@winstonsayno/mcp-gateway 5.4.0 → 5.6.0

package/dist/features/dlp.js

@@ -0,0 +1,203 @@
+/**
+ * Data loss prevention (5.6): classify sensitive data in tool traffic and mask it per tenant.
+ *
+ * Every match of a built-in PII detector (e-mail, phone, card, SSN, IBAN, IPv4, PRC ID) or a custom detector gets a
+ * sensitivity **level** — `public` < `internal` < `confidential` < `restricted`. Each tenant has a **clearance**;
+ * data above it is handled with the tenant's **strategy**:
+ *
+ * - `redact` → `[REDACTED:email]`;
+ * - `mask` → keeps the last 4 characters (`••••••1234`);
+ * - `hash` → a stable pseudonym `tok_3f9a1c2b` (HMAC with the tenant's salt), so joins still work;
+ * - `block` → the call fails with `-32013`.
+ *
+ * ```yaml
+ * dlp:
+ *   scope: results                 # arguments | results | both
+ *   default: { clearance: internal, strategy: mask }
+ *   tenants:
+ *     finance: { clearance: restricted }
+ *     trial:   { clearance: public, strategy: block }
+ *   detectors:
+ *     - { name: employee-id, pattern: "EMP-\\d{6}", level: confidential }
+ *   levels: { ipv4: public }       # override built-in category levels
+ * ```
+ *
+ * - `GET  /admin/dlp` — effective policy and counters (findings by category / level, actions by strategy).
+ * - `POST /admin/dlp/classify` — `{ value, tenant? }` → findings and the value as that tenant would see it.
+ *
+ * @module features/dlp
+ */
+import { createHmac } from 'node:crypto';
+import { z } from 'zod';
+import { registerFeature, objectBody } from '../gateway/features.js';
+import { registerCallHook } from '../gateway/hooks.js';
+import { DETECTORS } from '../policy/compliance.js';
+import { globToRegExp } from '../utils/tool-filter.js';
+export const LEVELS = ['public', 'internal', 'confidential', 'restricted'];
+export const ERR_DLP_BLOCKED = -32013;
+const TenantPolicy = z.object({ clearance: z.enum(LEVELS).optional(), strategy: z.enum(['redact', 'mask', 'hash', 'block']).optional(), salt: z.string().optional() }).strict();
+export const DlpSchema = z
+    .object({
+    enabled: z.boolean().default(true),
+    scope: z.enum(['arguments', 'results', 'both']).default('results'),
+    servers: z.array(z.string()).optional(),
+    default: TenantPolicy.default({}),
+    tenants: z.record(TenantPolicy).default({}),
+    levels: z.record(z.enum(LEVELS)).default({}),
+    detectors: z
+        .array(z
+        .object({
+        name: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+        pattern: z.string().min(1).refine((p) => { try {
+            new RegExp(p);
+            return true;
+        }
+        catch {
+            return false;
+        } }, 'invalid regular expression'),
+        level: z.enum(LEVELS).default('confidential'),
+    })
+        .strict())
+        .default([]),
+})
+    .strict();
+/** Built-in category levels. */
+export const DEFAULT_LEVELS = { email: 'internal', phone: 'internal', ipv4: 'internal', iban: 'confidential', 'credit-card': 'restricted', ssn: 'restricted', 'cn-id': 'restricted' };
+const rank = (l) => LEVELS.indexOf(l);
+export function policyFor(cfg, tenant) {
+    const t = (tenant && cfg.tenants[tenant]) || {};
+    return { clearance: t.clearance ?? cfg.default.clearance ?? 'internal', strategy: t.strategy ?? cfg.default.strategy ?? 'mask', salt: t.salt ?? cfg.default.salt ?? `mcp-gateway:${tenant ?? '-'}` };
+}
+export function maskValue(s, strategy, category, salt) {
+    if (strategy === 'redact')
+        return `[REDACTED:${category}]`;
+    if (strategy === 'hash')
+        return `tok_${createHmac('sha256', salt).update(s).digest('hex').slice(0, 8)}`;
+    const keep = s.length > 8 ? 4 : 0;
+    return '•'.repeat(Math.max(4, s.length - keep)) + (keep ? s.slice(-keep) : '');
+}
+/** Classify and transform every string inside a JSON value for one tenant. */
+export function applyDlp(value, cfg, tenant) {
+    const pol = policyFor(cfg, tenant);
+    const dets = [
+        ...DETECTORS.map((d) => ({ name: d.category, re: d.re, valid: d.valid, level: (cfg.levels[d.category] ?? DEFAULT_LEVELS[d.category] ?? 'confidential') })),
+        ...cfg.detectors.map((d) => ({ name: d.name, re: new RegExp(d.pattern, 'g'), valid: undefined, level: (cfg.levels[d.name] ?? d.level) })),
+    ];
+    const findings = [];
+    let blocked = false;
+    const scan = (s, path) => {
+        let out = s;
+        for (const d of dets) {
+            d.re.lastIndex = 0;
+            out = out.replace(d.re, (m) => {
+                if (m.startsWith('[REDACTED:') || m.startsWith('tok_') || m.startsWith('••••'))
+                    return m;
+                if (d.valid && !d.valid(m))
+                    return m;
+                const over = rank(d.level) > rank(pol.clearance);
+                const action = over ? pol.strategy : 'allow';
+                findings.push({ category: d.name, level: d.level, path, action });
+                if (!over)
+                    return m;
+                if (pol.strategy === 'block') {
+                    blocked = true;
+                    return m;
+                }
+                return maskValue(m, pol.strategy, d.name, pol.salt);
+            });
+        }
+        return out;
+    };
+    const walk = (v, path, depth) => {
+        if (depth > 64)
+            return v;
+        if (typeof v === 'string')
+            return scan(v, path);
+        if (Array.isArray(v))
+            return v.map((x, i) => walk(x, `${path}[${i}]`, depth + 1));
+        if (v && typeof v === 'object')
+            return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x, path ? `${path}.${k}` : k, depth + 1)]));
+        return v;
+    };
+    const out = walk(value, '', 0);
+    return { value: blocked ? value : out, findings, blocked };
+}
+/** Counters since start (process-wide). */
+export const dlpStats = { calls: 0, byCategory: {}, byLevel: {}, byAction: {} };
+function count(findings) {
+    dlpStats.calls++;
+    for (const f of findings) {
+        dlpStats.byCategory[f.category] = (dlpStats.byCategory[f.category] ?? 0) + 1;
+        dlpStats.byLevel[f.level] = (dlpStats.byLevel[f.level] ?? 0) + 1;
+        dlpStats.byAction[f.action] = (dlpStats.byAction[f.action] ?? 0) + 1;
+    }
+}
+function active(cfg, serverId, dir) {
+    if (!cfg.dlp)
+        return undefined;
+    const d = DlpSchema.parse(cfg.dlp);
+    if (!d.enabled || (d.scope !== 'both' && d.scope !== dir))
+        return undefined;
+    if (d.servers?.length && !d.servers.some((g) => globToRegExp(g).test(serverId)))
+        return undefined;
+    return d;
+}
+registerCallHook({
+    id: 'dlp',
+    before: (call, cfg) => {
+        const d = active(cfg, call.serverId, 'arguments');
+        if (!d)
+            return;
+        const r = applyDlp(call.args, d, call.tenant);
+        if (!r.findings.length)
+            return;
+        count(r.findings);
+        if (r.blocked)
+            return { refuse: { code: ERR_DLP_BLOCKED, message: `DLP: sensitive data in the arguments (${[...new Set(r.findings.filter((f) => f.action === 'block').map((f) => f.category))].join(', ')})`, data: { levels: [...new Set(r.findings.map((f) => f.level))] } } };
+        return { args: r.value };
+    },
+    after: (call, result, cfg) => {
+        if (!result.success)
+            return;
+        const d = active(cfg, call.serverId, 'results');
+        if (!d)
+            return;
+        const r = applyDlp(result.result, d, call.tenant);
+        if (!r.findings.length)
+            return;
+        count(r.findings);
+        if (r.blocked) {
+            const cats = [...new Set(r.findings.filter((f) => f.action === 'block').map((f) => f.category))];
+            return { success: false, durationMs: result.durationMs, error: { code: ERR_DLP_BLOCKED, message: `DLP: the result contains data above this caller's clearance (${cats.join(', ')})`, data: { decision: 'dlp', categories: cats } } };
+        }
+        return { ...result, result: r.value };
+    },
+});
+registerFeature({
+    id: 'dlp',
+    since: '5.6.0',
+    summary: 'Data loss prevention: sensitivity levels, per-tenant clearance and masking',
+    mount: (router, ctx) => {
+        const cfg = () => DlpSchema.parse(ctx.config().dlp ?? { enabled: false });
+        router.get('/', (_req, res) => {
+            const c = cfg();
+            res.json({
+                enabled: !!ctx.config().dlp && c.enabled,
+                scope: c.scope,
+                levels: { ...DEFAULT_LEVELS, ...Object.fromEntries(c.detectors.map((d) => [d.name, d.level])), ...c.levels },
+                default: policyFor(c, undefined),
+                tenants: Object.fromEntries(Object.keys(c.tenants).map((t) => { const { salt: _s, ...p } = policyFor(c, t); return [t, p]; })),
+                stats: dlpStats,
+            });
+        });
+        router.post('/classify', (req, res) => {
+            const b = objectBody(req, res);
+            if (!b)
+                return;
+            const r = applyDlp(b.value, cfg(), typeof b.tenant === 'string' ? b.tenant : undefined);
+            const { salt: _s, ...pol } = policyFor(cfg(), typeof b.tenant === 'string' ? b.tenant : undefined);
+            res.json({ policy: pol, blocked: r.blocked, findings: r.findings, value: r.value });
+        });
+    },
+});
+//# sourceMappingURL=dlp.js.map

package/dist/features/dlp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dlp.js","sourceRoot":"","sources":["../../src/features/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAGpF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC;AAEtC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChL,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC;QACvI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;KAC9C,CAAC;SACD,MAAM,EAAE,CACZ;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,gCAAgC;AAChC,MAAM,CAAC,MAAM,cAAc,GAA0B,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AAc7M,MAAM,IAAI,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7C,MAAM,UAAU,SAAS,CAAC,GAAa,EAAE,MAA0B;IACjE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;AACvM,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,QAAoC,EAAE,QAAgB,EAAE,IAAY;IACvG,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,aAAa,QAAQ,GAAG,CAAC;IAC3D,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,GAAa,EAAE,MAA0B;IAC7E,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAU,EAAE,CAAC,CAAC;QAC7K,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,SAAiD,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAU,EAAE,CAAC,CAAC;KAC3L,CAAC;IACF,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,IAAY,EAAU,EAAE;QAC/C,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,CAAC,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACnB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,CAAC,CAAC;gBACzF,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAyB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;gBACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC;gBACpB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAC7B,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAE,KAAa,EAAW,EAAE;QAChE,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5K,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAM,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAA4B,EAAE,OAAO,EAAE,EAA4B,EAAE,QAAQ,EAAE,EAA4B,EAAE,CAAC;AAC9J,SAAS,KAAK,CAAC,QAAsB;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7E,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAkB,EAAE,QAAgB,EAAE,GAA4B;IAChF,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO;QAC/B,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yCAAyC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACjR,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QAC3B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO;QAC/B,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACjG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gEAAgE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACvO,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;CACF,CAAC,CAAC;AAEH,eAAe,CAAC;IACd,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,4EAA4E;IACrF,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC5B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO;gBACxC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE;gBAC5G,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC;gBAChC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9H,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxF,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/features/index.d.ts

@@ -8,5 +8,7 @@ import './conformance.js';
 import './regions.js';
 import './edge-fleet.js';
 import './marketplace.js';
+import './sessions.js';
+import './dlp.js';
 export { listFeatures, registerFeature, createFeatureRouter } from '../gateway/features.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/features/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,eAAe,CAAC;AACvB,OAAO,UAAU,CAAC;AAElB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/features/index.js

@@ -8,5 +8,7 @@ import './conformance.js';
 import './regions.js';
 import './edge-fleet.js';
 import './marketplace.js';
+import './sessions.js';
+import './dlp.js';
 export { listFeatures, registerFeature, createFeatureRouter } from '../gateway/features.js';
 //# sourceMappingURL=index.js.map

package/dist/features/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,eAAe,CAAC;AACvB,OAAO,UAAU,CAAC;AAElB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/features/sessions.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Agent session recording, replay and regression evals (5.5).
+ *
+ * A **recording** ("cassette") is an ordered list of tool calls an agent made — arguments and results — taken
+ * from the replay recorder (`replay.enabled: true`) for one client and time window, or imported as JSON. Replaying
+ * runs every call again through the full pipeline and grades each response against the recorded one:
+ *
+ * - `success` — the call must succeed again (default);
+ * - `structure` — same JSON shape (keys and types), values may differ;
+ * - `exact` — identical result.
+ *
+ * The eval report gives the pass rate, each failing step with a structural diff, and latency before / after —
+ * a regression test for "does this agent's workflow still work after I upgraded that MCP server?".
+ *
+ * ```yaml
+ * sessions:
+ *   dir: ./recordings   # persist recordings as JSON (relative to the config file); in memory when omitted
+ *   maxRecordings: 100
+ * ```
+ *
+ * - `GET    /admin/sessions` — recordings (name, steps, client, created).
+ * - `POST   /admin/sessions` — record `{ name, clientId?, since?, until?, tools? }` from captured calls.
+ * - `PUT    /admin/sessions/:name` — import a recording `{ steps: [{ serverId, tool, arguments, result?, success }] }`.
+ * - `GET    /admin/sessions/:name` — export; `DELETE` removes.
+ * - `POST   /admin/sessions/:name/replay` — `{ mode?, stopOnFailure? }` → eval report.
+ *
+ * @module features/sessions
+ */
+import { z } from 'zod';
+import { type FeatureContext } from '../gateway/features.js';
+import { type CapturedCall, type JsonChange } from '../gateway/replay.js';
+export declare const SessionsSchema: z.ZodObject<{
+    dir: z.ZodOptional<z.ZodString>;
+    maxRecordings: z.ZodDefault<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    maxRecordings: number;
+    dir?: string | undefined;
+}, {
+    dir?: string | undefined;
+    maxRecordings?: number | undefined;
+}>;
+export type SessionsConfig = z.input<typeof SessionsSchema>;
+export interface RecordedStep {
+    serverId: string;
+    tool: string;
+    arguments: Record<string, unknown>;
+    result?: unknown;
+    success: boolean;
+    durationMs?: number;
+}
+export interface Recording {
+    name: string;
+    createdAt: string;
+    clientId?: string;
+    steps: RecordedStep[];
+}
+export type EvalMode = 'success' | 'structure' | 'exact';
+export interface StepOutcome {
+    index: number;
+    serverId: string;
+    tool: string;
+    passed: boolean;
+    reason?: string;
+    durationMs: number;
+    recordedMs?: number;
+    diff?: JsonChange[];
+}
+export interface EvalReport {
+    recording: string;
+    mode: EvalMode;
+    steps: number;
+    passed: number;
+    failed: number;
+    skipped: number;
+    passRate: number;
+    latency: {
+        recordedMs: number;
+        replayMs: number;
+    };
+    outcomes: StepOutcome[];
+}
+/** Build a recording from captured calls. Truncated captures (no arguments) are dropped. */
+export declare function recordFrom(calls: CapturedCall[], sel: {
+    name: string;
+    clientId?: string;
+    since?: string;
+    until?: string;
+    tools?: string[];
+}): Recording;
+/** Keys and value types only. */
+export declare function shapeOf(v: unknown): unknown;
+/** Grade one replayed step. */
+export declare function grade(step: RecordedStep, got: {
+    success: boolean;
+    result?: unknown;
+    error?: {
+        message: string;
+    };
+}, mode: EvalMode): {
+    passed: boolean;
+    reason?: string;
+    diff?: JsonChange[];
+};
+/** Replay a recording through `invoke` and grade it. */
+export declare function replayRecording(rec: Recording, invoke: FeatureContext['invoke'], opts?: {
+    mode?: EvalMode;
+    stopOnFailure?: boolean;
+}): Promise<EvalReport>;
+/** Validate an imported recording body. */
+export declare function parseSteps(raw: unknown): RecordedStep[] | string;
+/** Recording storage: memory, plus a JSON file per recording when `dir` is set. */
+export declare class RecordingStore {
+    private readonly dir;
+    private readonly max;
+    private readonly mem;
+    private loaded?;
+    constructor(dir: () => string | undefined, max: () => number);
+    private load;
+    list(): Promise<Recording[]>;
+    get(name: string): Promise<Recording | undefined>;
+    put(r: Recording): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+//# sourceMappingURL=sessions.d.ts.map

package/dist/features/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/features/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACtG,OAAO,EAAY,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEpF,eAAO,MAAM,cAAc;;;;;;;;;EAAoH,CAAC;AAChJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AACD,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AACzD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;CACrB;AACD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAID,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CASvJ;AAED,iCAAiC;AACjC,wBAAgB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAI3C;AAED,+BAA+B;AAC/B,wBAAgB,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAA;CAAE,CAM7L;AAED,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BpK;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,EAAE,GAAG,MAAM,CAUhE;AAED,mFAAmF;AACnF,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,GAAG;IAA4B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgC;IACpD,OAAO,CAAC,MAAM,CAAC,CAAS;gBAEK,GAAG,EAAE,MAAM,MAAM,GAAG,SAAS,EAAmB,GAAG,EAAE,MAAM,MAAM;YAEhF,IAAI;IAaZ,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAK5B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAKjD,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAO7C"}

package/dist/features/sessions.js

@@ -0,0 +1,229 @@
+/**
+ * Agent session recording, replay and regression evals (5.5).
+ *
+ * A **recording** ("cassette") is an ordered list of tool calls an agent made — arguments and results — taken
+ * from the replay recorder (`replay.enabled: true`) for one client and time window, or imported as JSON. Replaying
+ * runs every call again through the full pipeline and grades each response against the recorded one:
+ *
+ * - `success` — the call must succeed again (default);
+ * - `structure` — same JSON shape (keys and types), values may differ;
+ * - `exact` — identical result.
+ *
+ * The eval report gives the pass rate, each failing step with a structural diff, and latency before / after —
+ * a regression test for "does this agent's workflow still work after I upgraded that MCP server?".
+ *
+ * ```yaml
+ * sessions:
+ *   dir: ./recordings   # persist recordings as JSON (relative to the config file); in memory when omitted
+ *   maxRecordings: 100
+ * ```
+ *
+ * - `GET    /admin/sessions` — recordings (name, steps, client, created).
+ * - `POST   /admin/sessions` — record `{ name, clientId?, since?, until?, tools? }` from captured calls.
+ * - `PUT    /admin/sessions/:name` — import a recording `{ steps: [{ serverId, tool, arguments, result?, success }] }`.
+ * - `GET    /admin/sessions/:name` — export; `DELETE` removes.
+ * - `POST   /admin/sessions/:name/replay` — `{ mode?, stopOnFailure? }` → eval report.
+ *
+ * @module features/sessions
+ */
+import { mkdir, readFile, readdir, unlink, writeFile } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+import { z } from 'zod';
+import { registerFeature, objectBody, badRequest } from '../gateway/features.js';
+import { jsonDiff } from '../gateway/replay.js';
+export const SessionsSchema = z.object({ dir: z.string().min(1).optional(), maxRecordings: z.number().int().positive().default(100) }).strict();
+const NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+/** Build a recording from captured calls. Truncated captures (no arguments) are dropped. */
+export function recordFrom(calls, sel) {
+    const since = sel.since ? Date.parse(sel.since) : -Infinity;
+    const until = sel.until ? Date.parse(sel.until) : Infinity;
+    const steps = calls
+        .filter((c) => c.kind === 'tool' && !c.replayOf && c.arguments !== undefined)
+        .filter((c) => (sel.clientId === undefined || c.clientId === sel.clientId) && (!sel.tools?.length || sel.tools.includes(c.tool)))
+        .filter((c) => { const t = Date.parse(c.timestamp); return t >= since && t <= until; })
+        .map((c) => ({ serverId: c.serverId, tool: c.tool, arguments: c.arguments, ...(c.result !== undefined ? { result: c.result } : {}), success: c.success, durationMs: c.durationMs }));
+    return { name: sel.name, createdAt: new Date().toISOString(), ...(sel.clientId ? { clientId: sel.clientId } : {}), steps };
+}
+/** Keys and value types only. */
+export function shapeOf(v) {
+    if (Array.isArray(v))
+        return v.map(shapeOf);
+    if (v && typeof v === 'object')
+        return Object.fromEntries(Object.entries(v).sort(([a], [b]) => a.localeCompare(b)).map(([k, x]) => [k, shapeOf(x)]));
+    return v === null ? 'null' : typeof v;
+}
+/** Grade one replayed step. */
+export function grade(step, got, mode) {
+    if (step.success && !got.success)
+        return { passed: false, reason: `failed: ${got.error?.message ?? 'error'}` };
+    if (!step.success)
+        return got.success ? { passed: false, reason: 'recorded call failed but the replay succeeded' } : { passed: true };
+    if (mode === 'success' || step.result === undefined)
+        return { passed: true };
+    const diff = mode === 'exact' ? jsonDiff(step.result, got.result, 20) : jsonDiff(shapeOf(step.result), shapeOf(got.result), 20);
+    return diff.length ? { passed: false, reason: mode === 'exact' ? 'result changed' : 'result shape changed', diff } : { passed: true };
+}
+/** Replay a recording through `invoke` and grade it. */
+export async function replayRecording(rec, invoke, opts = {}) {
+    const mode = opts.mode ?? 'success';
+    const outcomes = [];
+    let stop = false;
+    for (const [index, step] of rec.steps.entries()) {
+        if (stop)
+            break;
+        const started = Date.now();
+        let got;
+        try {
+            got = await invoke(step.serverId, step.tool, step.arguments, `replay:${rec.name}`);
+        }
+        catch (e) {
+            got = { success: false, error: { message: e.message } };
+        }
+        const g = grade(step, got, mode);
+        outcomes.push({ index, serverId: step.serverId, tool: step.tool, ...g, durationMs: Date.now() - started, ...(step.durationMs !== undefined ? { recordedMs: step.durationMs } : {}) });
+        if (!g.passed && opts.stopOnFailure)
+            stop = true;
+    }
+    const passed = outcomes.filter((o) => o.passed).length;
+    const sum = (xs) => xs.reduce((a, b) => a + b, 0);
+    return {
+        recording: rec.name,
+        mode,
+        steps: rec.steps.length,
+        passed,
+        failed: outcomes.length - passed,
+        skipped: rec.steps.length - outcomes.length,
+        passRate: rec.steps.length ? passed / rec.steps.length : 1,
+        latency: { recordedMs: sum(rec.steps.map((s) => s.durationMs ?? 0)), replayMs: sum(outcomes.map((o) => o.durationMs)) },
+        outcomes,
+    };
+}
+/** Validate an imported recording body. */
+export function parseSteps(raw) {
+    if (!Array.isArray(raw))
+        return '"steps" must be an array';
+    const out = [];
+    for (const [i, s] of raw.entries()) {
+        const x = s;
+        if (!x || typeof x.serverId !== 'string' || typeof x.tool !== 'string')
+            return `steps[${i}]: "serverId" and "tool" are required`;
+        if (x.arguments !== undefined && (typeof x.arguments !== 'object' || x.arguments === null || Array.isArray(x.arguments)))
+            return `steps[${i}].arguments must be an object`;
+        out.push({ serverId: x.serverId, tool: x.tool, arguments: x.arguments ?? {}, ...(x.result !== undefined ? { result: x.result } : {}), success: x.success !== false, ...(typeof x.durationMs === 'number' ? { durationMs: x.durationMs } : {}) });
+    }
+    return out;
+}
+/** Recording storage: memory, plus a JSON file per recording when `dir` is set. */
+export class RecordingStore {
+    dir;
+    max;
+    mem = new Map();
+    loaded;
+    constructor(dir, max) {
+        this.dir = dir;
+        this.max = max;
+    }
+    async load() {
+        const d = this.dir();
+        if (!d || this.loaded === d)
+            return;
+        this.loaded = d;
+        const files = await readdir(d).catch(() => []);
+        for (const f of files.filter((x) => x.endsWith('.json'))) {
+            try {
+                const r = JSON.parse(await readFile(join(d, f), 'utf8'));
+                if (r && NAME.test(r.name) && Array.isArray(r.steps))
+                    this.mem.set(r.name, r);
+            }
+            catch { /* skip unreadable */ }
+        }
+    }
+    async list() {
+        await this.load();
+        return [...this.mem.values()].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    }
+    async get(name) {
+        await this.load();
+        return this.mem.get(name);
+    }
+    async put(r) {
+        await this.load();
+        if (!this.mem.has(r.name) && this.mem.size >= this.max())
+            throw new Error(`recording limit reached (${this.max()})`);
+        this.mem.set(r.name, r);
+        const d = this.dir();
+        if (d) {
+            await mkdir(d, { recursive: true });
+            await writeFile(join(d, `${r.name}.json`), JSON.stringify(r, null, 2) + '\n');
+        }
+    }
+    async delete(name) {
+        await this.load();
+        const had = this.mem.delete(name);
+        const d = this.dir();
+        if (d)
+            await unlink(join(d, `${name}.json`)).catch(() => undefined);
+        return had;
+    }
+}
+registerFeature({
+    id: 'sessions',
+    since: '5.5.0',
+    summary: 'Agent session recording, replay and regression evals',
+    mount: (router, ctx) => {
+        const cfg = () => SessionsSchema.parse(ctx.config().sessions ?? {});
+        const store = new RecordingStore(() => { const d = cfg().dir; return d ? resolve(ctx.config().configDir ?? process.cwd(), d) : undefined; }, () => cfg().maxRecordings);
+        const summary = (r) => ({ name: r.name, createdAt: r.createdAt, clientId: r.clientId, steps: r.steps.length, tools: [...new Set(r.steps.map((s) => s.tool))] });
+        const save = async (res, r) => {
+            try {
+                await store.put(r);
+                res.status(201).json(summary(r));
+            }
+            catch (e) {
+                res.status(409).json({ error: 'Conflict', message: e.message });
+            }
+        };
+        router.get('/', async (_req, res) => void res.json({ recordings: (await store.list()).map(summary), replayEnabled: ctx.config().replay?.enabled === true }));
+        router.post('/', async (req, res) => {
+            const b = objectBody(req, res);
+            if (!b)
+                return;
+            if (typeof b.name !== 'string' || !NAME.test(b.name))
+                return badRequest(res, '"name" is required ([A-Za-z0-9_.-], ≤ 64)');
+            if (ctx.config().replay?.enabled !== true)
+                return void res.status(409).json({ error: 'Conflict', message: 'recording needs `replay.enabled: true` (captures arguments and results)' });
+            const rec = recordFrom(ctx.capturedCalls?.() ?? [], { name: b.name, clientId: typeof b.clientId === 'string' ? b.clientId : undefined, since: typeof b.since === 'string' ? b.since : undefined, until: typeof b.until === 'string' ? b.until : undefined, tools: Array.isArray(b.tools) ? b.tools.map(String) : undefined });
+            if (!rec.steps.length)
+                return void res.status(422).json({ error: 'Unprocessable Entity', message: 'no captured tool calls match' });
+            await save(res, rec);
+        });
+        router.put('/:name', async (req, res) => {
+            const b = objectBody(req, res);
+            if (!b)
+                return;
+            if (!NAME.test(req.params.name))
+                return badRequest(res, 'invalid recording name');
+            const steps = parseSteps(b.steps);
+            if (typeof steps === 'string')
+                return badRequest(res, steps);
+            await save(res, { name: req.params.name, createdAt: new Date().toISOString(), ...(typeof b.clientId === 'string' ? { clientId: b.clientId } : {}), steps });
+        });
+        router.get('/:name', async (req, res) => {
+            const r = await store.get(req.params.name);
+            if (!r)
+                return void res.status(404).json({ error: 'Not Found', message: 'no such recording' });
+            res.json(r);
+        });
+        router.delete('/:name', async (req, res) => void res.json({ deleted: await store.delete(req.params.name) }));
+        router.post('/:name/replay', async (req, res) => {
+            const r = await store.get(req.params.name);
+            if (!r)
+                return void res.status(404).json({ error: 'Not Found', message: 'no such recording' });
+            const b = (req.body ?? {});
+            if (b.mode !== undefined && !['success', 'structure', 'exact'].includes(String(b.mode)))
+                return badRequest(res, '"mode" must be success, structure or exact');
+            res.json(await replayRecording(r, ctx.invoke, { mode: b.mode, stopOnFailure: b.stopOnFailure === true }));
+        });
+    },
+});
+//# sourceMappingURL=sessions.js.map

package/dist/features/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/features/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAuB,MAAM,wBAAwB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAsC,MAAM,sBAAsB,CAAC;AAEpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAwChJ,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAqB,EAAE,GAA0F;IAC1I,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3D,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;SAC5E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;SAChI,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;SACtF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAU,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxL,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC7H,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,OAAO,CAAC,CAAU;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChL,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,KAAK,CAAC,IAAkB,EAAE,GAAwE,EAAE,IAAc;IAChI,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,OAAO,EAAE,EAAE,CAAC;IAC/G,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtI,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAChI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxI,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,MAAgC,EAAE,OAAqD,EAAE;IAC7I,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,IAAI,IAAI;YAAE,MAAM;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,GAAwE,CAAC;QAC7E,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtL,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa;YAAE,IAAI,GAAG,IAAI,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,GAAG,GAAG,CAAC,EAAY,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,IAAI;QACnB,IAAI;QACJ,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;QACvB,MAAM;QACN,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,MAAM;QAChC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC3C,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE;QACvH,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC3D,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAA0B,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,uCAAuC,CAAC;QACjI,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC,+BAA+B,CAAC;QAC3K,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAG,CAAC,CAAC,SAAqC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,cAAc;IAII;IAAgD;IAH5D,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,MAAM,CAAU;IAExB,YAA6B,GAA6B,EAAmB,GAAiB;QAAjE,QAAG,GAAH,GAAG,CAA0B;QAAmB,QAAG,GAAH,GAAG,CAAc;IAAG,CAAC;IAE1F,KAAK,CAAC,IAAI;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;gBACtE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,CAAY;QACpB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,eAAe,CAAC;IACd,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,sDAAsD;IAC/D,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,cAAc,CAC9B,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAC1G,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,aAAa,CAC1B,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3K,MAAM,IAAI,GAAG,KAAK,EAAE,GAA+B,EAAE,CAAY,EAAE,EAAE;YACnE,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7J,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YAC1H,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;gBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC,CAAC;YACvL,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9T,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACpI,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YACnF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/J,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/F,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;YAC1E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;YAC9J,GAAG,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAA4B,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QACpI,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}