@weave-kit/engine 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -0,0 +1,76 @@
+# Changelog
+
+All notable changes to `@weave-kit/engine`. Format follows [Keep a Changelog](https://keepachangelog.com/);
+the project uses [Semantic Versioning](https://semver.org/).
+
+## [0.7.0]
+
+### Added
+
+- **Node 22 support.** The engine, CLI and scaffolded projects now run on Node **22+** (verified on
+  Node 22 and Node 24). `engines.node` is `>=22`; generated projects declare the same.
+
+### Changed
+
+- `isolated-vm` — the optional native dependency behind the script sandbox — is pinned to
+  **`^6.2.0`**, which ships prebuilt binaries for both Node 22 and Node 24 (7.x drops Node 22).
+  Behavior is unchanged (the sandbox, RPC bridge and timeout/`__done` handling are covered by the
+  same tests on both runtimes). Note: prebuilds are no longer published for Node 26 — on that
+  runtime the script sandbox may fall back to a source build.
+
+## [0.6.0]
+
+A breaking release. The data model, access control and workflow were reworked end to end. Read the
+**Breaking** section before upgrading.
+
+### Breaking
+
+- **Record ids are the `record_key`.** A record's external id is now a single URL-safe string that
+  encodes the (possibly composite) primary key, surfaced as the read-only `weave_id` field. REST
+  `/{id}`, MCP `id` and batch `ids[]` all take this string — read it from a result or `describe_object`
+  instead of composing the raw primary key.
+- **Field types are bucketed** into PG-native value types and engine-shipped custom types. `person`
+  was renamed to `user`; `SCALAR` was removed; `currency` accepts an optional ISO 4217 code (and an
+  optional `precision`); `json` now maps to PostgreSQL `json` — use `jsonb` for the old behavior. Run
+  `weave schema:upgrade`.
+- **Row scopes add `department`** (`own | department | all`) plus a separate `manage` scope for writes,
+  and a scope column's ids can be `internal` (engine ids) or `external` (customer ids).
+- **Identity directory** — the engine now owns `weavekit_user` / `weavekit_department`; sync an external
+  source with `weave sync:identity`, authenticate through a verifier, and manage users over the admin
+  REST surface.
+- **`multiRelation` uses a link table** (real FK per side, `ON DELETE CASCADE`) instead of a column;
+  reads and filters are scoped to the targets the subject can read.
+- **Workflow rewritten to a single-line node chain** (`workflow.json` format v2). v1 state-machine
+  files are linearized on read. Instance/step/workitem state lives in engine tables
+  (`weavekit_workflow_instances` / `_steps` / `_workitems`, plus locks/definitions/timers). New
+  REST + MCP surface; `weave workflow:migrate` was **removed**; the side-table column
+  `workflow_id` was renamed to `workflow_instance_id`; `weave migrate` drops and recreates the timer
+  table.
+- **Engine-owned system tables + runtime zero-DDL.** All DDL is emitted by `weave migrate`; the runtime
+  never alters or drops customer columns (reads only).
+- **Security hardening** — formula references respect RBAC, `details` children inherit (and can only
+  narrow) their parent's permissions, DDL literals are escaped, and script SQL is gated by an AST pass.
+
+### Added
+
+- Record-metadata side tables with `weave_*` virtual fields (`weave_id`, `weave_status`,
+  `weave_owner_id`, `weave_created_by`/`_modified_by`, `weave_created_time`/`_modified_time`,
+  `weave_workflow_instance_id`) — request them in `fields`, and they work in `filter` / `sort`.
+- Field types: native PG enums for static `enum`s, data-driven `enum` options, `seq_no`, `uuid`,
+  `smallint`/`bigint`/`real`/`double`/`char`, numeric `precision`/`scale`, `json`/`jsonb`.
+- Reverse-modeling: `weave introspect` handles composite primary keys and native enum/array columns;
+  `weave schema:map` reports schema↔column drift.
+- Workflow actions `submit` / `approve` / `reject` / `forward` / `withdraw` / `cancel` / `reactivate`,
+  any-one / all approvals, node timeouts, an admin override, and definition write-back.
+- `describe_object` exposes a field's resolved type `base`.
+
+### Changed
+
+- `weave migrate` registers content-addressed workflow definitions; instances pin the hash they started
+  under, so editing `workflow.json` only affects new records.
+- Live `record.transitioned` events carry `from` / `to` / `action`.
+
+### Fixed
+
+- Correct row-scope parameter offset on `update` / `delete` / `transition`.
+- `record_key` encoding is single-sourced in SQL (contract-tested).

package/README.md

@@ -63,7 +63,7 @@ write.
 
 ## Requirements
 
-- Node.js 24 LTS
+- Node.js 22+
 - PostgreSQL
 
 ## Quick start
@@ -95,12 +95,12 @@ weave mcp:config          # ready-to-paste config for Claude Code / Cursor / VS
 Full documentation: **[docs.weavekit.io/engine](https://docs.weavekit.io/engine)**
 
 - [Getting started](https://docs.weavekit.io/engine/guides/getting-started) — scaffold, migrate, run, consume
-- [Git-versioned metadata](https://docs.weavekit.io/engine/guides/git-versioned-metadata) — your data model as reviewable Git commits
-- [Schema guide](https://docs.weavekit.io/engine/guides/schema) · [RBAC](https://docs.weavekit.io/engine/guides/rbac) · [Formulas](https://docs.weavekit.io/engine/guides/formulas) · [Audit](https://docs.weavekit.io/engine/guides/audit)
-- [CLI reference](https://docs.weavekit.io/engine/guides/cli) · [MCP](https://docs.weavekit.io/engine/guides/mcp) · [Script hooks](https://docs.weavekit.io/engine/guides/script-hooks)
-- [Custom tools & guardrails](https://docs.weavekit.io/engine/guides/custom-tools-and-guardrails) · [Custom field types](https://docs.weavekit.io/engine/reference/custom-field-types) · [Quotas](https://docs.weavekit.io/engine/guides/quotas) · [Inbound events](https://docs.weavekit.io/engine/guides/ingress)
-- [Public API & dependency budget](https://docs.weavekit.io/engine/reference/public-api)
-- [Practices & operations](https://docs.weavekit.io/engine/practices/existing-crm-to-mcp) — real integration and deployment walkthroughs
+- [Git-versioned metadata](https://docs.weavekit.io/engine/guides/model/git-versioned-metadata) — your data model as reviewable Git commits
+- [Schema guide](https://docs.weavekit.io/engine/guides/model/schema) · [RBAC](https://docs.weavekit.io/engine/guides/access/rbac) · [Formulas](https://docs.weavekit.io/engine/guides/model/formulas) · [Audit](https://docs.weavekit.io/engine/guides/platform/audit)
+- [CLI reference](https://docs.weavekit.io/engine/guides/platform/cli) · [MCP](https://docs.weavekit.io/engine/guides/agents/mcp) · [Script hooks](https://docs.weavekit.io/engine/guides/automation/script-hooks)
+- [Custom tools & guardrails](https://docs.weavekit.io/engine/guides/agents/custom-tools-and-guardrails) · [Custom field types](https://docs.weavekit.io/engine/reference/schema/custom-field-types) · [Quotas](https://docs.weavekit.io/engine/guides/automation/quotas) · [Inbound events](https://docs.weavekit.io/engine/guides/integration/ingress)
+- [Public API & dependency budget](https://docs.weavekit.io/engine/reference/api/public-api)
+- [Practices & operations](https://docs.weavekit.io/engine/practices/agent/existing-crm-to-mcp) — real integration and deployment walkthroughs
 
 The Markdown sources live in [`docs/`](https://github.com/weavekit/engine/tree/main/docs).
 

package/dist/adapters/auth/index.d.ts

@@ -1,14 +1,16 @@
 import type { Locale } from '../../core/index.js';
-import type { RbacSubject } from '../../core/index.js';
+import type { IdentitySubject } from '../../core/index.js';
 import { type AuthConfig, type Authenticator } from './source.js';
 export type { Authenticator, AuthConfig, AuthResolver, AuthSource } from './source.js';
 export { createAuth } from './source.js';
+export type { AuthVerifier } from './verify.js';
+export { createDirectoryAuthenticator, enforceSyncedIdentity } from './subject.js';
 /**
  * Resolve the Authorization header into a subject, or throw a 401-family
  * {@link SchemaError}. Missing header → `auth.missingKey`; present but
  * unresolvable → `auth.invalidKey`. The REST layer maps both to 401.
  */
-export declare function authenticate(authenticator: Authenticator, header: string | undefined, locale: Locale): Promise<RbacSubject>;
+export declare function authenticate(authenticator: Authenticator, header: string | undefined, locale: Locale): Promise<IdentitySubject>;
 /** build the default authenticator from an auth source (static map or custom resolver) */
 export declare function buildAuthenticator(config: AuthConfig): Authenticator;
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,CAAC,CAKtB;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAEpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnF;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAEpE"}

package/dist/adapters/auth/index.js

@@ -1,6 +1,7 @@
 import { SchemaError } from '../../core/index.js';
 import { createAuth } from './source.js';
 export { createAuth } from './source.js';
+export { createDirectoryAuthenticator, enforceSyncedIdentity } from './subject.js';
 /**
  * Resolve the Authorization header into a subject, or throw a 401-family
  * {@link SchemaError}. Missing header → `auth.missingKey`; present but

package/dist/adapters/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAuC,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAA4B,EAC5B,MAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAuC,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAA4B,EAC5B,MAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/adapters/auth/source.d.ts

@@ -1,7 +1,7 @@
-import type { RbacSubject } from '../../core/index.js';
+import type { IdentitySubject } from '../../core/index.js';
 /** resolves an Authorization header into an authenticated identity (null = unauthenticated) */
 export interface Authenticator {
-    resolve(header: string | undefined): RbacSubject | null | Promise<RbacSubject | null>;
+    resolve(header: string | undefined): IdentitySubject | null | Promise<IdentitySubject | null>;
 }
 /**
  * Custom auth resolver: given the raw Authorization header (including the
@@ -9,12 +9,12 @@ export interface Authenticator {
  * the user from the customer's own database / verify a JWT. Returning null
  * means unauthenticated (401).
  */
-export type AuthResolver = (header: string | undefined) => RbacSubject | null | Promise<RbacSubject | null>;
+export type AuthResolver = (header: string | undefined) => IdentitySubject | null | Promise<IdentitySubject | null>;
 /**
  * The authentication source: either a static key map or a resolver function.
  * `source` is required whenever `auth` is configured (fail fast otherwise).
  */
-export type AuthSource = Record<string, RbacSubject> | AuthResolver;
+export type AuthSource = Record<string, IdentitySubject> | AuthResolver;
 /** authentication config — the single source of truth is `source` */
 export interface AuthConfig {
     source: AuthSource;

package/dist/adapters/auth/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvF;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;AAE5G;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,YAAY,CAAC;AAEpE,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAiB5D"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAC/F;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAEpH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC;AAExE,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAiB5D"}

package/dist/adapters/auth/subject.d.ts

@@ -0,0 +1,22 @@
+import type { Locale } from '../../core/index.js';
+import type { IdentityDirectory } from '../../core/provider/identity/index.js';
+import type { Authenticator } from './source.js';
+import type { AuthVerifier } from './verify.js';
+/**
+ * Compose credential verification with the identity directory:
+ * `credential → (AuthVerifier) → VerifiedIdentity → (IdentityDirectory) → IdentitySubject`.
+ * A verified credential whose user is not provisioned locally is rejected with
+ * `identity.notSynced` (provision with `weave sync:identity` first).
+ */
+export declare function createDirectoryAuthenticator(options: {
+    verifier: AuthVerifier;
+    directory: IdentityDirectory;
+    locale: Locale;
+}): Authenticator;
+/**
+ * Gate any authenticator on the local directory: the resolved subject must have
+ * a synced local user, and RBAC then uses the directory's authoritative
+ * roles/department. Unknown identities are rejected with `identity.notSynced`.
+ */
+export declare function enforceSyncedIdentity(inner: Authenticator, directory: IdentityDirectory, locale: Locale): Authenticator;
+//# sourceMappingURL=subject.d.ts.map

package/dist/adapters/auth/subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/subject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAmB,MAAM,uCAAuC,CAAC;AAChG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,aAAa,CAahB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,MAAM,GACb,aAAa,CAYf"}

package/dist/adapters/auth/subject.js

@@ -0,0 +1,42 @@
+import { SchemaError } from '../../core/index.js';
+/**
+ * Compose credential verification with the identity directory:
+ * `credential → (AuthVerifier) → VerifiedIdentity → (IdentityDirectory) → IdentitySubject`.
+ * A verified credential whose user is not provisioned locally is rejected with
+ * `identity.notSynced` (provision with `weave sync:identity` first).
+ */
+export function createDirectoryAuthenticator(options) {
+    const { verifier, directory, locale } = options;
+    return {
+        async resolve(header) {
+            const verified = await verifier.verify(header);
+            if (verified === null)
+                return null;
+            const subject = await directory.resolve(verified.ref, verified.claims);
+            if (subject === null) {
+                throw new SchemaError('identity.notSynced', { ref: verified.ref }, locale);
+            }
+            return subject;
+        },
+    };
+}
+/**
+ * Gate any authenticator on the local directory: the resolved subject must have
+ * a synced local user, and RBAC then uses the directory's authoritative
+ * roles/department. Unknown identities are rejected with `identity.notSynced`.
+ */
+export function enforceSyncedIdentity(inner, directory, locale) {
+    return {
+        async resolve(header) {
+            const subject = await inner.resolve(header);
+            if (subject === null)
+                return null;
+            const synced = await directory.resolve(subject.id);
+            if (synced === null) {
+                throw new SchemaError('identity.notSynced', { ref: subject.id }, locale);
+            }
+            return synced;
+        },
+    };
+}
+//# sourceMappingURL=subject.js.map

package/dist/adapters/auth/subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject.js","sourceRoot":"","sources":["../../../src/adapters/auth/subject.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAoB,EACpB,SAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/auth/verify.d.ts

@@ -0,0 +1,12 @@
+import type { VerifiedIdentity } from '../../core/provider/identity/index.js';
+/**
+ * Authentication seam: turn a raw credential (the `Authorization` header) into
+ * a verified-but-unresolved identity. Protocol verifiers (OIDC/JWT/SAML) are
+ * supplied by integrations (e.g. `@weave-kit/enterprise`); the engine defines
+ * the contract and composes it with the identity directory. Returning `null`
+ * means the credential is missing/invalid (401).
+ */
+export interface AuthVerifier {
+    verify(header: string | undefined): VerifiedIdentity | null | Promise<VerifiedIdentity | null>;
+}
+//# sourceMappingURL=verify.d.ts.map

package/dist/adapters/auth/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChG"}

package/dist/adapters/auth/verify.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verify.js.map

package/dist/adapters/auth/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/adapters/auth/verify.ts"],"names":[],"mappings":""}

package/dist/adapters/events/index.d.ts

@@ -4,13 +4,14 @@ import type { EventBus } from '../../core/provider/event/index.js';
 import type { SlidingWindow } from '../../core/limiter/index.js';
 import type { Authenticator } from '../auth/index.js';
 /**
- * Live event endpoint (M12, framework-agnostic push channel):
+ * Live event endpoint (framework-agnostic push channel):
  *   GET {prefix}/events  (SSE over `Authorization: Bearer`)
  *
  * Every connection is bound to the authenticated subject and filtered before
  * delivery (a push must never leak a record the identity cannot read, nor an
  * audit event it may not see):
  *   - record.* events   → object must be readable (mirrors MCP list_objects)
+ *   - record.transitioned → same object-readability filter as record.*
  *   - audit.event       → own actorId only, unless the subject holds an admin role
  *   - schema.changed    → broadcast (cache-invalidation nudge, no payload)
  *

package/dist/adapters/events/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAGV,QAAQ,EAET,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,QAAQ,CAAC;IACd,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;CAC1C;AAmBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,aAAkB,GAAG,IAAI,CAuD9G"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAmB,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,EAGV,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,QAAQ,CAAC;IACd,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;CAC1C;AAoBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,aAAkB,GAAG,IAAI,CAuD9G"}

package/dist/adapters/events/index.js

@@ -5,7 +5,8 @@ function passesFilter(event, subject, readable, isAdmin) {
     switch (event.type) {
         case EVENT_TYPES.RECORD_CREATED:
         case EVENT_TYPES.RECORD_UPDATED:
-        case EVENT_TYPES.RECORD_DELETED: {
+        case EVENT_TYPES.RECORD_DELETED:
+        case EVENT_TYPES.RECORD_TRANSITIONED: {
             const payload = event.payload;
             return readable.has(payload.object);
         }

package/dist/adapters/events/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAUzE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAuC9D,SAAS,YAAY,CAAC,KAAkB,EAAE,OAAoB,EAAE,QAAqB,EAAE,OAAgB;IACrG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAA8B,CAAC;YACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAA4B,CAAC;YACnD,OAAO,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACzD,CAAC;QACD;YACE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAgB,EAAE,UAAyB,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAElD,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IAErC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,IAAI,WAAW,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,GAAG,EAAE;gBACZ,WAAW,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpB,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAQ,EAAE;YAC3C,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE;oBAC1C,IAAI,EAAE,WAAW,CAAC,cAAc;oBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AASzE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAwC9D,SAAS,YAAY,CAAC,KAAkB,EAAE,OAAwB,EAAE,QAAqB,EAAE,OAAgB;IACzG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAA6B,CAAC;YACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAA4B,CAAC;YACnD,OAAO,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACzD,CAAC;QACD;YACE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAgB,EAAE,UAAyB,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAElD,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IAErC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,IAAI,WAAW,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,GAAG,EAAE;gBACZ,WAAW,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpB,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAQ,EAAE;YAC3C,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE;oBAC1C,IAAI,EAAE,WAAW,CAAC,cAAc;oBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/mcp/generate.d.ts

@@ -1,4 +1,4 @@
-import type { RbacSubject, ToolDefinition } from '../../core/index.js';
+import type { IdentitySubject, ToolDefinition } from '../../core/index.js';
 import type { ToolExecutor } from '../../runtime/tools/index.js';
 import type { McpEngine, McpToolSpec } from './types.js';
 /**
@@ -20,9 +20,9 @@ export interface CompiledTool {
 /**
  * Compile the full tool surface for a subject: the generic CRUD tools the
  * subject's RBAC permits, the always-on introspection tools, and the
- * subject-visible custom tools (M10b, roles-filtered by the executor).
+ * subject-visible custom tools (roles-filtered by the executor).
  */
-export declare function compileToolsFor(engine: McpEngine, subject: RbacSubject, custom?: {
+export declare function compileToolsFor(engine: McpEngine, subject: IdentitySubject, custom?: {
     defs: ToolDefinition[];
     executor: ToolExecutor;
 }): CompiledTool[];

package/dist/adapters/mcp/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/generate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AASjE,OAAO,KAAK,EAAc,SAAS,EAAiB,WAAW,EAAmB,MAAM,YAAY,CAAC;AAErG;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAiLD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC1D,YAAY,EAAE,CAiChB"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/generate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAUjE,OAAO,KAAK,EAAc,SAAS,EAAiB,WAAW,EAAmB,MAAM,YAAY,CAAC;AAErG;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAyMD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,eAAe,EACxB,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC1D,YAAY,EAAE,CAiChB"}

package/dist/adapters/mcp/generate.js

@@ -1,12 +1,12 @@
-import { INTROSPECTION_TOOLS, REGISTRY_TOOLS, resolvePermission } from '../../core/index.js';
+import { INTROSPECTION_TOOLS, REGISTRY_TOOLS, WORKFLOW_TOOLS, resolvePermissionFor } from '../../core/index.js';
 import { ACTION_PREFIXES } from '../../core/audit/index.js';
-import { createRecordHandler, deleteRecordHandler, getRecordHandler, searchRecordsHandler, updateRecordHandler, } from './tools.js';
+import { createRecordHandler, deleteRecordHandler, getRecordHandler, searchRecordsHandler, updateRecordHandler, workflowTransitionHandler, } from './tools.js';
 import { describeObjectHandler, listObjectsHandler } from './introspection.js';
 /** capabilities the subject holds on at least one object (drives which generic ops appear) */
 function capabilities(registry, subject) {
-    const caps = { read: false, create: false, update: false, delete: false };
+    const caps = { read: false, create: false, update: false, delete: false, transition: false };
     for (const def of registry.list()) {
-        const p = resolvePermission(def, subject.roles);
+        const p = resolvePermissionFor(registry, def, subject.roles);
         if (p === undefined)
             continue;
         if (p.read !== undefined)
@@ -14,8 +14,12 @@ function capabilities(registry, subject) {
         if (p.create === true)
             caps.create = true;
         // `update === null` = all fields updatable; `[]` = none; `undefined` = no update permission
-        if (p.update === null || (Array.isArray(p.update) && p.update.length > 0))
+        const canUpdate = p.update === null || (Array.isArray(p.update) && p.update.length > 0);
+        if (canUpdate)
             caps.update = true;
+        // transitions reuse the update permission; only objects declaring a workflow qualify
+        if (canUpdate && def.workflow !== undefined)
+            caps.transition = true;
         if (p.delete === true)
             caps.delete = true;
     }
@@ -68,7 +72,7 @@ function registryTools(engine, subject) {
                 description: 'Fetch one record of an object by its primary key (not found → error)',
                 inputSchema: {
                     type: 'object',
-                    properties: { object: OBJECT_ARG, id: { type: 'string', description: 'primary key' } },
+                    properties: { object: OBJECT_ARG, id: { type: 'string', description: 'record id (the record_key; see describe_object -> weave_id)' } },
                     required: ['object', 'id'],
                 },
                 handler: (args, ctx) => getRecordHandler(args, ctx),
@@ -103,7 +107,7 @@ function registryTools(engine, subject) {
                     type: 'object',
                     properties: {
                         object: OBJECT_ARG,
-                        id: { type: 'string', description: 'primary key' },
+                        id: { type: 'string', description: 'record id (the record_key; see describe_object -> weave_id)' },
                         changes: { type: 'object', description: 'fields to change', additionalProperties: true },
                     },
                     required: ['object', 'id', 'changes'],
@@ -120,16 +124,35 @@ function registryTools(engine, subject) {
                 description: 'Delete a record of an object by its primary key',
                 inputSchema: {
                     type: 'object',
-                    properties: { object: OBJECT_ARG, id: { type: 'string', description: 'primary key' } },
+                    properties: { object: OBJECT_ARG, id: { type: 'string', description: 'record id (the record_key; see describe_object -> weave_id)' } },
                     required: ['object', 'id'],
                 },
                 handler: (args, ctx) => deleteRecordHandler(args, ctx),
             },
         });
     }
+    if (caps.transition) {
+        tools.push({
+            objectName: undefined,
+            spec: {
+                name: WORKFLOW_TOOLS.TRANSITION,
+                description: 'Fire a declared workflow transition on a record (the action must be allowed from its current state and by your role; see describe_object → workflow)',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        object: OBJECT_ARG,
+                        id: { type: 'string', description: 'record id (the record_key; see describe_object -> weave_id)' },
+                        action: { type: 'string', description: 'workflow transition action name (see describe_object)' },
+                    },
+                    required: ['object', 'id', 'action'],
+                },
+                handler: (args, ctx) => workflowTransitionHandler(args, ctx),
+            },
+        });
+    }
     return tools;
 }
-/** custom-tool surface merged into the session tool surface (roles filtered by the executor, D8-cached) */
+/** custom-tool surface merged into the session tool surface (roles filtered by the executor, cached per subject) */
 function customToolTools(engine, subject, custom) {
     return custom.executor.surface(subject, custom.defs).map((entry) => {
         const def = custom.defs.find((d) => d.name === entry.name);
@@ -140,7 +163,7 @@ function customToolTools(engine, subject, custom) {
                 description: def.description,
                 inputSchema: def.inputSchema,
                 handler: async (args, ctx) => {
-                    // rate limit at the adapter layer (agentKey, widened by roles:tool — M10 D6)
+                    // rate limit at the adapter layer (agentKey, widened by `roles:tool` scope)
                     const scope = `${[...ctx.session.user.roles].sort().join(',')}:${def.name}`;
                     if (!ctx.guardrails.checkRateLimit(ctx.session.agentKey, scope)) {
                         const { SchemaError } = await import('../../core/index.js');
@@ -166,7 +189,7 @@ function customToolTools(engine, subject, custom) {
 /**
  * Compile the full tool surface for a subject: the generic CRUD tools the
  * subject's RBAC permits, the always-on introspection tools, and the
- * subject-visible custom tools (M10b, roles-filtered by the executor).
+ * subject-visible custom tools (roles-filtered by the executor).
  */
 export function compileToolsFor(engine, subject, custom) {
     const tools = [...registryTools(engine, subject)];

package/dist/adapters/mcp/generate.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../../src/adapters/mcp/generate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAqB/E,8FAA8F;AAC9F,SAAS,YAAY,CACnB,QAAwB,EACxB,OAAoB;IAEpB,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAmC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1C,4FAA4F;QAC5F,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9F,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,yFAAyF;CACvG,CAAC;AAEF,kFAAkF;AAClF,SAAS,aAAa,CAAC,MAAiB,EAAE,OAAoB;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR;YACE,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,oEAAoE;gBACjF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,wDAAwD;4BACrE,oBAAoB,EAAE,IAAI;yBAC3B;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,OAAO;4BACb,WAAW,EAAE,yBAAyB;4BACtC,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;gCAC/F,QAAQ,EAAE,CAAC,OAAO,CAAC;6BACpB;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;wBACrD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;wBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;qBACrD;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC;aAClG;SACF,EACD;YACE,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,GAAG;gBACxB,WAAW,EAAE,sEAAsE;gBACnF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;oBACtF,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;iBAC3B;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC;aAC9F;SACF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,uEAAuE;gBACpF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,oBAAoB,EAAE,IAAI,EAAE;qBACnF;oBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;iBAC7B;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,wEAAwE;gBACrF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE;wBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,IAAI,EAAE;qBACzF;oBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;iBACtC;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,iDAAiD;gBAC9D,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;oBACtF,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;iBAC3B;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,SAAS,eAAe,CACtB,MAAiB,EACjB,OAAoB,EACpB,MAA0D;IAE1D,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC7E,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,KAAK,EAAE,IAA6B,EAAE,GAAoB,EAA0B,EAAE;oBAC7F,6EAA6E;oBAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC5E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBAChE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;wBAC5D,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAClE,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;wBACtD,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;wBACzB,KAAK,EAAE;4BACL,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;4BACzB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;4BAClC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU;yBACnC;wBACD,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE;wBACjD,IAAI;wBACJ,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;qBAC1B,CAAC,CAAC;oBACH,OAAO,MAAuB,CAAC;gBACjC,CAAC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAiB,EACjB,OAAoB,EACpB,MAA2D;IAE3D,MAAM,KAAK,GAAmB,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAElE,KAAK,CAAC,IAAI,CACR;QACE,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB,CAAC,YAAY;YACtC,WAAW,EAAE,4CAA4C;YACzD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC;SAChG;KACF,EACD;QACE,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB,CAAC,eAAe;YACzC,WAAW,EAAE,qFAAqF;YAClG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;gBACpE,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC;SACnG;KACF,CACF,CAAC;IAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../../src/adapters/mcp/generate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAqB/E,8FAA8F;AAC9F,SAAS,YAAY,CACnB,QAAwB,EACxB,OAAwB;IAExB,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC7F,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAmC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1C,4FAA4F;QAC5F,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxF,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAClC,qFAAqF;QACrF,IAAI,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,yFAAyF;CACvG,CAAC;AAEF,kFAAkF;AAClF,SAAS,aAAa,CAAC,MAAiB,EAAE,OAAwB;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR;YACE,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,oEAAoE;gBACjF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,wDAAwD;4BACrE,oBAAoB,EAAE,IAAI;yBAC3B;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,OAAO;4BACb,WAAW,EAAE,yBAAyB;4BACtC,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;gCAC/F,QAAQ,EAAE,CAAC,OAAO,CAAC;6BACpB;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;wBACrD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;wBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;qBACrD;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC;aAClG;SACF,EACD;YACE,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,GAAG;gBACxB,WAAW,EAAE,sEAAsE;gBACnF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,EAAE;oBACtI,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;iBAC3B;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC;aAC9F;SACF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,uEAAuE;gBACpF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,oBAAoB,EAAE,IAAI,EAAE;qBACnF;oBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;iBAC7B;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,wEAAwE;gBACrF,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE;wBAClG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,IAAI,EAAE;qBACzF;oBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;iBACtC;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,MAAM;gBAC3B,WAAW,EAAE,iDAAiD;gBAC9D,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,EAAE;oBACtI,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;iBAC3B;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc,CAAC,UAAU;gBAC/B,WAAW,EACT,sJAAsJ;gBACxJ,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,UAAU;wBAClB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE;wBAClG,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;qBACjG;oBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;iBACrC;gBACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC;aACvG;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oHAAoH;AACpH,SAAS,eAAe,CACtB,MAAiB,EACjB,OAAwB,EACxB,MAA0D;IAE1D,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC7E,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,KAAK,EAAE,IAA6B,EAAE,GAAoB,EAA0B,EAAE;oBAC7F,4EAA4E;oBAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC5E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBAChE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;wBAC5D,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAClE,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;wBACtD,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;wBACzB,KAAK,EAAE;4BACL,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;4BACzB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;4BAClC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU;yBACnC;wBACD,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE;wBACjD,IAAI;wBACJ,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;qBAC1B,CAAC,CAAC;oBACH,OAAO,MAAuB,CAAC;gBACjC,CAAC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAiB,EACjB,OAAwB,EACxB,MAA2D;IAE3D,MAAM,KAAK,GAAmB,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAElE,KAAK,CAAC,IAAI,CACR;QACE,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB,CAAC,YAAY;YACtC,WAAW,EAAE,4CAA4C;YACzD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC;SAChG;KACF,EACD;QACE,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB,CAAC,eAAe;YACzC,WAAW,EAAE,qFAAqF;YAClG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;gBACpE,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,CAAC,IAA6B,EAAE,GAAoB,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC;SACnG;KACF,CACF,CAAC;IAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/adapters/mcp/guardrails.d.ts

@@ -21,7 +21,7 @@ export interface McpGuardrails {
      * limit. On over-limit it fires a WARN alert and returns false — the caller
      * turns that into an isError tool result. An optional `scope` widens the
      * window key (e.g. `${rolesHash}:${tool}`) so role/tool dimensions get their
-     * own windows (M10 D6); scope absent = per-agentKey as before.
+     * own windows; scope absent = per-agentKey as before.
      */
     checkRateLimit(key: string, scope?: string, now?: number): boolean;
     /** record a tool-call audit event; failures are caught (audit is best-effort) */

package/dist/adapters/mcp/http.d.ts

@@ -13,7 +13,7 @@ export interface McpHttpDeps {
     guardrails: McpGuardrails;
     sessionStore: McpSessionStore;
     locale: Locale;
-    /** M10 custom tools: loaded definitions + the protocol-agnostic executor */
+    /** custom tools: loaded definitions + the protocol-agnostic executor */
     tools?: {
         defs: ToolDefinition[];
         executor: ToolExecutor;
@@ -27,6 +27,8 @@ export interface McpHttpDeps {
      * every `writeHead` call instead (`true` reflects the request origin).
      */
     corsOrigin?: string | string[] | boolean;
+    /** allow a call-level `onBehalfOf` override (default false) */
+    allowImpersonation?: boolean;
 }
 export declare function registerMcpRoutes(app: FastifyInstance, deps: McpHttpDeps): void;
 //# sourceMappingURL=http.d.ts.map

package/dist/adapters/mcp/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,cAAc,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,YAAY,CAAC;AAwD3D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,aAAa,CAAC;IAC1B,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;CAC1C;AAmCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA+I/E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,cAAc,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,YAAY,CAAC;AAwD3D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,aAAa,CAAC;IAC1B,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA+I/E"}

package/dist/adapters/mcp/http.js

@@ -79,7 +79,7 @@ export function registerMcpRoutes(app, deps) {
     const sessionStore = deps.sessionStore;
     const path = endpoint ?? '/mcp';
     const sessions = new Map();
-    /** per-subject compiled surface cache (D8: kills the per-request full recompile on list AND call) */
+    /** per-subject compiled surface cache (kills the per-request full recompile on list AND call) */
     const surfaceCache = new Map();
     function surfaceFor(session) {
         const key = `${session.user.id}:${[...session.user.roles].sort().join(',')}`;
@@ -117,7 +117,7 @@ export function registerMcpRoutes(app, deps) {
                 auditDeniedTool(guardrails, session, name, request.params.arguments);
                 throw new SchemaError('mcp.tool.notFound', { tool: name }, locale);
             }
-            const ctx = { engine, session, guardrails, resolveIdentity: identityResolver };
+            const ctx = { engine, session, guardrails, resolveIdentity: identityResolver, allowImpersonation: deps.allowImpersonation === true };
             const result = await tool.spec.handler((request.params.arguments ?? {}), ctx);
             return result;
         });

package/dist/adapters/mcp/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGxH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIhD,OAAO,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AAGnE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAA6C,EAAE,aAAiC;IACnG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAIF,CAAC;IACpB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,UAAkB,EAAE,aAAgD,EAAE,OAAiC,EAAE,EAAE;QAC3H,IAAI,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG,OAA8C,CAAC;YACtD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC;QACjE,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAa,CAAC;YAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAa,CAAC,CAAC;IAC7D,CAAC,CAAyB,CAAC;AAC7B,CAAC;AA4BD,gFAAgF;AAChF,SAAS,eAAe,CACtB,UAAyB,EACzB,OAAmB,EACnB,IAAY,EACZ,IAAa;IAEb,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,iBAAiB,CAAC,KAAK;QAClC,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC7C,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,mBAAmB;QAC9B,IAAI,EAAE;YACJ,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;YACnC,IAAI;SACL;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAiB;IACvE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAoB,IAAI,CAAC,YAAY,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,qGAAqG;IACrG,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,SAAS,UAAU,CAAC,OAAmB;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,SAAS,WAAW,CAAC,SAAmC;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;gBAC/B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,4EAA4E;gBAC5E,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;YAC/E,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,EAAE,GAAG,CAAC,CAAC;YACxH,OAAO,MAAmC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa,CAAC,QAAgB,EAAE,KAAmB;QAC1D,MAAM,KAAK,GAAiB,EAAkB,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,GAAW,EAAE,EAAE;gBACpC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;gBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,KAAmB;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAe,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtG,sFAAsF;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YACxG,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,YAAY;gBACZ,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,8EAA8E;QAC9E,oEAAoE;QACpE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpE,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGxH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIhD,OAAO,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AAGnE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAA6C,EAAE,aAAiC;IACnG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAIF,CAAC;IACpB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,UAAkB,EAAE,aAAgD,EAAE,OAAiC,EAAE,EAAE;QAC3H,IAAI,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG,OAA8C,CAAC;YACtD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC;QACjE,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAa,CAAC;YAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAa,CAAC,CAAC;IAC7D,CAAC,CAAyB,CAAC;AAC7B,CAAC;AA8BD,gFAAgF;AAChF,SAAS,eAAe,CACtB,UAAyB,EACzB,OAAmB,EACnB,IAAY,EACZ,IAAa;IAEb,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,iBAAiB,CAAC,KAAK;QAClC,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC7C,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,mBAAmB;QAC9B,IAAI,EAAE;YACJ,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;YACnC,IAAI;SACL;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAiB;IACvE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAoB,IAAI,CAAC,YAAY,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,iGAAiG;IACjG,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,SAAS,UAAU,CAAC,OAAmB;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,SAAS,WAAW,CAAC,SAAmC;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;gBAC/B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,4EAA4E;gBAC5E,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,CAAC;YACO,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAC7I,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,EAAE,GAAG,CAAC,CAAC;YACxH,OAAO,MAAmC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa,CAAC,QAAgB,EAAE,KAAmB;QAC1D,MAAM,KAAK,GAAiB,EAAkB,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,GAAW,EAAE,EAAE;gBACpC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;gBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,KAAmB;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAe,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtG,sFAAsF;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YACxG,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,YAAY;gBACZ,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,8EAA8E;QAC9E,oEAAoE;QACpE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpE,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}