFILE)\\b/i, // File operations\n];\n\nexport function detectSQLInjection(value: string): boolean {\n  for (const pattern of SQL_INJECTION_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  return false;\n}\n\n// --- Length Check ---\n\nexport function checkLengthLimits(\n  value: string,\n  maxLength: number = 4096,\n): boolean {\n  return value.length <= maxLength;\n}\n\n// --- Entropy Detection ---\n\n/**\n * Detects high-entropy strings that may indicate encoded payloads.\n * Uses Shannon entropy calculation.\n * Threshold: 4.5 bits per character (base64 encoded data is ~6.0).\n */\nconst ENTROPY_THRESHOLD = 4.5;\nconst MIN_LENGTH_FOR_ENTROPY_CHECK = 32;\n\nexport function checkEntropyLimits(value: string): boolean {\n  if (value.length < MIN_LENGTH_FOR_ENTROPY_CHECK) return true; // Too short to be meaningful\n\n  const entropy = calculateShannonEntropy(value);\n  return entropy <= ENTROPY_THRESHOLD;\n}\n\nfunction calculateShannonEntropy(str: string): number {\n  const freq = new Map<string, number>();\n  for (const char of str) {\n    freq.set(char, (freq.get(char) ?? 0) + 1);\n  }\n\n  let entropy = 0;\n  const len = str.length;\n  for (const count of freq.values()) {\n    const p = count / len;\n    if (p > 0) {\n      entropy -= p * Math.log2(p);\n    }\n  }\n  return entropy;\n}\n\n// --- Main Sanitization Function ---\n\n/**\n * Runs all input guard checks on a value.\n * Returns structured result with all detected threats.\n */\nexport function sanitizeInput(\n  field: string,\n  value: unknown,\n  config: InputGuardConfig = DEFAULT_INPUT_GUARD_CONFIG,\n): SanitizationResult {\n  const threats: DetectedThreat[] = [];\n\n  if (typeof value !== 'string') {\n    // For non-string values, recursively check string values in objects/arrays\n    if (typeof value === 'object' && value !== null) {\n      return sanitizeObject(field, value, config);\n    }\n    return { safe: true, threats: [] };\n  }\n\n  if (config.pathTraversal && detectPathTraversal(value)) {\n    threats.push({\n      type: 'PATH_TRAVERSAL',\n      field,\n      value: truncate(value, 100),\n      description: 'Path traversal pattern detected',\n    });\n  }\n\n  if (config.shellInjection && detectShellInjection(value)) {\n    threats.push({\n      type: 'SHELL_INJECTION',\n      field,\n      value: truncate(value, 100),\n      description: 'Shell injection pattern detected',\n    });\n  }\n\n  if (config.wildcardAbuse && detectWildcardAbuse(value)) {\n    threats.push({\n      type: 'WILDCARD_ABUSE',\n      field,\n      value: truncate(value, 100),\n      description: 'Wildcard abuse pattern detected',\n    });\n  }\n\n  if (!checkLengthLimits(value, config.lengthLimit)) {\n    threats.push({\n      type: 'LENGTH_EXCEEDED',\n      field,\n      value: `[${value.length} chars]`,\n      description: `Value exceeds maximum length of ${config.lengthLimit}`,\n    });\n  }\n\n  if (config.entropyLimit && !checkEntropyLimits(value)) {\n    threats.push({\n      type: 'HIGH_ENTROPY',\n      field,\n      value: truncate(value, 100),\n      description: 'High entropy string detected - possible encoded payload',\n    });\n  }\n\n  if (config.ssrf && detectSSRF(value)) {\n    threats.push({\n      type: 'SSRF',\n      field,\n      value: truncate(value, 100),\n      description: 'Server-side request forgery pattern detected — internal/metadata URL blocked',\n    });\n  }\n\n  if (config.sqlInjection && detectSQLInjection(value)) {\n    threats.push({\n      type: 'SQL_INJECTION',\n      field,\n      value: truncate(value, 100),\n      description: 'SQL injection pattern detected',\n    });\n  }\n\n  return { safe: threats.length === 0, threats };\n}\n\n/**\n * Recursively sanitizes all string values in an object or array.\n */\nfunction sanitizeObject(\n  basePath: string,\n  obj: object,\n  config: InputGuardConfig,\n): SanitizationResult {\n  const threats: DetectedThreat[] = [];\n\n  if (Array.isArray(obj)) {\n    for (let i = 0; i < obj.length; i++) {\n      const result = sanitizeInput(`${basePath}[${i}]`, obj[i], config);\n      threats.push(...result.threats);\n    }\n  } else {\n    for (const [key, val] of Object.entries(obj)) {\n      const result = sanitizeInput(`${basePath}.${key}`, val, config);\n      threats.push(...result.threats);\n    }\n  }\n\n  return { safe: threats.length === 0, threats };\n}\n\nfunction truncate(str: string, maxLen: number): string {\n  return str.length > maxLen ? str.slice(0, maxLen) + '...' : str;\n}\n","import type { Permission } from './permissions.js';\n\n/**\n * Capability Token: a signed, short-lived, single-use token\n * that authorizes execution of specific tools within specific scopes.\n *\n * Security properties:\n * - Short-lived: TTL defaults to 30 seconds\n * - Single-use: nonce prevents replay attacks\n * - Scoped: limited to specific tools and servers\n * - Signed: HMAC-SHA256 prevents forgery\n */\nexport interface CapabilityToken {\n  readonly jti: string;           // Unique token ID (nonce)\n  readonly iss: string;           // Issuer (gateway ID)\n  readonly sub: string;           // Subject (request ID)\n  readonly iat: number;           // Issued at (unix timestamp)\n  readonly exp: number;           // Expires at (unix timestamp)\n  readonly permissions: readonly Permission[];\n  readonly toolScope: readonly string[];    // Which tools this token covers\n  readonly serverScope: readonly string[];  // Which servers\n  readonly pathScope?: readonly string[];   // Optional path restrictions\n}\n\n/**\n * Configuration for token issuance.\n */\nexport interface TokenConfig {\n  readonly secret: string;        // HMAC signing key\n  readonly ttlSeconds: number;    // Default 30 seconds\n  readonly algorithm: 'HS256';    // Start with HMAC\n  readonly issuer: string;\n}\n\n/**\n * Default token configuration.\n * Secret must be provided - no default.\n */\nexport const DEFAULT_TOKEN_TTL_SECONDS = 30;\nexport const TOKEN_ALGORITHM = 'HS256' as const;\nexport const MIN_SECRET_LENGTH = 32;\n\n/**\n * Result of token verification.\n */\nexport interface TokenVerificationResult {\n  readonly valid: boolean;\n  readonly payload?: CapabilityToken;\n  readonly reason?: string;\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/trust.ts","../src/permissions.ts","../src/policy.ts","../src/tool.ts","../src/context.ts","../src/constants.ts","../src/mcp-types.ts","../src/schema-validator.ts","../src/input-guard.ts","../src/capability-token.ts"],"names":["z","maxChildDepth"],"mappings":";;;AAIO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CACE,OAAA,EACA,IAAA,EACA,OAAA,GAAmC,EAAC,EACpC;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACxC,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,SAAS,CAAA;AAC3C,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,GAAkC;AAChC,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AACF;AAGO,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EACpD,WAAA,CACE,QAAA,EACA,MAAA,EACA,OAAA,GAAmC,EAAC,EACpC;AACA,IAAA,KAAA;AAAA,MACE,CAAA,iCAAA,EAAoC,QAAQ,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA;AAAA,MACxD,eAAA;AAAA,MACA,EAAE,QAAA,EAAU,MAAA,EAAQ,GAAG,OAAA;AAAQ,KACjC;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAA,EACvD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,SAAS,kBAAkB,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AAAA,EACd;AACF;AAGO,IAAM,qBAAA,GAAN,cAAoC,cAAA,CAAe;AAAA,EACxD,WAAA,CACE,UACA,gBAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,sCAAsC,QAAQ,CAAA,GAAA,EAAM,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MAC/E,0BAAA;AAAA,MACA,EAAE,UAAU,gBAAA;AAAiB,KAC/B;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,cAAA,CAAe;AAAA,EACjD,WAAA,CAAY,UAAkB,cAAA,EAAwB;AACpD,IAAA,KAAA;AAAA,MACE,CAAA,8BAAA,EAAiC,QAAQ,CAAA,OAAA,EAAU,cAAc,CAAA,IAAA,CAAA;AAAA,MACjE,qBAAA;AAAA,MACA,EAAE,UAAU,cAAA;AAAe,KAC7B;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;AAGO,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EACpD,WAAA,CAAY,UAAkB,UAAA,EAAoB;AAChD,IAAA,KAAA;AAAA,MACE,CAAA,MAAA,EAAS,QAAQ,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,CAAA;AAAA,MACrD,gBAAA;AAAA,MACA,EAAE,UAAU,UAAA;AAAW,KACzB;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAGO,IAAM,wBAAA,GAAN,cAAuC,cAAA,CAAe;AAAA,EAC3D,WAAA,CAAY,SAAiB,KAAA,EAAe;AAC1C,IAAA,KAAA;AAAA,MACE,kCAAkC,OAAO,CAAA,CAAA;AAAA,MACzC,sBAAA;AAAA,MACA,EAAE,KAAA;AAAM,KACV;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CACE,UACA,OAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,QAAQ,CAAA,GAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,WAAW,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,MACrF,qBAAA;AAAA,MACA,EAAE,QAAA,EAAU,WAAA,EAAa,OAAA,CAAQ,QAAQ,OAAA;AAAQ,KACnD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAGO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CACE,SAAA,EACA,UAAA,EACA,OAAA,GAAmC,EAAC,EACpC;AACA,IAAA,KAAA;AAAA,MACE,wBAAwB,SAAS,CAAA,EAAG,aAAa,CAAA,OAAA,EAAU,UAAU,MAAM,EAAE,CAAA,CAAA;AAAA,MAC7E,eAAA;AAAA,MACA,EAAE,SAAA,EAAW,UAAA,EAAY,GAAG,OAAA;AAAQ,KACtC;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF;;;AChIO,IAAM,UAAA,GAAa;AAAA,EACxB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,OAAA,EAAS;AACX;AAQO,SAAS,kBAAkB,KAAA,EAAqC;AACrE,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,MAAA,CAAO,OAAO,UAAU,CAAA,CAAE,SAAS,KAAmB,CAAA;AAE1D;AAOO,SAAS,qBAAA,CACd,MACA,EAAA,EACM;AACN,EAAA,IAAI,EAAA,KAAO,WAAW,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,oBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,IAAA,KAAS,UAAA,CAAW,QAAA,IAAY,EAAA,KAAO,WAAW,SAAA,EAAW;AAC/D,IAAA;AAAA,EACF;AACA,EAAA,IAAI,IAAA,KAAS,UAAA,CAAW,SAAA,IAAa,EAAA,KAAO,WAAW,QAAA,EAAU;AAC/D,IAAA;AAAA,EACF;AACA,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA;AAAA,EACF;AACA,EAAA,MAAM,IAAI,oBAAA;AAAA,IACR,CAAA,8BAAA,EAAiC,IAAI,CAAA,IAAA,EAAO,EAAE,CAAA;AAAA,GAChD;AACF;ACpDO,IAAM,UAAA,GAAa;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,KAAA,EAAO,OAAA;AAAA,EACP,OAAA,EAAS;AACX;AAIO,IAAM,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAC;AAM5D,SAAS,oBACd,WAAA,EACe;AACf,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAI,IAAI,WAAW,CAAA;AAC5B;AAGO,IAAM,iBAAgC,MAAA,CAAO,MAAA;AAAA,sBAC9C,GAAA;AACN;AAGO,IAAM,YAA2B,MAAA,CAAO,MAAA;AAAA,kBAC7C,IAAI,GAAA,CAAgB,CAAC,UAAA,CAAW,IAAI,CAAC;AACvC;AAEO,SAAS,aAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,WAAA,CAAY,IAAI,QAAQ,CAAA;AACjC;AAEO,SAAS,iBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,SAAS,KAAA,CAAM,CAAC,MAAM,WAAA,CAAY,GAAA,CAAI,CAAC,CAAC,CAAA;AACjD;AAGO,SAAS,oBAAoB,MAAA,EAA4B;AAC9D,EAAA,IACE,MAAA,CAAO,WAAW,YAAY,CAAA,IAC9B,OAAO,UAAA,CAAW,UAAU,CAAA,IAC5B,MAAA,KAAW,YAAA,EACX;AACA,IAAA,OAAO,UAAA,CAAW,IAAA;AAAA,EACpB;AACA,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,OAAO,UAAA,CAAW,OAAA;AAAA,EACpB;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA;AACpB;AC3DO,IAAM,YAAA,GAAe;AAAA,EAC1B,KAAA,EAAO,OAAA;AAAA,EACP,IAAA,EAAM;AACR;AAuDO,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EACvC,EAAA,EAAIA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAC7B,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,IAAI,CAAA;AAAA,EAChC,QAAQA,CAAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,MAAM,CAAC,CAAA;AAAA,EAChC,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAK,CAAA,CAAE,QAAQ,GAAI,CAAA;AAAA,EACzD,WAAA,EAAaA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACtC,YAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAC,CAAA;AAAA,EAC/C,mBAAmBA,CAAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,UAAA,EAAY,SAAS,CAAC,CAAA;AAAA,EAC9D,qBAAqBA,CAAAA,CAAE,MAAA,CAAOA,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACpD,eAAA,EAAiBA,EACd,MAAA,CAAO;AAAA,IACN,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACtC,QAAQA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACrC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,aAAA,EAAeA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,GACrC,EACA,QAAA,EAAS;AAAA,EACZ,kBAAA,EAAoBA,EACjB,MAAA,CAAO;AAAA,IACN,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACtC,QAAQA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAAS,GACtC,EACA,QAAA,EAAS;AAAA,EACZ,mBAAA,EAAqBA,EAClB,MAAA,CAAO;AAAA,IACN,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACtC,QAAQA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAAS,GACtC,EACA,QAAA,EAAS;AAAA,EACZ,cAAA,EAAgBA,EACb,MAAA,CAAO;AAAA,IACN,SAASA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACtC,QAAQA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAAS,GACtC,EACA,QAAA,EAAS;AAAA,EACZ,OAAA,EAASA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACjC,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC;AAEM,IAAM,eAAA,GAAkBA,EAAE,MAAA,CAAO;AAAA,EACtC,EAAA,EAAIA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAC7B,IAAA,EAAMA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EAC/B,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,IAAI,CAAA;AAAA,EAChC,SAASA,CAAAA,CAAE,MAAA,GAAS,GAAA,EAAI,CAAE,IAAI,CAAC,CAAA;AAAA,EAC/B,KAAA,EAAOA,CAAAA,CAAE,KAAA,CAAM,gBAAgB,CAAA;AAAA,EAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC;;;ACpFM,SAAS,qBACd,MAAA,EAEgB;AAChB,EAAA,OAAO;AAAA,IACL,gBAAgB,EAAC;AAAA,IACjB,oBAAoB,EAAC;AAAA,IACrB,cAAA,EAAgB,IAAA;AAAA,IAChB,qBAAA,EAAuB,IAAA;AAAA,IACvB,kBAAA,EAAoB,EAAA;AAAA,IACpB,GAAG;AAAA,GACL;AACF;;;AChBO,SAAS,sBACd,MAAA,EAEiB;AACjB,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,WAAA;AAAA,IACZ,kBAAA,sBAAwB,GAAA,EAAI;AAAA,IAC5B,SAAA,EAAW,IAAA;AAAA,IACX,UAAU,EAAC;AAAA,IACX,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IAClC,GAAG;AAAA,GACL;AACF;;;ACrCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,kBAAA,GAAqB;AAG3B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,oBAAA,GAAuB;AAG7B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,6BAAA,GAAgC;AAGtC,IAAM,yBAAA,GAA4B;AAGlC,IAAM,2BAAA,GAA8B,IAAI,EAAA,GAAK;AAG7C,IAAM,4BAAA,GAA+B;AAKrC,IAAM,sBAAA,GAAyB;AAG/B,IAAM,6BAAA,GAAgC;AAGtC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,yBAAA,GAA4B;AAKlC,IAAM,yBAAA,GAA4B;AAGlC,IAAM,uBAAA,GAA0B;AAGhC,IAAM,qBAAA,GAAwB;AAK9B,IAAM,oBAAA,GAAuB;AAG7B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,6BAAA,GAAgC;AAAA,EAC3C,cAAA,EACE,2FAAA;AAAA,EACF,sBAAA,EACE,oFAAA;AAAA,EACF,kBAAA,EACE,6EAAA;AAAA,EACF,sBAAA,EACE,iFAAA;AAAA,EACF,eAAA,EACE,yFAAA;AAAA,EACF,mBAAA,EACE;AACJ;;;AC7CO,SAAS,uBACd,MAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACnB,KAAA,EAAO,eAAA;AAAA,UACP,OAAA,EAAS,MAAA;AAAA,UACT,IAAA,EAAM;AAAA,SACP;AAAA;AACH,KACF;AAAA,IACA,OAAA,EAAS;AAAA,GACX;AACF;AC1BA,IAAM,eAAA,GAAoD;AAAA,EACxD,QAAA,EAAU,kBAAA;AAAA,EACV,YAAA,EAAc,wBAAA;AAAA,EACd,YAAA,EAAc;AAChB,CAAA;AAWO,SAAS,iBAAA,CACd,MAAA,EACA,KAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,SAAmB,EAAC;AAG1B,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AACzD,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,CAAC,SAAS,CAAA,EAAG,WAAW,IAAA,EAAK;AAAA,EAC9D;AAGA,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACvD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,CAAC,UAAU,CAAA,EAAG,WAAW,IAAA,EAAK;AAAA,EAC/D;AAGA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA;AAErC,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,KAAA,CAAM,MAAA,EAAQ;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,GAAS,IAAI,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC5D,MAAA,MAAA,CAAO,KAAK,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAW,IAAA,EAAK;AAAA,EACjD;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAA;AAAA,IACP,QAAQ,EAAC;AAAA,IACT,WAAW,MAAA,CAAO;AAAA,GACpB;AACF;AAMO,SAAS,mBACd,KAAA,EACmD;AACnD,EAAA,OAAOA,CAAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA,EAAO;AAChC;AAKA,SAAS,cAAA,CAAe,OAAgB,QAAA,EAAiC;AACvE,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,oCAAA;AAAA,EACT;AAEA,EAAA,MAAM,YAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAU,CAAA,CAAE,MAAA;AACvD,EAAA,IAAI,YAAY,QAAA,EAAU;AACxB,IAAA,OAAO,CAAA,WAAA,EAAc,SAAS,CAAA,uBAAA,EAA0B,QAAQ,CAAA,MAAA,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,eAAA,CAAgB,OAAgB,QAAA,EAAiC;AACxE,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,KAAA,EAAO,CAAC,CAAA;AACnC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,OAAO,CAAA,YAAA,EAAe,KAAK,CAAA,iBAAA,EAAoB,QAAQ,CAAA,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAA,CAAa,OAAgB,YAAA,EAA8B;AAClE,EAAA,IAAI,YAAA,GAAe,qBAAqB,CAAA,EAAG;AACzC,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACtE,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAIC,iBAAgB,YAAA,GAAe,CAAA;AACnC,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,UAAA,GAAa,YAAA,CAAa,IAAA,EAAM,YAAA,GAAe,CAAC,CAAA;AACtD,MAAA,IAAI,UAAA,GAAaA,cAAAA,EAAeA,cAAAA,GAAgB,UAAA;AAAA,IAClD;AACA,IAAA,OAAOA,cAAAA;AAAA,EACT;AAEA,EAAA,IAAI,gBAAgB,YAAA,GAAe,CAAA;AACnC,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,KAAgC,CAAA,EAAG;AAC/D,IAAA,MAAM,UAAA,GAAa,YAAA;AAAA,MAChB,MAAkC,GAAG,CAAA;AAAA,MACtC,YAAA,GAAe;AAAA,KACjB;AACA,IAAA,IAAI,UAAA,GAAa,eAAe,aAAA,GAAgB,UAAA;AAAA,EAClD;AACA,EAAA,OAAO,aAAA;AACT;;;AChGO,IAAM,0BAAA,GACX,OAAO,MAAA,CAAO;AAAA,EACZ,aAAA,EAAe,IAAA;AAAA,EACf,cAAA,EAAgB,IAAA;AAAA,EAChB,aAAA,EAAe,IAAA;AAAA,EACf,WAAA,EAAa,IAAA;AAAA,EACb,YAAA,EAAc,IAAA;AAAA,EACd,IAAA,EAAM,IAAA;AAAA,EACN,YAAA,EAAc;AAChB,CAAC;AAIH,IAAM,uBAAA,GAA0B;AAAA,EAC9B,QAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEA,IAAM,eAAA,GAAkB;AAAA,EACtB,gBAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,wBAAA;AAAA,EACA,wBAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA;AAAA,EACA,cAAA;AAAA;AAAA,EACA,qBAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,gBAAA;AAAA;AAAA,EACA,UAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,oBAAoB,KAAA,EAAwB;AAC1D,EAAA,KAAA,MAAW,WAAW,uBAAA,EAAyB;AAC7C,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,wBAAA,GAA2B;AAAA,EAC/B,QAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,IAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,qBAAqB,KAAA,EAAwB;AAC3D,EAAA,KAAA,MAAW,WAAW,wBAAA,EAA0B;AAC9C,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,uBAAA,GAA0B,CAAA;AAEzB,SAAS,oBAAoB,KAAA,EAAwB;AAE1D,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG,OAAO,IAAA;AAGjC,EAAA,MAAM,iBAAiB,KAAA,CAAM,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAG,MAAA;AACjD,EAAA,IAAI,aAAA,GAAgB,yBAAyB,OAAO,IAAA;AAEpD,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,aAAA,GAAgB;AAAA,EACpB,0BAAA;AAAA,EACA,4CAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA;AAAA,EACA,2CAAA;AAAA;AAAA,EACA,uCAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,6BAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA;AAAA,EAEA,sBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,+BAAA;AAAA;AAAA,EACA,6BAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EACA,iDAAA;AAAA;AAAA,EACA,kCAAA;AAAA;AAAA,EACA,kCAAA;AAAA;AAAA;AAAA,EAEA,4BAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAMA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,kCAAkC,CAAA;AAC5D,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,CAAM,CAAC,GAAG,OAAO,KAAA;AAEhC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,CAAC,GAAG,EAAE,CAAA;AACrC,EAAA,IAAI,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,YAAY,OAAO,KAAA;AAGnD,EAAA,OACG,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACpC,OAAA,IAAW,aAAc,OAAA,IAAW,SAAA;AAAA,EACpC,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACpC,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACpC,OAAA,IAAW,cAAc,OAAA,IAAW,UAAA;AAAA,EACrC,OAAA,KAAY,CAAA;AAEhB;AAEO,SAAS,WAAW,KAAA,EAAwB;AACjD,EAAA,KAAA,MAAW,WAAW,aAAA,EAAe;AACnC,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AAEA,EAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,OAAO,KAAA;AACT;AAIA,IAAM,sBAAA,GAAyB;AAAA,EAC7B,sCAAA;AAAA;AAAA,EACA,kEAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,eAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,oBAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,mBAAmB,KAAA,EAAwB;AACzD,EAAA,KAAA,MAAW,WAAW,sBAAA,EAAwB;AAC5C,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACT;AAIO,SAAS,iBAAA,CACd,KAAA,EACA,SAAA,GAAoB,IAAA,EACX;AACT,EAAA,OAAO,MAAM,MAAA,IAAU,SAAA;AACzB;AASA,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,4BAAA,GAA+B,EAAA;AAE9B,SAAS,mBAAmB,KAAA,EAAwB;AACzD,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,4BAAA,EAA8B,OAAO,IAAA;AAExD,EAAA,MAAM,OAAA,GAAU,wBAAwB,KAAK,CAAA;AAC7C,EAAA,OAAO,OAAA,IAAW,iBAAA;AACpB;AAEA,SAAS,wBAAwB,GAAA,EAAqB;AACpD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAoB;AACrC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAA,CAAK,IAAI,IAAA,EAAA,CAAO,IAAA,CAAK,IAAI,IAAI,CAAA,IAAK,KAAK,CAAC,CAAA;AAAA,EAC1C;AAEA,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,MAAM,GAAA,CAAI,MAAA;AAChB,EAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,EAAO,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,GAAQ,GAAA;AAClB,IAAA,IAAI,IAAI,CAAA,EAAG;AACT,MAAA,OAAA,IAAW,CAAA,GAAI,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA;AAAA,IAC5B;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAQO,SAAS,aAAA,CACd,KAAA,EACA,KAAA,EACA,MAAA,GAA2B,0BAAA,EACP;AACpB,EAAA,MAAM,UAA4B,EAAC;AAEnC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAE7B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,KAAA,EAAO,MAAM,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AAAA,EACnC;AAEA,EAAA,IAAI,MAAA,CAAO,aAAA,IAAiB,mBAAA,CAAoB,KAAK,CAAA,EAAG;AACtD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,gBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,cAAA,IAAkB,oBAAA,CAAqB,KAAK,CAAA,EAAG;AACxD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,iBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,aAAA,IAAiB,mBAAA,CAAoB,KAAK,CAAA,EAAG;AACtD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,gBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,CAAC,iBAAA,CAAkB,KAAA,EAAO,MAAA,CAAO,WAAW,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,iBAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,OAAA,CAAA;AAAA,MACvB,WAAA,EAAa,CAAA,gCAAA,EAAmC,MAAA,CAAO,WAAW,CAAA;AAAA,KACnE,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,kBAAA,CAAmB,KAAK,CAAA,EAAG;AACrD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,cAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,UAAA,CAAW,KAAK,CAAA,EAAG;AACpC,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,MAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,kBAAA,CAAmB,KAAK,CAAA,EAAG;AACpD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,eAAA;AAAA,MACN,KAAA;AAAA,MACA,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAAA,MAC1B,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAA,EAAQ;AAC/C;AAKA,SAAS,cAAA,CACP,QAAA,EACA,GAAA,EACA,MAAA,EACoB;AACpB,EAAA,MAAM,UAA4B,EAAC;AAEnC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAA,EAAK,GAAA,CAAI,CAAC,CAAA,EAAG,MAAM,CAAA;AAChE,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAAA,IAChC;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,cAAc,CAAA,EAAG,QAAQ,IAAI,GAAG,CAAA,CAAA,EAAI,KAAK,MAAM,CAAA;AAC9D,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAA,EAAQ;AAC/C;AAEA,SAAS,QAAA,CAAS,KAAa,MAAA,EAAwB;AACrD,EAAA,OAAO,GAAA,CAAI,SAAS,MAAA,GAAS,GAAA,CAAI,MAAM,CAAA,EAAG,MAAM,IAAI,KAAA,GAAQ,GAAA;AAC9D;;;ACnVO,IAAM,yBAAA,GAA4B;AAClC,IAAM,eAAA,GAAkB;AACxB,IAAM,iBAAA,GAAoB","file":"index.js","sourcesContent":["/**\n * Base error class for all SolonGate security errors.\n * Every error includes a machine-readable code for programmatic handling.\n */\nexport class SolonGateError extends Error {\n  public readonly code: string;\n  public readonly timestamp: string;\n  public readonly details: Record<string, unknown>;\n\n  constructor(\n    message: string,\n    code: string,\n    details: Record<string, unknown> = {},\n  ) {\n    super(message);\n    this.name = 'SolonGateError';\n    this.code = code;\n    this.timestamp = new Date().toISOString();\n    this.details = Object.freeze({ ...details });\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n\n  /**\n   * Serializable representation for logging and API responses.\n   * Never includes stack traces (information leakage prevention).\n   */\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      timestamp: this.timestamp,\n      details: this.details,\n    };\n  }\n}\n\n/** Thrown when a tool call is denied by policy. */\nexport class PolicyDeniedError extends SolonGateError {\n  constructor(\n    toolName: string,\n    reason: string,\n    details: Record<string, unknown> = {},\n  ) {\n    super(\n      `Policy denied execution of tool \"${toolName}\": ${reason}`,\n      'POLICY_DENIED',\n      { toolName, reason, ...details },\n    );\n    this.name = 'PolicyDeniedError';\n  }\n}\n\n/** Thrown when a trust level escalation is attempted illegally. */\nexport class TrustEscalationError extends SolonGateError {\n  constructor(message: string) {\n    super(message, 'TRUST_ESCALATION');\n    this.name = 'TrustEscalationError';\n  }\n}\n\n/** Thrown when tool input fails schema validation. */\nexport class SchemaValidationError extends SolonGateError {\n  constructor(\n    toolName: string,\n    validationErrors: readonly string[],\n  ) {\n    super(\n      `Schema validation failed for tool \"${toolName}\": ${validationErrors.join('; ')}`,\n      'SCHEMA_VALIDATION_FAILED',\n      { toolName, validationErrors },\n    );\n    this.name = 'SchemaValidationError';\n  }\n}\n\n/** Thrown when a tool exceeds its rate limit. */\nexport class RateLimitError extends SolonGateError {\n  constructor(toolName: string, limitPerMinute: number) {\n    super(\n      `Rate limit exceeded for tool \"${toolName}\": max ${limitPerMinute}/min`,\n      'RATE_LIMIT_EXCEEDED',\n      { toolName, limitPerMinute },\n    );\n    this.name = 'RateLimitError';\n  }\n}\n\n/** Thrown when a tool is not found in the registry. */\nexport class ToolNotFoundError extends SolonGateError {\n  constructor(toolName: string, serverName: string) {\n    super(\n      `Tool \"${toolName}\" not found on server \"${serverName}\"`,\n      'TOOL_NOT_FOUND',\n      { toolName, serverName },\n    );\n    this.name = 'ToolNotFoundError';\n  }\n}\n\n/** Thrown when an unsafe configuration is detected. */\nexport class UnsafeConfigurationError extends SolonGateError {\n  constructor(message: string, field: string) {\n    super(\n      `Unsafe configuration detected: ${message}`,\n      'UNSAFE_CONFIGURATION',\n      { field },\n    );\n    this.name = 'UnsafeConfigurationError';\n  }\n}\n\n/** Thrown when input guard detects dangerous patterns. */\nexport class InputGuardError extends SolonGateError {\n  constructor(\n    toolName: string,\n    threats: readonly { type: string; field: string; description: string }[],\n  ) {\n    super(\n      `Input guard blocked tool \"${toolName}\": ${threats.map(t => t.description).join('; ')}`,\n      'INPUT_GUARD_BLOCKED',\n      { toolName, threatCount: threats.length, threats },\n    );\n    this.name = 'InputGuardError';\n  }\n}\n\n/** Thrown when a network operation fails (API calls, cloud sync, etc.). */\nexport class NetworkError extends SolonGateError {\n  constructor(\n    operation: string,\n    statusCode?: number,\n    details: Record<string, unknown> = {},\n  ) {\n    super(\n      `Network error during ${operation}${statusCode ? ` (HTTP ${statusCode})` : ''}`,\n      'NETWORK_ERROR',\n      { operation, statusCode, ...details },\n    );\n    this.name = 'NetworkError';\n  }\n}\n","import { TrustEscalationError } from './errors.js';\n\n/**\n * Trust levels in the SolonGate security model.\n *\n * Core threat model principle: LLMs are UNTRUSTED by default.\n * Trust is never assumed - it must be explicitly granted and is\n * always scoped to specific capabilities.\n *\n * UNTRUSTED: Default for all LLM-originated requests. No permissions.\n * VERIFIED: Passed schema validation and policy evaluation. May execute within granted scope.\n * TRUSTED: System-internal only. NEVER assignable to LLM-originated requests.\n */\nexport const TrustLevel = {\n  UNTRUSTED: 'UNTRUSTED',\n  VERIFIED: 'VERIFIED',\n  TRUSTED: 'TRUSTED',\n} as const;\n\nexport type TrustLevel = (typeof TrustLevel)[keyof typeof TrustLevel];\n\n/**\n * Validates that a trust level is a legitimate enum value.\n * Prevents type confusion attacks where a string bypasses checks.\n */\nexport function isValidTrustLevel(value: unknown): value is TrustLevel {\n  return (\n    typeof value === 'string' &&\n    Object.values(TrustLevel).includes(value as TrustLevel)\n  );\n}\n\n/**\n * Asserts that a trust level transition is valid.\n * UNTRUSTED -> VERIFIED (via policy evaluation) is the only escalation path.\n * TRUSTED is never reachable from external requests.\n */\nexport function assertValidTransition(\n  from: TrustLevel,\n  to: TrustLevel,\n): void {\n  if (to === TrustLevel.TRUSTED) {\n    throw new TrustEscalationError(\n      'Cannot escalate to TRUSTED level. TRUSTED is reserved for system-internal operations.',\n    );\n  }\n  if (from === TrustLevel.VERIFIED && to === TrustLevel.UNTRUSTED) {\n    return; // Downgrade is always allowed (fail-safe)\n  }\n  if (from === TrustLevel.UNTRUSTED && to === TrustLevel.VERIFIED) {\n    return; // Normal escalation via policy evaluation\n  }\n  if (from === to) {\n    return; // No-op\n  }\n  throw new TrustEscalationError(\n    `Invalid trust transition from ${from} to ${to}`,\n  );\n}\n","import { z } from 'zod';\n\n/**\n * Permission types are ALWAYS evaluated independently.\n * Having READ does NOT imply WRITE or EXECUTE.\n */\nexport const Permission = {\n  READ: 'READ',\n  WRITE: 'WRITE',\n  EXECUTE: 'EXECUTE',\n} as const;\n\nexport type Permission = (typeof Permission)[keyof typeof Permission];\n\nexport const PermissionSchema = z.enum(['READ', 'WRITE', 'EXECUTE']);\n\n/** Immutable set of permissions granted to a specific scope. */\nexport type PermissionSet = ReadonlySet<Permission>;\n\n/** Creates an immutable permission set from an array. */\nexport function createPermissionSet(\n  permissions: Permission[],\n): PermissionSet {\n  for (const p of permissions) {\n    PermissionSchema.parse(p);\n  }\n  return new Set(permissions) as ReadonlySet<Permission>;\n}\n\n/** Empty permission set - the default for all new tools (default-deny). */\nexport const NO_PERMISSIONS: PermissionSet = Object.freeze(\n  new Set<Permission>(),\n) as ReadonlySet<Permission>;\n\n/** Read-only permission set - the maximum default for new tools. */\nexport const READ_ONLY: PermissionSet = Object.freeze(\n  new Set<Permission>([Permission.READ]),\n) as ReadonlySet<Permission>;\n\nexport function hasPermission(\n  permissions: PermissionSet,\n  required: Permission,\n): boolean {\n  return permissions.has(required);\n}\n\nexport function hasAllPermissions(\n  permissions: PermissionSet,\n  required: Permission[],\n): boolean {\n  return required.every((p) => permissions.has(p));\n}\n\n/** Maps MCP protocol methods to SolonGate permission types. */\nexport function permissionForMethod(method: string): Permission {\n  if (\n    method.startsWith('resources/') ||\n    method.startsWith('prompts/') ||\n    method === 'tools/list'\n  ) {\n    return Permission.READ;\n  }\n  if (method === 'tools/call') {\n    return Permission.EXECUTE;\n  }\n  // Default to EXECUTE for unknown methods (most restrictive)\n  return Permission.EXECUTE;\n}\n","import { z } from 'zod';\nimport type { Permission } from './permissions.js';\nimport type { TrustLevel } from './trust.js';\n\n/**\n * Policy effect: the only two outcomes of policy evaluation.\n * No \"MAYBE\" or \"CONDITIONAL\" - binary security decisions only.\n */\nexport const PolicyEffect = {\n  ALLOW: 'ALLOW',\n  DENY: 'DENY',\n} as const;\n\nexport type PolicyEffect = (typeof PolicyEffect)[keyof typeof PolicyEffect];\n\n/**\n * A single policy rule that matches against execution requests.\n * Rules are evaluated by priority order. First matching rule wins.\n * If NO rule matches, the result is DENY (default-deny).\n */\nexport interface PolicyRule {\n  readonly id: string;\n  readonly description: string;\n  readonly effect: PolicyEffect;\n  readonly priority: number;\n  readonly toolPattern: string;\n  readonly permission: Permission;\n  readonly minimumTrustLevel: TrustLevel;\n  readonly argumentConstraints?: Record<string, unknown>;\n  readonly pathConstraints?: {\n    readonly allowed?: readonly string[];\n    readonly denied?: readonly string[];\n    readonly rootDirectory?: string;\n    readonly allowSymlinks?: boolean;\n  };\n  readonly commandConstraints?: {\n    readonly allowed?: readonly string[];\n    readonly denied?: readonly string[];\n  };\n  readonly filenameConstraints?: {\n    readonly allowed?: readonly string[];\n    readonly denied?: readonly string[];\n  };\n  readonly urlConstraints?: {\n    readonly allowed?: readonly string[];\n    readonly denied?: readonly string[];\n  };\n  readonly enabled: boolean;\n  readonly createdAt: string;\n  readonly updatedAt: string;\n}\n\n/**\n * A versioned, ordered set of policy rules.\n * Modifications create new sets (immutable by convention).\n */\nexport interface PolicySet {\n  readonly id: string;\n  readonly name: string;\n  readonly description: string;\n  readonly version: number;\n  readonly rules: readonly PolicyRule[];\n  readonly createdAt: string;\n  readonly updatedAt: string;\n}\n\nexport const PolicyRuleSchema = z.object({\n  id: z.string().min(1).max(256),\n  description: z.string().max(1024),\n  effect: z.enum(['ALLOW', 'DENY']),\n  priority: z.number().int().min(0).max(10000).default(1000),\n  toolPattern: z.string().min(1).max(512),\n  permission: z.enum(['READ', 'WRITE', 'EXECUTE']),\n  minimumTrustLevel: z.enum(['UNTRUSTED', 'VERIFIED', 'TRUSTED']),\n  argumentConstraints: z.record(z.unknown()).optional(),\n  pathConstraints: z\n    .object({\n      allowed: z.array(z.string()).optional(),\n      denied: z.array(z.string()).optional(),\n      rootDirectory: z.string().optional(),\n      allowSymlinks: z.boolean().optional(),\n    })\n    .optional(),\n  commandConstraints: z\n    .object({\n      allowed: z.array(z.string()).optional(),\n      denied: z.array(z.string()).optional(),\n    })\n    .optional(),\n  filenameConstraints: z\n    .object({\n      allowed: z.array(z.string()).optional(),\n      denied: z.array(z.string()).optional(),\n    })\n    .optional(),\n  urlConstraints: z\n    .object({\n      allowed: z.array(z.string()).optional(),\n      denied: z.array(z.string()).optional(),\n    })\n    .optional(),\n  enabled: z.boolean().default(true),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\n\nexport const PolicySetSchema = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(256),\n  description: z.string().max(2048),\n  version: z.number().int().min(0),\n  rules: z.array(PolicyRuleSchema),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\n\n/** The result of evaluating a policy against a request. */\nexport interface PolicyDecision {\n  readonly effect: PolicyEffect;\n  readonly matchedRule: PolicyRule | null;\n  readonly reason: string;\n  readonly timestamp: string;\n  readonly evaluationTimeMs: number;\n  readonly metadata?: {\n    readonly evaluatedRules: number;\n    readonly ruleIds: readonly string[];\n    readonly requestContext: {\n      readonly tool: string;\n      readonly arguments: readonly string[];\n    };\n  };\n}\n","import type { Permission } from './permissions.js';\n\n/**\n * Declares a tool's capabilities and security requirements.\n * Wraps MCP tool definitions with SolonGate-specific metadata.\n */\nexport interface ToolCapability {\n  readonly name: string;\n  readonly description: string;\n  readonly serverName: string;\n\n  /** Maximum permissions this tool CAN request (capability ceiling). */\n  readonly maxPermissions: readonly Permission[];\n\n  /** Default permissions when no explicit policy exists. Must be empty in Phase 0 (default-deny). */\n  readonly defaultPermissions: readonly Permission[];\n\n  readonly inputSchema: Record<string, unknown>;\n\n  /** Tools with side effects cannot be READ-only. */\n  readonly hasSideEffects: boolean;\n\n  /** Sensitive data access affects audit log redaction behavior. */\n  readonly accessesSensitiveData: boolean;\n\n  /** Max calls per minute. 0 = unlimited. */\n  readonly rateLimitPerMinute: number;\n}\n\n/** Creates a ToolCapability with the most restrictive secure defaults. */\nexport function createToolCapability(\n  params: Pick<ToolCapability, 'name' | 'description' | 'serverName' | 'inputSchema'> &\n    Partial<Omit<ToolCapability, 'name' | 'description' | 'serverName' | 'inputSchema'>>,\n): ToolCapability {\n  return {\n    maxPermissions: [],\n    defaultPermissions: [],\n    hasSideEffects: true,\n    accessesSensitiveData: true,\n    rateLimitPerMinute: 60,\n    ...params,\n  };\n}\n","import type { TrustLevel } from './trust.js';\nimport type { PermissionSet } from './permissions.js';\n\n/**\n * SecurityContext represents the security state of a single request.\n * Created fresh for each MCP request and NEVER reused.\n * All fields are readonly - state transitions create new contexts.\n */\nexport interface SecurityContext {\n  readonly requestId: string;\n  readonly trustLevel: TrustLevel;\n  readonly grantedPermissions: PermissionSet;\n  readonly sessionId: string | null;\n  readonly createdAt: string;\n  readonly metadata: Readonly<Record<string, unknown>>;\n  readonly capabilityToken?: string;\n}\n\n/** Extends SecurityContext with tool-specific execution information. */\nexport interface ExecutionContext extends SecurityContext {\n  readonly toolName: string;\n  readonly serverName: string;\n  readonly arguments: Readonly<Record<string, unknown>>;\n}\n\n/** Creates a new SecurityContext with default-deny settings. */\nexport function createSecurityContext(\n  params: Pick<SecurityContext, 'requestId'> &\n    Partial<Omit<SecurityContext, 'requestId' | 'createdAt' | 'trustLevel' | 'grantedPermissions'>>,\n): SecurityContext {\n  return {\n    trustLevel: 'UNTRUSTED',\n    grantedPermissions: new Set(),\n    sessionId: null,\n    metadata: {},\n    createdAt: new Date().toISOString(),\n    ...params,\n  };\n}\n","/** Default policy effect when no rule matches: DENY */\nexport const DEFAULT_POLICY_EFFECT = 'DENY' as const;\n\n/** Maximum number of rules in a single PolicySet */\nexport const MAX_RULES_PER_POLICY_SET = 1000;\n\n/** Maximum depth for nested argument validation */\nexport const MAX_ARGUMENT_DEPTH = 10;\n\n/** Maximum size of tool arguments in bytes */\nexport const MAX_ARGUMENTS_SIZE_BYTES = 1_048_576; // 1MB\n\n/** Maximum length of a tool name */\nexport const MAX_TOOL_NAME_LENGTH = 256;\n\n/** Maximum length of a server name */\nexport const MAX_SERVER_NAME_LENGTH = 256;\n\n/** Default rate limit per tool per minute */\nexport const DEFAULT_RATE_LIMIT_PER_MINUTE = 60;\n\n/** Maximum rate limit per tool per minute */\nexport const MAX_RATE_LIMIT_PER_MINUTE = 10_000;\n\n/** Security context timeout in milliseconds (5 minutes) */\nexport const SECURITY_CONTEXT_TIMEOUT_MS = 5 * 60 * 1000;\n\n/** Policy evaluation timeout in milliseconds (100ms) */\nexport const POLICY_EVALUATION_TIMEOUT_MS = 100;\n\n// --- Input Guard Constants ---\n\n/** Default maximum length per string argument */\nexport const INPUT_GUARD_MAX_LENGTH = 4096;\n\n/** Shannon entropy threshold for encoded payload detection */\nexport const INPUT_GUARD_ENTROPY_THRESHOLD = 4.5;\n\n/** Minimum string length before entropy check applies */\nexport const INPUT_GUARD_MIN_ENTROPY_LENGTH = 32;\n\n/** Maximum wildcards allowed per value */\nexport const INPUT_GUARD_MAX_WILDCARDS = 3;\n\n// --- Token Constants ---\n\n/** Default capability token TTL in seconds */\nexport const TOKEN_DEFAULT_TTL_SECONDS = 30;\n\n/** Minimum secret key length for HMAC signing */\nexport const TOKEN_MIN_SECRET_LENGTH = 32;\n\n/** Maximum token age before forced expiry (5 minutes) */\nexport const TOKEN_MAX_AGE_SECONDS = 300;\n\n// --- Rate Limiter Constants ---\n\n/** Default sliding window size in milliseconds (1 minute) */\nexport const RATE_LIMIT_WINDOW_MS = 60_000;\n\n/** Maximum entries to keep per tool before cleanup */\nexport const RATE_LIMIT_MAX_ENTRIES = 10_000;\n\n/** Warning messages for unsafe configurations. */\nexport const UNSAFE_CONFIGURATION_WARNINGS = {\n  WILDCARD_ALLOW:\n    'Wildcard ALLOW rules grant permission to ALL tools. This bypasses the default-deny model.',\n  TRUSTED_LEVEL_EXTERNAL:\n    'Setting trust level to TRUSTED for external requests bypasses all security checks.',\n  WRITE_WITHOUT_READ:\n    'Granting WRITE without READ is unusual and may indicate a misconfiguration.',\n  EXECUTE_WITHOUT_REVIEW:\n    'EXECUTE permission allows tools to perform arbitrary actions. Review carefully.',\n  RATE_LIMIT_ZERO:\n    'A rate limit of 0 means unlimited calls. This removes protection against runaway loops.',\n  DISABLED_VALIDATION:\n    'Disabling schema validation removes input sanitization protections.',\n} as const;\n","/**\n * Types that bridge between the MCP protocol and SolonGate's type system.\n * Adapts MCP SDK types without creating a hard dependency.\n */\n\nexport interface McpToolDefinition {\n  readonly name: string;\n  readonly description?: string;\n  readonly inputSchema: {\n    readonly type: 'object';\n    readonly properties?: Record<string, unknown>;\n    readonly required?: readonly string[];\n  };\n}\n\nexport interface McpCallToolParams {\n  readonly name: string;\n  readonly arguments?: Record<string, unknown>;\n}\n\nexport interface McpCallToolResult {\n  readonly content: readonly McpToolResultContent[];\n  readonly isError?: boolean;\n  readonly structuredContent?: unknown;\n}\n\nexport type McpToolResultContent =\n  | { readonly type: 'text'; readonly text: string }\n  | { readonly type: 'image'; readonly data: string; readonly mimeType: string }\n  | { readonly type: 'resource'; readonly resource: unknown };\n\n/** Wraps denied tool calls in MCP error responses. */\nexport function createDeniedToolResult(\n  reason: string,\n): McpCallToolResult {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: JSON.stringify({\n          error: 'POLICY_DENIED',\n          message: reason,\n          hint: 'This tool call was blocked by SolonGate security policy. Check your policy configuration.',\n        }),\n      },\n    ],\n    isError: true,\n  };\n}\n","import { z, type ZodTypeAny } from 'zod';\nimport { MAX_ARGUMENT_DEPTH, MAX_ARGUMENTS_SIZE_BYTES } from './constants.js';\n\n/**\n * Result of schema validation.\n * Always includes structured errors for programmatic handling.\n */\nexport interface SchemaValidationResult {\n  readonly valid: boolean;\n  readonly errors: readonly string[];\n  readonly sanitized: Readonly<Record<string, unknown>> | null;\n}\n\n/**\n * Options for schema validation behavior.\n */\nexport interface SchemaValidatorOptions {\n  readonly maxDepth?: number;\n  readonly maxSizeBytes?: number;\n  readonly stripUnknown?: boolean;\n}\n\nconst DEFAULT_OPTIONS: Required<SchemaValidatorOptions> = {\n  maxDepth: MAX_ARGUMENT_DEPTH,\n  maxSizeBytes: MAX_ARGUMENTS_SIZE_BYTES,\n  stripUnknown: false,\n};\n\n/**\n * Validates tool input against a Zod schema with strict security enforcement.\n *\n * - Unknown fields are REJECTED (no additionalProperties)\n * - Type mismatches are REJECTED\n * - Required fields are ENFORCED\n * - Recursive depth is limited\n * - Argument size is limited\n */\nexport function validateToolInput(\n  schema: ZodTypeAny,\n  input: unknown,\n  options?: SchemaValidatorOptions,\n): SchemaValidationResult {\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const errors: string[] = [];\n\n  // 1. Size check - prevent oversized payloads\n  const sizeError = checkInputSize(input, opts.maxSizeBytes);\n  if (sizeError) {\n    return { valid: false, errors: [sizeError], sanitized: null };\n  }\n\n  // 2. Depth check - prevent deeply nested structures\n  const depthError = checkInputDepth(input, opts.maxDepth);\n  if (depthError) {\n    return { valid: false, errors: [depthError], sanitized: null };\n  }\n\n  // 3. Schema validation using Zod strict mode\n  const result = schema.safeParse(input);\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      const path = issue.path.length > 0 ? issue.path.join('.') : 'root';\n      errors.push(`${path}: ${issue.message}`);\n    }\n    return { valid: false, errors, sanitized: null };\n  }\n\n  return {\n    valid: true,\n    errors: [],\n    sanitized: result.data as Readonly<Record<string, unknown>>,\n  };\n}\n\n/**\n * Creates a strict Zod object schema that rejects unknown fields.\n * Wraps z.object().strict() for convenience.\n */\nexport function createStrictSchema(\n  shape: Record<string, ZodTypeAny>,\n): z.ZodObject<Record<string, ZodTypeAny>, 'strict'> {\n  return z.object(shape).strict();\n}\n\n/**\n * Checks if input size exceeds the maximum allowed bytes.\n */\nfunction checkInputSize(input: unknown, maxBytes: number): string | null {\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(input);\n  } catch {\n    return 'Input cannot be serialized to JSON';\n  }\n\n  const sizeBytes = new TextEncoder().encode(serialized).length;\n  if (sizeBytes > maxBytes) {\n    return `Input size ${sizeBytes} bytes exceeds maximum ${maxBytes} bytes`;\n  }\n  return null;\n}\n\n/**\n * Checks if input exceeds maximum nesting depth.\n * Prevents stack overflow and denial-of-service via deeply nested objects.\n */\nfunction checkInputDepth(input: unknown, maxDepth: number): string | null {\n  const depth = measureDepth(input, 0);\n  if (depth > maxDepth) {\n    return `Input depth ${depth} exceeds maximum ${maxDepth}`;\n  }\n  return null;\n}\n\nfunction measureDepth(value: unknown, currentDepth: number): number {\n  if (currentDepth > MAX_ARGUMENT_DEPTH + 1) {\n    return currentDepth; // Early exit to prevent stack overflow\n  }\n\n  if (value === null || value === undefined || typeof value !== 'object') {\n    return currentDepth;\n  }\n\n  if (Array.isArray(value)) {\n    let maxChildDepth = currentDepth + 1;\n    for (const item of value) {\n      const childDepth = measureDepth(item, currentDepth + 1);\n      if (childDepth > maxChildDepth) maxChildDepth = childDepth;\n    }\n    return maxChildDepth;\n  }\n\n  let maxChildDepth = currentDepth + 1;\n  for (const key of Object.keys(value as Record<string, unknown>)) {\n    const childDepth = measureDepth(\n      (value as Record<string, unknown>)[key],\n      currentDepth + 1,\n    );\n    if (childDepth > maxChildDepth) maxChildDepth = childDepth;\n  }\n  return maxChildDepth;\n}\n","/**\n * Input Guard: detects and blocks dangerous patterns in tool arguments.\n *\n * Prevents physical execution of injected instructions by checking for:\n * - Path traversal attacks (../, ..\\, encoded variants)\n * - Shell injection (;, |, &, `, $(), etc.)\n * - Wildcard abuse (**, recursive globs)\n * - Excessive length\n * - High-entropy payloads (potential encoded exploits)\n */\n\n/** Threat type detected by input guard. */\nexport type ThreatType =\n  | 'PATH_TRAVERSAL'\n  | 'SHELL_INJECTION'\n  | 'WILDCARD_ABUSE'\n  | 'LENGTH_EXCEEDED'\n  | 'HIGH_ENTROPY'\n  | 'SSRF'\n  | 'SQL_INJECTION';\n\n/** A detected threat with details. */\nexport interface DetectedThreat {\n  readonly type: ThreatType;\n  readonly field: string;\n  readonly value: string;\n  readonly description: string;\n}\n\n/** Result of sanitization check. */\nexport interface SanitizationResult {\n  readonly safe: boolean;\n  readonly threats: readonly DetectedThreat[];\n}\n\n/** Configuration for input guard checks. */\nexport interface InputGuardConfig {\n  readonly pathTraversal: boolean;\n  readonly shellInjection: boolean;\n  readonly wildcardAbuse: boolean;\n  readonly lengthLimit: number;\n  readonly entropyLimit: boolean;\n  readonly ssrf: boolean;\n  readonly sqlInjection: boolean;\n}\n\nexport const DEFAULT_INPUT_GUARD_CONFIG: Readonly<InputGuardConfig> =\n  Object.freeze({\n    pathTraversal: true,\n    shellInjection: true,\n    wildcardAbuse: true,\n    lengthLimit: 4096,\n    entropyLimit: true,\n    ssrf: true,\n    sqlInjection: true,\n  });\n\n// --- Path Traversal Detection ---\n\nconst PATH_TRAVERSAL_PATTERNS = [\n  /\\.\\.\\//,          // ../\n  /\\.\\.\\\\/,          // ..\\\n  /%2e%2e/i,         // URL-encoded ..\n  /%2e\\./i,          // partial URL-encoded\n  /\\.%2e/i,          // partial URL-encoded\n  /%252e%252e/i,     // double URL-encoded\n  /\\.\\.\\0/,          // null byte variant\n];\n\nconst SENSITIVE_PATHS = [\n  /\\/etc\\/passwd/i,\n  /\\/etc\\/shadow/i,\n  /\\/proc\\//i,\n  /\\/dev\\//i,\n  /c:\\\\windows\\\\system32/i,\n  /c:\\\\windows\\\\syswow64/i,\n  /\\/root\\//i,\n  /~\\//,\n  /\\.env(\\.|$)/i,                    // .env, .env.local, .env.production\n  /\\.aws\\/credentials/i,            // AWS credentials\n  /\\.ssh\\/id_/i,                     // SSH keys\n  /\\.kube\\/config/i,                 // Kubernetes config\n  /wp-config\\.php/i,                 // WordPress config\n  /\\.git\\/config/i,                  // Git config\n  /\\.npmrc/i,                        // npm credentials\n  /\\.pypirc/i,                       // PyPI credentials\n];\n\nexport function detectPathTraversal(value: string): boolean {\n  for (const pattern of PATH_TRAVERSAL_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  for (const pattern of SENSITIVE_PATHS) {\n    if (pattern.test(value)) return true;\n  }\n  return false;\n}\n\n// --- Shell Injection Detection ---\n\nconst SHELL_INJECTION_PATTERNS = [\n  /[;|&`]/,          // Command separators and backtick execution\n  /\\$\\(/,            // Command substitution $(...)\n  /\\$\\{/,            // Variable expansion ${...}\n  />\\s*/,            // Output redirect\n  /<\\s*/,            // Input redirect\n  /&&/,              // AND chaining\n  /\\|\\|/,            // OR chaining\n  /\\beval\\b/i,       // eval command\n  /\\bexec\\b/i,       // exec command\n  /\\bsystem\\b/i,     // system call\n  /%0a/i,            // URL-encoded newline\n  /%0d/i,            // URL-encoded carriage return\n  /%09/i,            // URL-encoded tab\n  /\\r\\n/,            // CRLF injection\n  /\\n/,              // Newline (command separator on Unix)\n];\n\nexport function detectShellInjection(value: string): boolean {\n  for (const pattern of SHELL_INJECTION_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  return false;\n}\n\n// --- Wildcard Abuse Detection ---\n\nconst MAX_WILDCARDS_PER_VALUE = 3;\n\nexport function detectWildcardAbuse(value: string): boolean {\n  // Block recursive globs\n  if (value.includes('**')) return true;\n\n  // Count wildcards\n  const wildcardCount = (value.match(/\\*/g) || []).length;\n  if (wildcardCount > MAX_WILDCARDS_PER_VALUE) return true;\n\n  return false;\n}\n\n// --- SSRF Detection ---\n\nconst SSRF_PATTERNS = [\n  /^https?:\\/\\/localhost\\b/i,\n  /^https?:\\/\\/127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/,\n  /^https?:\\/\\/0\\.0\\.0\\.0/,\n  /^https?:\\/\\/\\[::1\\]/,                         // IPv6 loopback\n  /^https?:\\/\\/10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/,  // 10.x.x.x\n  /^https?:\\/\\/172\\.(1[6-9]|2\\d|3[01])\\./,       // 172.16-31.x.x\n  /^https?:\\/\\/192\\.168\\./,                       // 192.168.x.x\n  /^https?:\\/\\/169\\.254\\./,                       // Link-local / AWS metadata\n  /metadata\\.google\\.internal/i,                  // GCP metadata\n  /^https?:\\/\\/metadata\\b/i,                      // Generic metadata endpoint\n  // IPv6 bypass patterns\n  /^https?:\\/\\/\\[fe80:/i,                         // IPv6 link-local\n  /^https?:\\/\\/\\[fc00:/i,                         // IPv6 unique local\n  /^https?:\\/\\/\\[fd[0-9a-f]{2}:/i,               // IPv6 unique local (fd00::/8)\n  /^https?:\\/\\/\\[::ffff:127\\./i,                  // IPv4-mapped IPv6 loopback\n  /^https?:\\/\\/\\[::ffff:10\\./i,                   // IPv4-mapped IPv6 private\n  /^https?:\\/\\/\\[::ffff:172\\.(1[6-9]|2\\d|3[01])\\./i, // IPv4-mapped IPv6 private\n  /^https?:\\/\\/\\[::ffff:192\\.168\\./i,             // IPv4-mapped IPv6 private\n  /^https?:\\/\\/\\[::ffff:169\\.254\\./i,             // IPv4-mapped IPv6 link-local\n  // Hex IP bypass (e.g., 0x7f000001 = 127.0.0.1)\n  /^https?:\\/\\/0x[0-9a-f]+\\b/i,\n  // Octal IP bypass (e.g., 0177.0.0.1 = 127.0.0.1)\n  /^https?:\\/\\/0[0-7]{1,3}\\./,\n];\n\n/**\n * Detects decimal IP representation (e.g., http://2130706433 = 127.0.0.1).\n * Converts decimal to IPv4 and checks if it's in a private/loopback range.\n */\nfunction detectDecimalIP(value: string): boolean {\n  const match = value.match(/^https?:\\/\\/(\\d{8,10})(?:[:/]|$)/);\n  if (!match || !match[1]) return false;\n\n  const decimal = parseInt(match[1], 10);\n  if (isNaN(decimal) || decimal > 0xffffffff) return false;\n\n  // Check private/loopback ranges\n  return (\n    (decimal >= 0x7f000000 && decimal <= 0x7fffffff) || // 127.0.0.0/8\n    (decimal >= 0x0a000000 && decimal <= 0x0affffff) || // 10.0.0.0/8\n    (decimal >= 0xac100000 && decimal <= 0xac1fffff) || // 172.16.0.0/12\n    (decimal >= 0xc0a80000 && decimal <= 0xc0a8ffff) || // 192.168.0.0/16\n    (decimal >= 0xa9fe0000 && decimal <= 0xa9feffff) || // 169.254.0.0/16\n    decimal === 0                                        // 0.0.0.0\n  );\n}\n\nexport function detectSSRF(value: string): boolean {\n  for (const pattern of SSRF_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  // Check for decimal IP bypass\n  if (detectDecimalIP(value)) return true;\n  return false;\n}\n\n// --- SQL Injection Detection ---\n\nconst SQL_INJECTION_PATTERNS = [\n  /'\\s{0,20}(OR|AND)\\s{0,20}'.{0,200}'/i,  // ' OR '1'='1 — bounded to prevent ReDoS\n  /'\\s{0,10};\\s{0,10}(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|EXEC)/i, // '; DROP TABLE\n  /UNION\\s+(ALL\\s+)?SELECT/i,       // UNION SELECT\n  /--\\s*$/m,                         // SQL comment at end of line\n  /\\/\\*.{0,500}?\\*\\//,              // SQL block comment — bounded + non-greedy\n  /\\bSLEEP\\s*\\(/i,                  // Time-based injection\n  /\\bBENCHMARK\\s*\\(/i,              // MySQL benchmark\n  /\\bWAITFOR\\s+DELAY/i,             // MSSQL delay\n  /\\b(LOAD_FILE|INTO\\s+OUTFILE|INTO\\s+DUMPFILE)\\b/i, // File operations\n];\n\nexport function detectSQLInjection(value: string): boolean {\n  for (const pattern of SQL_INJECTION_PATTERNS) {\n    if (pattern.test(value)) return true;\n  }\n  return false;\n}\n\n// --- Length Check ---\n\nexport function checkLengthLimits(\n  value: string,\n  maxLength: number = 4096,\n): boolean {\n  return value.length <= maxLength;\n}\n\n// --- Entropy Detection ---\n\n/**\n * Detects high-entropy strings that may indicate encoded payloads.\n * Uses Shannon entropy calculation.\n * Threshold: 4.5 bits per character (base64 encoded data is ~6.0).\n */\nconst ENTROPY_THRESHOLD = 4.5;\nconst MIN_LENGTH_FOR_ENTROPY_CHECK = 32;\n\nexport function checkEntropyLimits(value: string): boolean {\n  if (value.length < MIN_LENGTH_FOR_ENTROPY_CHECK) return true; // Too short to be meaningful\n\n  const entropy = calculateShannonEntropy(value);\n  return entropy <= ENTROPY_THRESHOLD;\n}\n\nfunction calculateShannonEntropy(str: string): number {\n  const freq = new Map<string, number>();\n  for (const char of str) {\n    freq.set(char, (freq.get(char) ?? 0) + 1);\n  }\n\n  let entropy = 0;\n  const len = str.length;\n  for (const count of freq.values()) {\n    const p = count / len;\n    if (p > 0) {\n      entropy -= p * Math.log2(p);\n    }\n  }\n  return entropy;\n}\n\n// --- Main Sanitization Function ---\n\n/**\n * Runs all input guard checks on a value.\n * Returns structured result with all detected threats.\n */\nexport function sanitizeInput(\n  field: string,\n  value: unknown,\n  config: InputGuardConfig = DEFAULT_INPUT_GUARD_CONFIG,\n): SanitizationResult {\n  const threats: DetectedThreat[] = [];\n\n  if (typeof value !== 'string') {\n    // For non-string values, recursively check string values in objects/arrays\n    if (typeof value === 'object' && value !== null) {\n      return sanitizeObject(field, value, config);\n    }\n    return { safe: true, threats: [] };\n  }\n\n  if (config.pathTraversal && detectPathTraversal(value)) {\n    threats.push({\n      type: 'PATH_TRAVERSAL',\n      field,\n      value: truncate(value, 100),\n      description: 'Path traversal pattern detected',\n    });\n  }\n\n  if (config.shellInjection && detectShellInjection(value)) {\n    threats.push({\n      type: 'SHELL_INJECTION',\n      field,\n      value: truncate(value, 100),\n      description: 'Shell injection pattern detected',\n    });\n  }\n\n  if (config.wildcardAbuse && detectWildcardAbuse(value)) {\n    threats.push({\n      type: 'WILDCARD_ABUSE',\n      field,\n      value: truncate(value, 100),\n      description: 'Wildcard abuse pattern detected',\n    });\n  }\n\n  if (!checkLengthLimits(value, config.lengthLimit)) {\n    threats.push({\n      type: 'LENGTH_EXCEEDED',\n      field,\n      value: `[${value.length} chars]`,\n      description: `Value exceeds maximum length of ${config.lengthLimit}`,\n    });\n  }\n\n  if (config.entropyLimit && !checkEntropyLimits(value)) {\n    threats.push({\n      type: 'HIGH_ENTROPY',\n      field,\n      value: truncate(value, 100),\n      description: 'High entropy string detected - possible encoded payload',\n    });\n  }\n\n  if (config.ssrf && detectSSRF(value)) {\n    threats.push({\n      type: 'SSRF',\n      field,\n      value: truncate(value, 100),\n      description: 'Server-side request forgery pattern detected — internal/metadata URL blocked',\n    });\n  }\n\n  if (config.sqlInjection && detectSQLInjection(value)) {\n    threats.push({\n      type: 'SQL_INJECTION',\n      field,\n      value: truncate(value, 100),\n      description: 'SQL injection pattern detected',\n    });\n  }\n\n  return { safe: threats.length === 0, threats };\n}\n\n/**\n * Recursively sanitizes all string values in an object or array.\n */\nfunction sanitizeObject(\n  basePath: string,\n  obj: object,\n  config: InputGuardConfig,\n): SanitizationResult {\n  const threats: DetectedThreat[] = [];\n\n  if (Array.isArray(obj)) {\n    for (let i = 0; i < obj.length; i++) {\n      const result = sanitizeInput(`${basePath}[${i}]`, obj[i], config);\n      threats.push(...result.threats);\n    }\n  } else {\n    for (const [key, val] of Object.entries(obj)) {\n      const result = sanitizeInput(`${basePath}.${key}`, val, config);\n      threats.push(...result.threats);\n    }\n  }\n\n  return { safe: threats.length === 0, threats };\n}\n\nfunction truncate(str: string, maxLen: number): string {\n  return str.length > maxLen ? str.slice(0, maxLen) + '...' : str;\n}\n","import type { Permission } from './permissions.js';\n\n/**\n * Capability Token: a signed, short-lived, single-use token\n * that authorizes execution of specific tools within specific scopes.\n *\n * Security properties:\n * - Short-lived: TTL defaults to 30 seconds\n * - Single-use: nonce prevents replay attacks\n * - Scoped: limited to specific tools and servers\n * - Signed: HMAC-SHA256 prevents forgery\n */\nexport interface CapabilityToken {\n  readonly jti: string;           // Unique token ID (nonce)\n  readonly iss: string;           // Issuer (gateway ID)\n  readonly sub: string;           // Subject (request ID)\n  readonly iat: number;           // Issued at (unix timestamp)\n  readonly exp: number;           // Expires at (unix timestamp)\n  readonly permissions: readonly Permission[];\n  readonly toolScope: readonly string[];    // Which tools this token covers\n  readonly serverScope: readonly string[];  // Which servers\n  readonly pathScope?: readonly string[];   // Optional path restrictions\n}\n\n/**\n * Configuration for token issuance.\n */\nexport interface TokenConfig {\n  readonly secret: string;        // HMAC signing key\n  readonly ttlSeconds: number;    // Default 30 seconds\n  readonly algorithm: 'HS256';    // Start with HMAC\n  readonly issuer: string;\n}\n\n/**\n * Default token configuration.\n * Secret must be provided - no default.\n */\nexport const DEFAULT_TOKEN_TTL_SECONDS = 30;\nexport const TOKEN_ALGORITHM = 'HS256' as const;\nexport const MIN_SECRET_LENGTH = 32;\n\n/**\n * Result of token verification.\n */\nexport interface TokenVerificationResult {\n  readonly valid: boolean;\n  readonly payload?: CapabilityToken;\n  readonly reason?: string;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",