@squadrules/mcp 4.8.6

package/dist/config.d.ts

@@ -0,0 +1,165 @@
+/**
+ * Centralized configuration for environment variables.
+ * This file contains all environment variable parsing logic.
+ * KEY_VALUE_STORE_URL (or REDIS_URL): when set (non-empty) → key-value backend;
+ * when unset or empty → in-memory backend. QDRANT_URL is always required.
+ */
+export { parseLocalArtifactDirHints } from './utils/kairos-local-artifact-dirs.js';
+export declare const REDIS_URL: string;
+/** Single source of truth: whether a shared key-value backend is available. */
+export declare const isRedisConfigured: boolean;
+export declare const KAIROS_REDIS_PREFIX: string;
+export declare const OIDC_STATE_KEY_PREFIX = "oidc-state:";
+/**
+ * Ordered URI hints emitted as the `kairos_local_artifact_dir` response field
+ * (preferred first). The client resolves a hint on its own filesystem and
+ * exports `KAIROS_LOCAL_ARTIFACT_DIR` (alias `SQUADRULES_LOCAL_ARTIFACT_DIR`)
+ * for shell challenges. Override the defaults via the comma-separated env
+ * `KAIROS_LOCAL_ARTIFACT_DIRS` (alias `SQUADRULES_LOCAL_ARTIFACT_DIRS`).
+ */
+export declare const KAIROS_LOCAL_ARTIFACT_DIRS: readonly string[];
+/** Memory cache key prefix; keys starting with this are global (no space namespace). One key per UUID. */
+export declare const MEMORY_CACHE_KEY_PREFIX = "mem:";
+export declare const OPENAI_EMBEDDING_MODEL: string;
+/** Base URL for OpenAI API (e.g. https://api.openai.com or Azure endpoint). No trailing slash. */
+export declare const OPENAI_API_URL: string;
+export declare const OPENAI_API_KEY: string;
+export declare const EMBEDDING_PROVIDER: string;
+export declare const TEI_BASE_URL: string;
+export declare const TEI_MODEL: string;
+export declare const TEI_API_KEY: string;
+export declare const EMBEDDING_LATENCY_WARN_MS: number;
+export declare const EMBEDDING_NORM_MIN: number;
+export declare const EMBEDDING_NORM_MAX: number;
+/** Retry policy for embedding 429/5xx/network. Exponential backoff+jitter; Retry-After honored; insufficient_quota fails fast. */
+export declare const EMBEDDING_MAX_RETRIES: number;
+export declare const EMBEDDING_RETRY_BASE_DELAY_MS: number;
+export declare const EMBEDDING_RETRY_MAX_DELAY_MS: number;
+export declare const EMBEDDING_RETRY_AFTER_CAP_MS: number;
+/** Total wall-clock budget for all embedding retries. Once exceeded, no further retries. */
+export declare const EMBEDDING_RETRY_BUDGET_MS: number;
+/** Wall-clock cap for comment PoW semantic check. On timeout, fail open. Set to 0 to skip. */
+export declare const COMMENT_SEMANTIC_VALIDATION_TIMEOUT_MS: number;
+export declare const SEARCH_SCORE_WARN_THRESHOLD: number;
+export declare const LOG_LEVEL: string;
+export declare const LOG_FORMAT: string;
+export declare const AUDIT_LOG_FILE: string;
+/**
+ * Verbosity for MCP audit events written to AUDIT_LOG_FILE (0-3).
+ * 0 = off, 1 = metadata only, 2 = + request args, 3 = + response body.
+ * Existing audit.embedding / audit.anomaly events are unaffected.
+ */
+export declare const AUDIT_LOG_LEVEL: number;
+export declare const QDRANT_API_KEY: string;
+export declare const QDRANT_COLLECTION_CURRENT: string;
+export declare const KAIROS_SEARCH_OVERFETCH_FACTOR: string;
+export declare const KAIROS_SEARCH_MAX_FETCH: number;
+/** Default number of match choices returned by search when the agent omits max_choices. */
+export declare const KAIROS_SEARCH_MAX_CHOICES: number;
+/** Absolute cap for search max_choices (prevents abuse and excessive resolveHead latency). */
+export declare const KAIROS_SEARCH_LIMIT_CAP: number;
+/** Minimum match choices when agent passes max_choices. */
+export declare const KAIROS_SEARCH_LIMIT_MIN: number;
+export declare const KAIROS_ENABLE_GROUP_COLLAPSE: boolean;
+export declare const HTTP_JSON_BODY_LIMIT: string;
+/** Max body size for POST /api/train/raw (`HTTP_TRAIN_RAW_BODY_LIMIT`, default 2mb). */
+export declare const HTTP_TRAIN_RAW_BODY_LIMIT: string;
+export declare const HTTP_RATE_LIMIT_WINDOW_MS: number;
+export declare const HTTP_RATE_LIMIT_MAX: number;
+export declare const AUTH_RATE_LIMIT_WINDOW_MS: number;
+export declare const AUTH_RATE_LIMIT_MAX: number;
+export declare const MCP_RATE_LIMIT_WINDOW_MS: number;
+export declare const MCP_RATE_LIMIT_MAX: number;
+/**
+ * When true, served MCP App widget HTML skips `ui/initialize` / `initialized` and ignores
+ * tool-result notifications (static chrome only). Use to isolate host crashes tied to the bridge.
+ */
+export declare const KAIROS_MCP_WIDGET_PRESENTATION_ONLY: boolean;
+export declare const AUTH_ENABLED: boolean;
+export declare const KEYCLOAK_URL: string;
+/** When set, used for server-side calls (e.g. token exchange). When unset, KEYCLOAK_URL is used. Use keycloak:8080 in Docker. */
+export declare const KEYCLOAK_INTERNAL_URL: string;
+export declare const KEYCLOAK_REALM: string;
+export declare const KEYCLOAK_CLIENT_ID: string;
+/** CLI browser login: public client ID (e.g. kairos-cli). Overridable at runtime by KAIROS_CLIENT_ID (alias SQUADRULES_CLIENT_ID). */
+export declare const KEYCLOAK_CLI_CLIENT_ID: string;
+/** Base URL for redirect_uri (e.g. http://localhost:3500). Must match Keycloak client redirect URIs. */
+export declare const AUTH_CALLBACK_BASE_URL: string;
+export declare const SESSION_SECRET: string;
+/** Session cookie and payload exp lifetime in seconds; default 7 hours. */
+export declare const SESSION_MAX_AGE_SEC: number;
+/**
+ * Comma-separated scopes advertised from `/.well-known/oauth-protected-resource`.
+ * Defaults to the baseline OIDC scopes required by SquadRules discovery; set explicitly
+ * to add scopes such as `offline_access` without rebuilding the container image.
+ */
+export declare const OIDC_SCOPES_SUPPORTED: readonly string[];
+/** When set to oidc_bearer, Bearer tokens are validated (issuer, audience, exp); when unset, Bearer presence only (backward compat). */
+export declare const AUTH_MODE: string;
+/** Comma-separated list of trusted JWT issuers (e.g. http://keycloak:8080/realms/kairos-dev). Required when AUTH_MODE=oidc_bearer. */
+export declare const AUTH_TRUSTED_ISSUERS_STRING: string;
+/** Comma-separated list of allowed JWT audiences (e.g. kairos-mcp). Required when AUTH_MODE=oidc_bearer. */
+export declare const AUTH_ALLOWED_AUDIENCES_STRING: string;
+/**
+ * Comma-separated group names (or /paths) allowed in the KAIROS auth session after OIDC.
+ * Only JWT `groups` entries that match any entry are kept:
+ * exact name or path (slash optional), or a **prefix** entry ending with `/` (e.g. `/shared/`
+ * keeps every group whose path starts with that prefix). Matching is **case-insensitive** for paths.
+ * Empty = do not filter: keep all token `groups` (recommended default so group spaces match IdP membership).
+ * To restrict, set entries; to approximate “no group spaces”, use an allowlist that matches nothing you issue (e.g. a dedicated sentinel name).
+ * Keycloak still issues full membership in the JWT; this filter controls what KAIROS forwards internally when non-empty.
+ */
+export declare const OIDC_GROUPS_ALLOWLIST: readonly string[];
+/**
+ * Bearer MCP auth: union groups from the verified access JWT with groups from OIDC userinfo (default true).
+ * Browser sessions merge id_token + access_token; Bearer clients often send an access token whose `groups`
+ * claim is incomplete or absent while userinfo still lists full membership — without merging, `spaces` omits
+ * group rows even though the UI (session) shows them.
+ */
+export declare const OIDC_BEARER_MERGE_USERINFO_GROUPS: boolean;
+export declare const KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX: string;
+/**
+ * Derive an illustrative full group path from the first path-prefix entry in
+ * `OIDC_GROUPS_ALLOWLIST` (entry ending with `/`). Returns null if none.
+ */
+export declare function deriveGroupSpacePathExampleFromAllowlist(allowlist: readonly string[], suffix: string): string | null;
+/**
+ * Example group path interpolated into MCP tool descriptions (`activate`, `spaces`,
+ * `train`, `tune`) at process start.
+ *
+ * - Set **`KAIROS_GROUP_SPACE_PATH_EXAMPLE`** to override completely.
+ * - Otherwise, if **`OIDC_GROUPS_ALLOWLIST`** contains a path-prefix entry (e.g. `/shared/`),
+ *   the example is `{prefix-without-trailing-slash}/{KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX}`.
+ * - Otherwise default **`/shared/{suffix}`** (suffix from `KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX`).
+ */
+export declare const GROUP_SPACE_PATH_EXAMPLE: string;
+/** Main HTTP listener when `TRANSPORT_TYPE=http`: UI, REST API, and Streamable HTTP MCP. Ignored in stdio mode (no HTTP server). */
+export declare const SERVER_PORT: number;
+export declare const QDRANT_RESCORE_STRING: string;
+/** When non-empty, backup/snapshot is enabled; app creates dir if missing. Empty = not configured → 503 on POST /api/snapshot. */
+export declare const QDRANT_SNAPSHOT_ON_START: boolean;
+export declare const QDRANT_SNAPSHOT_DIR: string;
+export declare const METRICS_PORT: number;
+/** Raw env: positive = override, -1 = disabled, 0 or unset = auto-detect from cgroup/memory. */
+export declare const MAX_CONCURRENT_MCP_REQUESTS_RAW: number;
+export declare const SCORE_THRESHOLD: number;
+/** Similar-memory: score >= this value triggers SIMILAR_MEMORY_FOUND. Set SIMILAR_MEMORY_THRESHOLD=1 to effectively disable. */
+export declare const SIMILAR_MEMORY_THRESHOLD: number;
+/** Attest boost: below this many runs we do not apply boost. */
+export declare const MIN_ATTEST_RUNS: number;
+/** Attest boost: at this many runs confidence is 1. */
+export declare const RUNS_FULL_CONFIDENCE: number;
+/** Max additive boost from attest (tiebreaker within RRF bands). */
+export declare const ATTEST_BOOST_MAX: number;
+export declare const TRANSPORT_TYPE: 'stdio' | 'http';
+export declare function getQdrantUrl(): string;
+export declare function getQdrantCollection(defaultValue?: string): string;
+export declare const AUTH_TRUSTED_ISSUERS: string[];
+export declare const AUTH_ALLOWED_AUDIENCES: string[];
+/** Embedded mem / default search space when AUTH_ENABLED=false; must follow space model (e.g. space:kairos-app). */
+export declare const KAIROS_APP_SPACE_ID: string;
+/** Simple-mode writable personal space id when AUTH_ENABLED=false and UUIDv5 seed override is not provided. */
+export declare const KAIROS_SIMPLE_PERSONAL_SPACE_ID: string;
+export declare const KAIROS_SIMPLE_PERSONAL_REALM: string;
+export declare const KAIROS_SIMPLE_PERSONAL_UUIDV5_SEED: string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAuCnF,eAAO,MAAM,SAAS,QAAuE,CAAC;AAC9F,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,SAAuB,CAAC;AACtD,eAAO,MAAM,mBAAmB,QAAsJ,CAAC;AACvL,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AACnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAEvD,CAAC;AACF,0GAA0G;AAC1G,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,sBAAsB,QAAmE,CAAC;AACvG,kGAAkG;AAClG,eAAO,MAAM,cAAc,QAA8E,CAAC;AAC1G,eAAO,MAAM,cAAc,QAAqC,CAAC;AACjE,eAAO,MAAM,kBAAkB,QAA6C,CAAC;AAC7E,eAAO,MAAM,YAAY,QAAmC,CAAC;AAC7D,eAAO,MAAM,SAAS,QAA6D,CAAC;AACpF,eAAO,MAAM,WAAW,QAAkC,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA+C,CAAC;AACtF,eAAO,MAAM,kBAAkB,QAAyC,CAAC;AACzE,eAAO,MAAM,kBAAkB,QAAyC,CAAC;AACzE,kIAAkI;AAClI,eAAO,MAAM,qBAAqB,QAAqD,CAAC;AACxF,eAAO,MAAM,6BAA6B,QAA+D,CAAC;AAC1G,eAAO,MAAM,4BAA4B,QAAgE,CAAC;AAC1G,eAAO,MAAM,4BAA4B,QAAiE,CAAC;AAC3G,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,QAA8D,CAAC;AACrG,8FAA8F;AAC9F,eAAO,MAAM,sCAAsC,QAA8D,CAAC;AAClH,eAAO,MAAM,2BAA2B,QAAkD,CAAC;AAC3F,eAAO,MAAM,SAAS,QAAoC,CAAC;AAC3D,eAAO,MAAM,UAAU,QAAqC,CAAC;AAC7D,eAAO,MAAM,cAAc,QAA4C,CAAC;AACxE;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAA4D,CAAC;AACzF,eAAO,MAAM,cAAc,QAAqC,CAAC;AACjE,eAAO,MAAM,yBAAyB,QAAgD,CAAC;AACvF,eAAO,MAAM,8BAA8B,QAA6F,CAAC;AACzI,eAAO,MAAM,uBAAuB,QAAkF,CAAC;AACvH,2FAA2F;AAC3F,eAAO,MAAM,yBAAyB,QAAqF,CAAC;AAC5H,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,QAAiF,CAAC;AACtH,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB,QAAgF,CAAC;AACrH,eAAO,MAAM,4BAA4B,SAAiG,CAAC;AAC3I,eAAO,MAAM,oBAAoB,QAA8C,CAAC;AAChF,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,QAAmD,CAAC;AAE1F,eAAO,MAAM,yBAAyB,QAAiD,CAAC;AACxF,eAAO,MAAM,mBAAmB,QAA2C,CAAC;AAC5E,eAAO,MAAM,yBAAyB,QAAiD,CAAC;AACxF,eAAO,MAAM,mBAAmB,QAAuC,CAAC;AACxE,eAAO,MAAM,wBAAwB,QAAgD,CAAC;AACtF,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AACxE;;;GAGG;AACH,eAAO,MAAM,mCAAmC,SAAgH,CAAC;AAIjK,eAAO,MAAM,YAAY,SAAsC,CAAC;AAChE,eAAO,MAAM,YAAY,QAAmC,CAAC;AAC7D,iIAAiI;AACjI,eAAO,MAAM,qBAAqB,QAA4C,CAAC;AAC/E,eAAO,MAAM,cAAc,QAA+C,CAAC;AAC3E,eAAO,MAAM,kBAAkB,QAAmD,CAAC;AACnF,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,QAAuD,CAAC;AAC3F,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,QAA6C,CAAC;AACjF,eAAO,MAAM,cAAc,QAAqC,CAAC;AACjE,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,QAA2C,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AAEF,wIAAwI;AACxI,eAAO,MAAM,SAAS,QAAgC,CAAC;AACvD,sIAAsI;AACtI,eAAO,MAAM,2BAA2B,QAA2C,CAAC;AACpF,4GAA4G;AAC5G,eAAO,MAAM,6BAA6B,QAA6C,CAAC;AACxF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAS/C,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,SAA2D,CAAC;AAO1G,eAAO,MAAM,iCAAiC,QAG/B,CAAC;AAEhB;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAE,MASnC,CAAC;AAEL,oIAAoI;AACpI,eAAO,MAAM,WAAW,QAAiC,CAAC;AAiB1D,eAAO,MAAM,qBAAqB,QAAyC,CAAC;AAC5E,kIAAkI;AAClI,eAAO,MAAM,wBAAwB,SAAmD,CAAC;AAEzF,eAAO,MAAM,mBAAmB,QAKa,CAAC;AAG9C,eAAO,MAAM,YAAY,QAAkC,CAAC;AAC5D,gGAAgG;AAChG,eAAO,MAAM,+BAA+B,QAA8C,CAAC;AAG3F,eAAO,MAAM,eAAe,QAAsC,CAAC;AACnE,gIAAgI;AAChI,eAAO,MAAM,wBAAwB,QAA+C,CAAC;AAErF,gEAAgE;AAChE,eAAO,MAAM,eAAe,QAAkC,CAAC;AAC/D,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,QAAwC,CAAC;AAC1E,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,QAAwC,CAAC;AAQtE,eAAO,MAAM,cAAc,EAAE,OAAO,GAAG,MACW,CAAC;AAGnD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,mBAAmB,CAAC,YAAY,SAAW,GAAG,MAAM,CAEnE;AAuBD,eAAO,MAAM,oBAAoB,UAAuB,CAAC;AAezD,eAAO,MAAM,sBAAsB,UAGjB,CAAC;AACnB,oHAAoH;AACpH,eAAO,MAAM,mBAAmB,QAAsF,CAAC;AACvH,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,QAA4G,CAAC;AACzJ,eAAO,MAAM,4BAA4B,QAAqG,CAAC;AAC/I,eAAO,MAAM,kCAAkC,QAA2G,CAAC"}

package/dist/config.js

@@ -0,0 +1,321 @@
+/**
+ * Centralized configuration for environment variables.
+ * This file contains all environment variable parsing logic.
+ * KEY_VALUE_STORE_URL (or REDIS_URL): when set (non-empty) → key-value backend;
+ * when unset or empty → in-memory backend. QDRANT_URL is always required.
+ */
+import path from 'path';
+import { parseOidcScopesSupported } from './http/oidc-scopes.js';
+import { normalizeRedisUrl } from './utils/normalize-redis-url.js';
+import { KAIROS_LOCAL_ARTIFACT_DIRS_DEFAULT, parseLocalArtifactDirHints } from './utils/kairos-local-artifact-dirs.js';
+export { parseLocalArtifactDirHints } from './utils/kairos-local-artifact-dirs.js';
+import { getEnvAliased, getEnvIntAliased, getEnvBooleanAliased, resolveAliasedRaw, logDeprecations } from './config/env-alias.js';
+/** Throws if key is missing or empty (after trim). Use for vars that must be set. */
+function getEnvRequired(key, errorMessage) {
+    const val = process.env[key];
+    const trimmed = typeof val === 'string' ? val.trim() : '';
+    if (!trimmed) {
+        const msg = errorMessage ?? `SquadRules requires ${key} to be set. Set it in .env or environment.`;
+        throw new Error(msg);
+    }
+    return trimmed;
+}
+function getEnvString(key, defaultValue) {
+    return process.env[key] || defaultValue;
+}
+function getEnvInt(key, defaultValue) {
+    const val = process.env[key];
+    if (val === undefined)
+        return defaultValue;
+    const parsed = parseInt(val, 10);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+function getEnvFloat(key, defaultValue) {
+    const val = process.env[key];
+    if (val === undefined)
+        return defaultValue;
+    const parsed = parseFloat(val);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+function getEnvBoolean(key, defaultValue) {
+    const val = process.env[key];
+    if (val === undefined)
+        return defaultValue;
+    const low = String(val).trim().toLowerCase();
+    if (low === 'false' || low === '0' || low === 'no' || low === 'n')
+        return false;
+    if (low === 'true' || low === '1' || low === 'yes' || low === 'y')
+        return true;
+    return defaultValue;
+}
+// KEY_VALUE_STORE_URL (or REDIS_URL) set (non-empty) → network store.
+const KEY_VALUE_STORE_URL_RAW = getEnvString('KEY_VALUE_STORE_URL', getEnvString('REDIS_URL', ''));
+const KEY_VALUE_STORE_PASSWORD = getEnvString('KEY_VALUE_STORE_PASSWORD', getEnvString('REDIS_PASSWORD', ''));
+export const REDIS_URL = normalizeRedisUrl(KEY_VALUE_STORE_URL_RAW, KEY_VALUE_STORE_PASSWORD);
+/** Single source of truth: whether a shared key-value backend is available. */
+export const isRedisConfigured = REDIS_URL.length > 0;
+export const KAIROS_REDIS_PREFIX = getEnvAliased('SQUADRULES_KEY_VALUE_PREFIX', 'KAIROS_KEY_VALUE_PREFIX', getEnvAliased('SQUADRULES_REDIS_PREFIX', 'KAIROS_REDIS_PREFIX', 'kairos:'));
+export const OIDC_STATE_KEY_PREFIX = 'oidc-state:';
+/**
+ * Ordered URI hints emitted as the `kairos_local_artifact_dir` response field
+ * (preferred first). The client resolves a hint on its own filesystem and
+ * exports `KAIROS_LOCAL_ARTIFACT_DIR` (alias `SQUADRULES_LOCAL_ARTIFACT_DIR`)
+ * for shell challenges. Override the defaults via the comma-separated env
+ * `KAIROS_LOCAL_ARTIFACT_DIRS` (alias `SQUADRULES_LOCAL_ARTIFACT_DIRS`).
+ */
+export const KAIROS_LOCAL_ARTIFACT_DIRS = parseLocalArtifactDirHints(getEnvAliased('SQUADRULES_LOCAL_ARTIFACT_DIRS', 'KAIROS_LOCAL_ARTIFACT_DIRS', KAIROS_LOCAL_ARTIFACT_DIRS_DEFAULT));
+/** Memory cache key prefix; keys starting with this are global (no space namespace). One key per UUID. */
+export const MEMORY_CACHE_KEY_PREFIX = 'mem:';
+export const OPENAI_EMBEDDING_MODEL = getEnvString('OPENAI_EMBEDDING_MODEL', 'text-embedding-3-small');
+/** Base URL for OpenAI API (e.g. https://api.openai.com or Azure endpoint). No trailing slash. */
+export const OPENAI_API_URL = getEnvString('OPENAI_API_URL', 'https://api.openai.com').replace(/\/$/, '');
+export const OPENAI_API_KEY = getEnvString('OPENAI_API_KEY', '');
+export const EMBEDDING_PROVIDER = getEnvString('EMBEDDING_PROVIDER', 'auto');
+export const TEI_BASE_URL = getEnvString('TEI_BASE_URL', '');
+export const TEI_MODEL = getEnvString('TEI_MODEL', 'Alibaba-NLP/gte-large-en-v1.5');
+export const TEI_API_KEY = getEnvString('TEI_API_KEY', '');
+export const EMBEDDING_LATENCY_WARN_MS = getEnvInt('EMBEDDING_LATENCY_WARN_MS', 5000);
+export const EMBEDDING_NORM_MIN = getEnvFloat('EMBEDDING_NORM_MIN', 0.5);
+export const EMBEDDING_NORM_MAX = getEnvFloat('EMBEDDING_NORM_MAX', 2.0);
+/** Retry policy for embedding 429/5xx/network. Exponential backoff+jitter; Retry-After honored; insufficient_quota fails fast. */
+export const EMBEDDING_MAX_RETRIES = Math.max(0, getEnvInt('EMBEDDING_MAX_RETRIES', 2));
+export const EMBEDDING_RETRY_BASE_DELAY_MS = Math.max(0, getEnvInt('EMBEDDING_RETRY_BASE_DELAY_MS', 500));
+export const EMBEDDING_RETRY_MAX_DELAY_MS = Math.max(1, getEnvInt('EMBEDDING_RETRY_MAX_DELAY_MS', 8_000));
+export const EMBEDDING_RETRY_AFTER_CAP_MS = Math.max(1, getEnvInt('EMBEDDING_RETRY_AFTER_CAP_MS', 10_000));
+/** Total wall-clock budget for all embedding retries. Once exceeded, no further retries. */
+export const EMBEDDING_RETRY_BUDGET_MS = Math.max(1, getEnvInt('EMBEDDING_RETRY_BUDGET_MS', 15_000));
+/** Wall-clock cap for comment PoW semantic check. On timeout, fail open. Set to 0 to skip. */
+export const COMMENT_SEMANTIC_VALIDATION_TIMEOUT_MS = getEnvInt('COMMENT_SEMANTIC_VALIDATION_TIMEOUT_MS', 10_000);
+export const SEARCH_SCORE_WARN_THRESHOLD = getEnvFloat('SEARCH_SCORE_WARN_THRESHOLD', 0.1);
+export const LOG_LEVEL = getEnvString('LOG_LEVEL', 'info');
+export const LOG_FORMAT = getEnvString('LOG_FORMAT', 'text');
+export const AUDIT_LOG_FILE = getEnvString('AUDIT_LOG_FILE', '').trim();
+/**
+ * Verbosity for MCP audit events written to AUDIT_LOG_FILE (0-3).
+ * 0 = off, 1 = metadata only, 2 = + request args, 3 = + response body.
+ * Existing audit.embedding / audit.anomaly events are unaffected.
+ */
+export const AUDIT_LOG_LEVEL = Math.max(0, Math.min(3, getEnvInt('AUDIT_LOG_LEVEL', 1)));
+export const QDRANT_API_KEY = getEnvString('QDRANT_API_KEY', '');
+export const QDRANT_COLLECTION_CURRENT = getEnvString('QDRANT_COLLECTION_CURRENT', '');
+export const KAIROS_SEARCH_OVERFETCH_FACTOR = getEnvAliased('SQUADRULES_SEARCH_OVERFETCH_FACTOR', 'KAIROS_SEARCH_OVERFETCH_FACTOR', '4');
+export const KAIROS_SEARCH_MAX_FETCH = getEnvIntAliased('SQUADRULES_SEARCH_MAX_FETCH', 'KAIROS_SEARCH_MAX_FETCH', 200);
+/** Default number of match choices returned by search when the agent omits max_choices. */
+export const KAIROS_SEARCH_MAX_CHOICES = getEnvIntAliased('SQUADRULES_SEARCH_MAX_CHOICES', 'KAIROS_SEARCH_MAX_CHOICES', 10);
+/** Absolute cap for search max_choices (prevents abuse and excessive resolveHead latency). */
+export const KAIROS_SEARCH_LIMIT_CAP = getEnvIntAliased('SQUADRULES_SEARCH_LIMIT_CAP', 'KAIROS_SEARCH_LIMIT_CAP', 50);
+/** Minimum match choices when agent passes max_choices. */
+export const KAIROS_SEARCH_LIMIT_MIN = getEnvIntAliased('SQUADRULES_SEARCH_LIMIT_MIN', 'KAIROS_SEARCH_LIMIT_MIN', 5);
+export const KAIROS_ENABLE_GROUP_COLLAPSE = getEnvBooleanAliased('SQUADRULES_ENABLE_GROUP_COLLAPSE', 'KAIROS_ENABLE_GROUP_COLLAPSE', true);
+export const HTTP_JSON_BODY_LIMIT = getEnvString('HTTP_JSON_BODY_LIMIT', '1mb');
+/** Max body size for POST /api/train/raw (`HTTP_TRAIN_RAW_BODY_LIMIT`, default 2mb). */
+export const HTTP_TRAIN_RAW_BODY_LIMIT = getEnvString('HTTP_TRAIN_RAW_BODY_LIMIT', '2mb');
+export const HTTP_RATE_LIMIT_WINDOW_MS = getEnvInt('HTTP_RATE_LIMIT_WINDOW_MS', 60_000);
+export const HTTP_RATE_LIMIT_MAX = getEnvInt('HTTP_RATE_LIMIT_MAX', 10_000);
+export const AUTH_RATE_LIMIT_WINDOW_MS = getEnvInt('AUTH_RATE_LIMIT_WINDOW_MS', 60_000);
+export const AUTH_RATE_LIMIT_MAX = getEnvInt('AUTH_RATE_LIMIT_MAX', 10);
+export const MCP_RATE_LIMIT_WINDOW_MS = getEnvInt('MCP_RATE_LIMIT_WINDOW_MS', 60_000);
+export const MCP_RATE_LIMIT_MAX = getEnvInt('MCP_RATE_LIMIT_MAX', 1000);
+/**
+ * When true, served MCP App widget HTML skips `ui/initialize` / `initialized` and ignores
+ * tool-result notifications (static chrome only). Use to isolate host crashes tied to the bridge.
+ */
+export const KAIROS_MCP_WIDGET_PRESENTATION_ONLY = getEnvBooleanAliased('SQUADRULES_MCP_WIDGET_PRESENTATION_ONLY', 'KAIROS_MCP_WIDGET_PRESENTATION_ONLY', false);
+// Auth (Keycloak OIDC). One Keycloak per env: each env file sets KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID.
+// AUTH_ENABLED defaults to true. If it is explicitly set to true, missing auth env is a startup error.
+// If it is left unset and auth env is incomplete, the server stays fail-closed at request time.
+export const AUTH_ENABLED = getEnvBoolean('AUTH_ENABLED', true);
+export const KEYCLOAK_URL = getEnvString('KEYCLOAK_URL', '');
+/** When set, used for server-side calls (e.g. token exchange). When unset, KEYCLOAK_URL is used. Use keycloak:8080 in Docker. */
+export const KEYCLOAK_INTERNAL_URL = getEnvString('KEYCLOAK_INTERNAL_URL', '');
+export const KEYCLOAK_REALM = getEnvString('KEYCLOAK_REALM', 'kairos-dev');
+export const KEYCLOAK_CLIENT_ID = getEnvString('KEYCLOAK_CLIENT_ID', 'kairos-mcp');
+/** CLI browser login: public client ID (e.g. kairos-cli). Overridable at runtime by KAIROS_CLIENT_ID (alias SQUADRULES_CLIENT_ID). */
+export const KEYCLOAK_CLI_CLIENT_ID = getEnvString('KEYCLOAK_CLI_CLIENT_ID', 'kairos-cli');
+/** Base URL for redirect_uri (e.g. http://localhost:3500). Must match Keycloak client redirect URIs. */
+export const AUTH_CALLBACK_BASE_URL = getEnvString('AUTH_CALLBACK_BASE_URL', '');
+export const SESSION_SECRET = getEnvString('SESSION_SECRET', '');
+/** Session cookie and payload exp lifetime in seconds; default 7 hours. */
+export const SESSION_MAX_AGE_SEC = getEnvInt('SESSION_MAX_AGE_SEC', 25_200);
+/**
+ * Comma-separated scopes advertised from `/.well-known/oauth-protected-resource`.
+ * Defaults to the baseline OIDC scopes required by SquadRules discovery; set explicitly
+ * to add scopes such as `offline_access` without rebuilding the container image.
+ */
+export const OIDC_SCOPES_SUPPORTED = parseOidcScopesSupported(resolveAliasedRaw('SQUADRULES_OIDC_SCOPES_SUPPORTED', 'KAIROS_OIDC_SCOPES_SUPPORTED'));
+/** When set to oidc_bearer, Bearer tokens are validated (issuer, audience, exp); when unset, Bearer presence only (backward compat). */
+export const AUTH_MODE = getEnvString('AUTH_MODE', '');
+/** Comma-separated list of trusted JWT issuers (e.g. http://keycloak:8080/realms/kairos-dev). Required when AUTH_MODE=oidc_bearer. */
+export const AUTH_TRUSTED_ISSUERS_STRING = getEnvString('AUTH_TRUSTED_ISSUERS', '');
+/** Comma-separated list of allowed JWT audiences (e.g. kairos-mcp). Required when AUTH_MODE=oidc_bearer. */
+export const AUTH_ALLOWED_AUDIENCES_STRING = getEnvString('AUTH_ALLOWED_AUDIENCES', '');
+/**
+ * Comma-separated group names (or /paths) allowed in the KAIROS auth session after OIDC.
+ * Only JWT `groups` entries that match any entry are kept:
+ * exact name or path (slash optional), or a **prefix** entry ending with `/` (e.g. `/shared/`
+ * keeps every group whose path starts with that prefix). Matching is **case-insensitive** for paths.
+ * Empty = do not filter: keep all token `groups` (recommended default so group spaces match IdP membership).
+ * To restrict, set entries; to approximate “no group spaces”, use an allowlist that matches nothing you issue (e.g. a dedicated sentinel name).
+ * Keycloak still issues full membership in the JWT; this filter controls what KAIROS forwards internally when non-empty.
+ */
+export const OIDC_GROUPS_ALLOWLIST = (() => {
+    const raw = getEnvString('OIDC_GROUPS_ALLOWLIST', '').trim();
+    if (!raw)
+        return Object.freeze([]);
+    return Object.freeze(raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean));
+})();
+/**
+ * Bearer MCP auth: union groups from the verified access JWT with groups from OIDC userinfo (default true).
+ * Browser sessions merge id_token + access_token; Bearer clients often send an access token whose `groups`
+ * claim is incomplete or absent while userinfo still lists full membership — without merging, `spaces` omits
+ * group rows even though the UI (session) shows them.
+ */
+export const OIDC_BEARER_MERGE_USERINFO_GROUPS = getEnvBoolean('OIDC_BEARER_MERGE_USERINFO_GROUPS', true);
+/**
+ * Suffix appended when building the example group path from a path-prefix
+ * allowlist entry (see GROUP_SPACE_PATH_EXAMPLE). Default `pe-team`.
+ */
+const KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX_RAW = getEnvAliased('SQUADRULES_GROUP_SPACE_EXAMPLE_SUFFIX', 'KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX', 'pe-team').trim();
+export const KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX = KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX_RAW.length > 0
+    ? KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX_RAW
+    : 'pe-team';
+/**
+ * Derive an illustrative full group path from the first path-prefix entry in
+ * `OIDC_GROUPS_ALLOWLIST` (entry ending with `/`). Returns null if none.
+ */
+export function deriveGroupSpacePathExampleFromAllowlist(allowlist, suffix) {
+    for (const entry of allowlist) {
+        const e = entry.trim();
+        if (e.endsWith('/') && e.length > 1) {
+            const base = e.replace(/\/+$/, '');
+            return `${base}/${suffix}`;
+        }
+    }
+    return null;
+}
+/**
+ * Example group path interpolated into MCP tool descriptions (`activate`, `spaces`,
+ * `train`, `tune`) at process start.
+ *
+ * - Set **`KAIROS_GROUP_SPACE_PATH_EXAMPLE`** to override completely.
+ * - Otherwise, if **`OIDC_GROUPS_ALLOWLIST`** contains a path-prefix entry (e.g. `/shared/`),
+ *   the example is `{prefix-without-trailing-slash}/{KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX}`.
+ * - Otherwise default **`/shared/{suffix}`** (suffix from `KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX`).
+ */
+export const GROUP_SPACE_PATH_EXAMPLE = (() => {
+    const explicit = getEnvAliased('SQUADRULES_GROUP_SPACE_PATH_EXAMPLE', 'KAIROS_GROUP_SPACE_PATH_EXAMPLE', '').trim();
+    if (explicit)
+        return explicit;
+    const derived = deriveGroupSpacePathExampleFromAllowlist(OIDC_GROUPS_ALLOWLIST, KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX);
+    if (derived)
+        return derived;
+    return `/shared/${KAIROS_GROUP_SPACE_EXAMPLE_SUFFIX}`;
+})();
+/** Main HTTP listener when `TRANSPORT_TYPE=http`: UI, REST API, and Streamable HTTP MCP. Ignored in stdio mode (no HTTP server). */
+export const SERVER_PORT = getEnvInt('SERVER_PORT', 3000);
+const AUTH_ENABLED_EXPLICIT = process.env['AUTH_ENABLED'] !== undefined;
+if (AUTH_ENABLED && AUTH_ENABLED_EXPLICIT) {
+    const missing = [];
+    if (!KEYCLOAK_URL.trim())
+        missing.push('KEYCLOAK_URL');
+    if (!KEYCLOAK_REALM.trim())
+        missing.push('KEYCLOAK_REALM');
+    if (!KEYCLOAK_CLIENT_ID.trim())
+        missing.push('KEYCLOAK_CLIENT_ID');
+    if (!AUTH_CALLBACK_BASE_URL.trim())
+        missing.push('AUTH_CALLBACK_BASE_URL');
+    if (!SESSION_SECRET.trim())
+        missing.push('SESSION_SECRET');
+    if (missing.length > 0) {
+        throw new Error(`AUTH_ENABLED=true requires non-empty env: ${missing.join(', ')}. Set them in .env. See docs/install/README.md.`);
+    }
+}
+export const QDRANT_RESCORE_STRING = getEnvString('QDRANT_RESCORE', 'true');
+/** When non-empty, backup/snapshot is enabled; app creates dir if missing. Empty = not configured → 503 on POST /api/snapshot. */
+export const QDRANT_SNAPSHOT_ON_START = getEnvBoolean('QDRANT_SNAPSHOT_ON_START', false);
+const QDRANT_SNAPSHOT_DIR_RAW = getEnvString('QDRANT_SNAPSHOT_DIR', '').trim();
+export const QDRANT_SNAPSHOT_DIR = QDRANT_SNAPSHOT_DIR_RAW === ''
+    ? ''
+    : path.isAbsolute(QDRANT_SNAPSHOT_DIR_RAW)
+        ? QDRANT_SNAPSHOT_DIR_RAW
+        : path.resolve(QDRANT_SNAPSHOT_DIR_RAW);
+// Int configurations
+export const METRICS_PORT = getEnvInt('METRICS_PORT', 9090);
+/** Raw env: positive = override, -1 = disabled, 0 or unset = auto-detect from cgroup/memory. */
+export const MAX_CONCURRENT_MCP_REQUESTS_RAW = getEnvInt('MAX_CONCURRENT_MCP_REQUESTS', 0);
+// Float configurations (tunable via env; relaxed defaults so more results pass into choices)
+export const SCORE_THRESHOLD = getEnvFloat('SCORE_THRESHOLD', 0.5);
+/** Similar-memory: score >= this value triggers SIMILAR_MEMORY_FOUND. Set SIMILAR_MEMORY_THRESHOLD=1 to effectively disable. */
+export const SIMILAR_MEMORY_THRESHOLD = getEnvFloat('SIMILAR_MEMORY_THRESHOLD', 0.9);
+/** Attest boost: below this many runs we do not apply boost. */
+export const MIN_ATTEST_RUNS = getEnvInt('MIN_ATTEST_RUNS', 3);
+/** Attest boost: at this many runs confidence is 1. */
+export const RUNS_FULL_CONFIDENCE = getEnvInt('RUNS_FULL_CONFIDENCE', 10);
+/** Max additive boost from attest (tiebreaker within RRF bands). */
+export const ATTEST_BOOST_MAX = getEnvFloat('ATTEST_BOOST_MAX', 0.08);
+// Transport: stdio | http. Default http for non-CLI entrypoints (Docker/CI/bootstrap).
+// `kairos serve` sets KAIROS_CLI_SERVE=1 before spawning bootstrap so missing TRANSPORT_TYPE defaults to stdio there only.
+const _cliServeValue = resolveAliasedRaw('SQUADRULES_CLI_SERVE', 'KAIROS_CLI_SERVE');
+const _transportDefault = _cliServeValue === '1' && !process.env['TRANSPORT_TYPE']?.trim() ? 'stdio' : 'http';
+const TRANSPORT_TYPE_RAW = getEnvString('TRANSPORT_TYPE', _transportDefault);
+export const TRANSPORT_TYPE = TRANSPORT_TYPE_RAW === 'http' ? 'http' : 'stdio';
+// Required (throw at startup if missing)
+export function getQdrantUrl() {
+    return getEnvRequired('QDRANT_URL');
+}
+export function getQdrantCollection(defaultValue = 'kairos') {
+    return getEnvString('QDRANT_COLLECTION', defaultValue);
+}
+// Trusted issuers: from env, or from KEYCLOAK_URL/REALM when unset. Add loopback alias (localhost <-> 127.0.0.1) so tokens match either.
+const _authIssuersFromEnv = AUTH_TRUSTED_ISSUERS_STRING.split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+const _authIssuersBase = _authIssuersFromEnv.length > 0
+    ? _authIssuersFromEnv
+    : KEYCLOAK_URL && KEYCLOAK_REALM
+        ? [`${KEYCLOAK_URL.replace(/\/$/, '')}/realms/${KEYCLOAK_REALM}`]
+        : [];
+const _authIssuersExpanded = [];
+for (const iss of _authIssuersBase) {
+    _authIssuersExpanded.push(iss);
+    if (iss.includes('localhost')) {
+        const other = iss.replace(/localhost/g, '127.0.0.1');
+        if (!_authIssuersExpanded.includes(other))
+            _authIssuersExpanded.push(other);
+    }
+    else if (iss.includes('127.0.0.1')) {
+        const other = iss.replace(/127\.0\.0\.1/g, 'localhost');
+        if (!_authIssuersExpanded.includes(other))
+            _authIssuersExpanded.push(other);
+    }
+}
+export const AUTH_TRUSTED_ISSUERS = _authIssuersExpanded;
+// Allowed audiences: from env if set (explicit config wins), or default to server + CLI client IDs + account.
+// If AUTH_ALLOWED_AUDIENCES is explicitly set, use it as-is (no magic injection).
+const _authAudFromEnv = AUTH_ALLOWED_AUDIENCES_STRING.split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+const _authAudDefault = [];
+if (KEYCLOAK_CLIENT_ID)
+    _authAudDefault.push(KEYCLOAK_CLIENT_ID);
+if (KEYCLOAK_CLI_CLIENT_ID && KEYCLOAK_CLI_CLIENT_ID !== KEYCLOAK_CLIENT_ID) {
+    _authAudDefault.push(KEYCLOAK_CLI_CLIENT_ID);
+}
+const _authAudBase = _authAudFromEnv.length > 0 ? _authAudFromEnv : _authAudDefault;
+// Add "account" for Keycloak access tokens when we have realm issuers
+const _hasKeycloakRealm = _authIssuersBase.some((u) => u.includes('/realms/'));
+export const AUTH_ALLOWED_AUDIENCES = _hasKeycloakRealm && !_authAudBase.includes('account')
+    ? [..._authAudBase, 'account']
+    : _authAudBase;
+/** Embedded mem / default search space when AUTH_ENABLED=false; must follow space model (e.g. space:kairos-app). */
+export const KAIROS_APP_SPACE_ID = getEnvAliased('SQUADRULES_APP_SPACE_ID', 'KAIROS_APP_SPACE_ID', 'space:kairos-app');
+/** Simple-mode writable personal space id when AUTH_ENABLED=false and UUIDv5 seed override is not provided. */
+export const KAIROS_SIMPLE_PERSONAL_SPACE_ID = getEnvAliased('SQUADRULES_SIMPLE_PERSONAL_SPACE_ID', 'KAIROS_SIMPLE_PERSONAL_SPACE_ID', 'space:personal');
+export const KAIROS_SIMPLE_PERSONAL_REALM = getEnvAliased('SQUADRULES_SIMPLE_PERSONAL_REALM', 'KAIROS_SIMPLE_PERSONAL_REALM', 'kairos-simple');
+export const KAIROS_SIMPLE_PERSONAL_UUIDV5_SEED = getEnvAliased('SQUADRULES_SIMPLE_PERSONAL_UUIDV5_SEED', 'KAIROS_SIMPLE_PERSONAL_UUIDV5_SEED', '').trim();
+/** Emit a single consolidated deprecation notice for any KAIROS_* var used while its SQUADRULES_* alias was unset. */
+logDeprecations();
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAElI,qFAAqF;AACrF,SAAS,cAAc,CAAC,GAAW,EAAE,YAAqB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,YAAY,IAAI,uBAAuB,GAAG,4CAA4C,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,YAAoB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC;AAC1C,CAAC;AACD,SAAS,SAAS,CAAC,GAAW,EAAE,YAAoB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AACD,SAAS,WAAW,CAAC,GAAW,EAAE,YAAoB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AACD,SAAS,aAAa,CAAC,GAAW,EAAE,YAAqB;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,YAAY,CAAC;AACtB,CAAC;AACD,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,YAAY,CAAC,qBAAqB,EAAE,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;AACnG,MAAM,wBAAwB,GAAG,YAAY,CAAC,0BAA0B,EAAE,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9G,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAAC;AAC9F,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;AACvL,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AACnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB,0BAA0B,CACrF,aAAa,CAAC,gCAAgC,EAAE,4BAA4B,EAAE,kCAAkC,CAAC,CAClH,CAAC;AACF,0GAA0G;AAC1G,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;AACvG,kGAAkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1G,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACzE,kIAAkI;AAClI,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1G,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1G,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3G,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC,CAAC;AACrG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,sCAAsC,GAAG,SAAS,CAAC,wCAAwC,EAAE,MAAM,CAAC,CAAC;AAClH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAG,aAAa,CAAC,oCAAoC,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;AACzI,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;AACvH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,+BAA+B,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC;AAC5H,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;AACtH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;AACrH,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC,kCAAkC,EAAE,8BAA8B,EAAE,IAAI,CAAC,CAAC;AAC3I,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AAChF,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;AAE1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AACxE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,oBAAoB,CAAC,yCAAyC,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;AACjK,mHAAmH;AACnH,uGAAuG;AACvG,gGAAgG;AAChG,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,iIAAiI;AACjI,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;AACnF,sIAAsI;AACtI,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;AAC3F,wGAAwG;AACxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACjE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,wBAAwB,CAC9E,iBAAiB,CAAC,kCAAkC,EAAE,8BAA8B,CAAC,CACtF,CAAC;AAEF,wIAAwI;AACxI,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACvD,sIAAsI;AACtI,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACpF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AACxF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,GAAG,EAAE;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAClB,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,aAAa,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AAE1G;;;GAGG;AACH,MAAM,qCAAqC,GAAG,aAAa,CAAC,uCAAuC,EAAE,mCAAmC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5J,MAAM,CAAC,MAAM,iCAAiC,GAC5C,qCAAqC,CAAC,MAAM,GAAG,CAAC;IAC9C,CAAC,CAAC,qCAAqC;IACvC,CAAC,CAAC,SAAS,CAAC;AAEhB;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,SAA4B,EAC5B,MAAc;IAEd,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnC,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAW,CAAC,GAAG,EAAE;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,qCAAqC,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpH,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,wCAAwC,CACtD,qBAAqB,EACrB,iCAAiC,CAClC,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,WAAW,iCAAiC,EAAE,CAAC;AACxD,CAAC,CAAC,EAAE,CAAC;AAEL,oIAAoI;AACpI,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAE1D,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,SAAS,CAAC;AAExE,IAAI,YAAY,IAAI,qBAAqB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnE,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CACjH,CAAC;IACJ,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAC5E,kIAAkI;AAClI,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AACzF,MAAM,uBAAuB,GAAG,YAAY,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAC9B,uBAAuB,KAAK,EAAE;IAC5B,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;QACxC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAE9C,qBAAqB;AACrB,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC5D,gGAAgG;AAChG,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAE3F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACnE,gIAAgI;AAChI,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;AAErF,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;AAC/D,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AAC1E,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;AAEtE,uFAAuF;AACvF,2HAA2H;AAC3H,MAAM,cAAc,GAAG,iBAAiB,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AACrF,MAAM,iBAAiB,GACrB,cAAc,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AACtF,MAAM,kBAAkB,GAAG,YAAY,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,cAAc,GACzB,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAEnD,yCAAyC;AACzC,MAAM,UAAU,YAAY;IAC1B,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAY,GAAG,QAAQ;IACzD,OAAO,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;AACzD,CAAC;AAED,yIAAyI;AACzI,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC;KAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACnB,MAAM,gBAAgB,GACpB,mBAAmB,CAAC,MAAM,GAAG,CAAC;IAC5B,CAAC,CAAC,mBAAmB;IACrB,CAAC,CAAC,YAAY,IAAI,cAAc;QAC9B,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,cAAc,EAAE,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;AACX,MAAM,oBAAoB,GAAa,EAAE,CAAC;AAC1C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACnC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,8GAA8G;AAC9G,kFAAkF;AAClF,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC;KAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACnB,MAAM,eAAe,GAAa,EAAE,CAAC;AACrC,IAAI,kBAAkB;IAAE,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACjE,IAAI,sBAAsB,IAAI,sBAAsB,KAAK,kBAAkB,EAAE,CAAC;IAC5E,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;AACpF,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GACjC,iBAAiB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;IACpD,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,SAAS,CAAC;IAC9B,CAAC,CAAC,YAAY,CAAC;AACnB,oHAAoH;AACpH,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;AACvH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAG,aAAa,CAAC,qCAAqC,EAAE,iCAAiC,EAAE,gBAAgB,CAAC,CAAC;AACzJ,MAAM,CAAC,MAAM,4BAA4B,GAAG,aAAa,CAAC,kCAAkC,EAAE,8BAA8B,EAAE,eAAe,CAAC,CAAC;AAC/I,MAAM,CAAC,MAAM,kCAAkC,GAAG,aAAa,CAAC,wCAAwC,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAE3J,sHAAsH;AACtH,eAAe,EAAE,CAAC"}

package/dist/constants/builtin-search-meta.d.ts

@@ -0,0 +1,14 @@
+import type { Memory } from '../types/memory.js';
+/** Refine-help protocol; always appended as an **activate** footer choice (not a vector match). */
+export declare const KAIROS_REFINING_PROTOCOL_SLUG = "refine-search";
+/** Built-in adapter authoring flow; always appended as an **activate** footer choice (not a vector match). */
+export declare const KAIROS_CREATION_PROTOCOL_SLUG = "create-new-protocol";
+/** Set of built-in protocol slugs used for search filtering. */
+export declare const BUILTIN_PROTOCOL_SLUGS: Set<string>;
+/** Footer labels come from built-in meta docs, not hardcoded strings. */
+export declare const KAIROS_REFINING_FOOTER_LABEL: string;
+export declare const KAIROS_CREATION_FOOTER_LABEL: string;
+export declare const KAIROS_CREATION_FOOTER_NEXT_ACTION = "call train with adapter markdown to register a new adapter/protocol/workflow";
+/** True if this memory belongs to built-in footer protocols (refine / create). */
+export declare function memoryIsBuiltinSearchFooterProtocol(m: Memory): boolean;
+//# sourceMappingURL=builtin-search-meta.d.ts.map

package/dist/constants/builtin-search-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-search-meta.d.ts","sourceRoot":"","sources":["../../src/constants/builtin-search-meta.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,mGAAmG;AACnG,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAE7D,8GAA8G;AAC9G,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;AAEnE,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,aAA0E,CAAC;AAmB9G,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,QAGxC,CAAC;AACF,eAAO,MAAM,4BAA4B,QAGxC,CAAC;AACF,eAAO,MAAM,kCAAkC,iFACiC,CAAC;AAEjF,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGtE"}

package/dist/constants/builtin-search-meta.js

@@ -0,0 +1,32 @@
+import { getMetaDoc } from '../resources/embedded-mcp-resources.js';
+import { parseFrontmatter } from '../utils/frontmatter.js';
+/** Refine-help protocol; always appended as an **activate** footer choice (not a vector match). */
+export const KAIROS_REFINING_PROTOCOL_SLUG = 'refine-search';
+/** Built-in adapter authoring flow; always appended as an **activate** footer choice (not a vector match). */
+export const KAIROS_CREATION_PROTOCOL_SLUG = 'create-new-protocol';
+/** Set of built-in protocol slugs used for search filtering. */
+export const BUILTIN_PROTOCOL_SLUGS = new Set([KAIROS_REFINING_PROTOCOL_SLUG, KAIROS_CREATION_PROTOCOL_SLUG]);
+function getMetaDocTitle(slug, fallbackTitle) {
+    const doc = getMetaDoc(slug);
+    if (!doc)
+        return fallbackTitle;
+    const parsed = parseFrontmatter(doc);
+    if (parsed.title && parsed.title.trim().length > 0) {
+        return parsed.title.trim();
+    }
+    const h1Match = parsed.body.match(/^#\s+(.+)$/m);
+    if (h1Match && h1Match[1]) {
+        return h1Match[1].trim();
+    }
+    return fallbackTitle;
+}
+/** Footer labels come from built-in meta docs, not hardcoded strings. */
+export const KAIROS_REFINING_FOOTER_LABEL = getMetaDocTitle(KAIROS_REFINING_PROTOCOL_SLUG, 'Get help refining your search');
+export const KAIROS_CREATION_FOOTER_LABEL = getMetaDocTitle(KAIROS_CREATION_PROTOCOL_SLUG, 'Create New KAIROS Protocol');
+export const KAIROS_CREATION_FOOTER_NEXT_ACTION = 'call train with adapter markdown to register a new adapter/protocol/workflow';
+/** True if this memory belongs to built-in footer protocols (refine / create). */
+export function memoryIsBuiltinSearchFooterProtocol(m) {
+    const slug = m.slug ?? '';
+    return slug.length > 0 && BUILTIN_PROTOCOL_SLUGS.has(slug);
+}
+//# sourceMappingURL=builtin-search-meta.js.map

package/dist/constants/builtin-search-meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-search-meta.js","sourceRoot":"","sources":["../../src/constants/builtin-search-meta.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,mGAAmG;AACnG,MAAM,CAAC,MAAM,6BAA6B,GAAG,eAAe,CAAC;AAE7D,8GAA8G;AAC9G,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AAEnE,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAE9G,SAAS,eAAe,CAAC,IAAY,EAAE,aAAqB;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IAE/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CACzD,6BAA6B,EAC7B,+BAA+B,CAChC,CAAC;AACF,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CACzD,6BAA6B,EAC7B,4BAA4B,CAC7B,CAAC;AACF,MAAM,CAAC,MAAM,kCAAkC,GAC7C,8EAA8E,CAAC;AAEjF,kFAAkF;AAClF,MAAM,UAAU,mCAAmC,CAAC,CAAS;IAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}