@winstonsayno/mcp-gateway 7.6.0 → 7.7.0

package/dist/features/approval-flows.js

@@ -0,0 +1,334 @@
+/**
+ * Approvals 2.0 (7.7): multi-step, conditional approval flows with named approvers and escalation.
+ *
+ * The 1.x approvals hold a call until *an operator* approves it. An **approval flow** holds matching calls until each
+ * of its **steps** is approved by the required number of **approvers** (client-id globs — any authenticated client,
+ * not only operators). Flows and steps can be **conditional** on the arguments; a step can **escalate** to more
+ * approvers after a while. A denial at any step, or the flow timeout, refuses the call (JSON-RPC -32004, as 1.x).
+ *
+ * ```yaml
+ * approvalFlows:
+ *   flows:
+ *     - id: payments
+ *       tools: ["payments/transfer"]          # server/tool globs
+ *       when: [{ path: amount, op: gte, value: 1000 }]
+ *       timeoutSeconds: 900
+ *       steps:
+ *         - { name: lead, approvers: ["key:lead-*"] }
+ *         - name: finance
+ *           approvers: ["key:fin-*"]
+ *           required: 2
+ *           when: [{ path: amount, op: gte, value: 10000 }]   # only for large transfers
+ *           escalateAfterSeconds: 300
+ *           escalateTo: ["key:cfo"]
+ * ```
+ *
+ * Conditions: `{ path, op, value }` on the arguments (dot path), `op` ∈ `eq ne gt gte lt lte in matches exists`.
+ * The requester can never approve its own call; one approval per client per step.
+ *
+ * Approvers (any client): `GET /api/v1/features/approval-flows/inbox`, `GET …/mine`,
+ * `POST /api/v1/features/approval-flows/:id/approve|deny` `{ reason? }`.
+ * Operators: `GET /api/v1/admin/approval-flows`, `POST /api/v1/admin/approval-flows/:id/approve|deny` (override),
+ * `POST /api/v1/admin/approval-flows/evaluate` `{ server, tool, client?, arguments? }` (which flow / steps would apply).
+ *
+ * @module features/approval-flows
+ */
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { registerFeature, objectBody, badRequest, clientIdOf } from '../gateway/features.js';
+import { registerCallHook } from '../gateway/hooks.js';
+import { ERR_APPROVAL_REJECTED } from '../gateway/invoker.js';
+import { globToRegExp } from '../utils/tool-filter.js';
+import { redactValue } from '../security/redact.js';
+const Cond = z
+    .object({ path: z.string().min(1), op: z.enum(['eq', 'ne', 'gt', 'gte', 'lt', 'lte', 'in', 'matches', 'exists']), value: z.unknown().optional() })
+    .strict()
+    .superRefine((c, ctx) => {
+    if (c.op === 'matches') {
+        try {
+            new RegExp(String(c.value));
+        }
+        catch {
+            ctx.addIssue({ code: 'custom', message: `invalid regular expression ${JSON.stringify(c.value)}` });
+        }
+    }
+    if (c.op === 'in' && !Array.isArray(c.value))
+        ctx.addIssue({ code: 'custom', message: '`in` needs an array value' });
+});
+const Step = z
+    .object({
+    name: z.string().min(1),
+    approvers: z.array(z.string().min(1)).min(1),
+    required: z.number().int().min(1).default(1),
+    when: z.array(Cond).default([]),
+    escalateAfterSeconds: z.number().int().min(1).optional(),
+    escalateTo: z.array(z.string().min(1)).default([]),
+})
+    .strict();
+const Flow = z
+    .object({
+    id: z.string().min(1).regex(/^[A-Za-z0-9._-]+$/),
+    tools: z.array(z.string().min(1)).min(1),
+    clients: z.array(z.string().min(1)).optional(),
+    when: z.array(Cond).default([]),
+    timeoutSeconds: z.number().int().min(1).max(7 * 86400).default(900),
+    steps: z.array(Step).min(1),
+})
+    .strict();
+export const ApprovalFlowsSchema = z
+    .object({ enabled: z.boolean().default(true), flows: z.array(Flow).default([]), historySize: z.number().int().min(1).max(10_000).default(200) })
+    .strict()
+    .superRefine((c, ctx) => {
+    const ids = new Set();
+    for (const f of c.flows) {
+        if (ids.has(f.id))
+            ctx.addIssue({ code: 'custom', message: `duplicate flow id "${f.id}"` });
+        ids.add(f.id);
+    }
+});
+const get = (obj, path) => path.split('.').reduce((o, k) => (o && typeof o === 'object' ? o[k] : undefined), obj);
+/** Evaluate one condition against the call arguments. */
+export function test(c, args) {
+    const v = get(args, c.path);
+    switch (c.op) {
+        case 'exists':
+            return v !== undefined;
+        case 'eq':
+            return JSON.stringify(v) === JSON.stringify(c.value);
+        case 'ne':
+            return JSON.stringify(v) !== JSON.stringify(c.value);
+        case 'in':
+            return c.value.some((x) => JSON.stringify(x) === JSON.stringify(v));
+        case 'matches':
+            return typeof v === 'string' && new RegExp(String(c.value)).test(v);
+        default: {
+            const a = Number(v);
+            const b = Number(c.value);
+            if (v === undefined || v === null || Number.isNaN(a) || Number.isNaN(b))
+                return false;
+            return c.op === 'gt' ? a > b : c.op === 'gte' ? a >= b : c.op === 'lt' ? a < b : a <= b;
+        }
+    }
+}
+const all = (cs, args) => cs.every((c) => test(c, args));
+const anyGlob = (ps, v) => ps.some((p) => globToRegExp(p).test(v));
+/** First flow matching a call, with the steps that apply to it. */
+export function matchFlow(c, call) {
+    const target = `${call.serverId}/${call.tool}`;
+    for (const f of c.flows) {
+        if (!anyGlob(f.tools, target))
+            continue;
+        if (f.clients && !anyGlob(f.clients, call.clientId ?? 'anonymous'))
+            continue;
+        if (!all(f.when, call.args))
+            continue;
+        return { flow: f, steps: f.steps.filter((s) => all(s.when, call.args)) };
+    }
+    return undefined;
+}
+export class FlowError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+export class FlowQueue {
+    historySize;
+    held = new Map();
+    history = [];
+    constructor(historySize = 200) {
+        this.historySize = historySize;
+    }
+    start(flow, steps, call) {
+        const now = Date.now();
+        const req = {
+            id: randomUUID(),
+            flow: flow.id,
+            status: 'pending',
+            clientId: call.clientId,
+            serverId: call.serverId,
+            tool: call.tool,
+            arguments: redactValue(call.args),
+            steps: steps.map((s, i) => ({ name: s.name, approvers: s.approvers, required: s.required, escalateTo: s.escalateTo, escalated: false, status: i === 0 ? 'pending' : 'waiting', approvals: [] })),
+            current: 0,
+            createdAt: new Date(now).toISOString(),
+            expiresAt: new Date(now + flow.timeoutSeconds * 1000).toISOString(),
+        };
+        return new Promise((resolve) => {
+            const h = { req, resolve, timers: [] };
+            this.held.set(req.id, h);
+            const t = setTimeout(() => this.finish(req.id, 'expired', undefined, 'not approved in time'), flow.timeoutSeconds * 1000);
+            t.unref();
+            h.timers.push(t);
+            this.armEscalation(h, steps);
+        });
+    }
+    armEscalation(h, steps) {
+        const s = steps[h.req.current];
+        if (!s?.escalateAfterSeconds || !s.escalateTo.length)
+            return;
+        const idx = h.req.current;
+        const t = setTimeout(() => {
+            if (h.req.status === 'pending' && h.req.current === idx)
+                h.req.steps[idx].escalated = true;
+        }, s.escalateAfterSeconds * 1000);
+        t.unref();
+        h.timers.push(t);
+        h.steps = steps;
+    }
+    finish(id, status, by, reason) {
+        const h = this.held.get(id);
+        if (!h)
+            return undefined;
+        this.held.delete(id);
+        for (const t of h.timers)
+            clearTimeout(t);
+        h.req.status = status;
+        h.req.decidedAt = new Date().toISOString();
+        if (by)
+            h.req.decidedBy = by;
+        if (reason)
+            h.req.reason = reason;
+        this.history.unshift(h.req);
+        if (this.history.length > this.historySize)
+            this.history.length = this.historySize;
+        h.resolve(h.req);
+        return h.req;
+    }
+    /** May `client` act on the current step of `req`? */
+    canApprove(req, client) {
+        const s = req.steps[req.current];
+        if (!s || req.status !== 'pending' || client === req.clientId)
+            return false;
+        return anyGlob(s.approvers, client) || (s.escalated && anyGlob(s.escalateTo, client));
+    }
+    /** Approve / deny the current step. `override` (operators) skips the approver check and completes the step. */
+    decide(id, approve, by, reason, override = false) {
+        const h = this.held.get(id);
+        if (!h) {
+            if (this.history.some((x) => x.id === id))
+                throw new FlowError('Approval request was already decided', 409);
+            throw new FlowError('Approval request not found', 404);
+        }
+        const req = h.req;
+        if (by === req.clientId && !override)
+            throw new FlowError('A client cannot approve its own tool call', 403);
+        if (!override && !this.canApprove(req, by))
+            throw new FlowError(`Not an approver of step "${req.steps[req.current].name}"`, 403);
+        const step = req.steps[req.current];
+        if (!approve)
+            return this.finish(id, 'denied', by, reason ?? `denied at step "${step.name}"`);
+        if (step.approvals.some((a) => a.by === by))
+            throw new FlowError('Already approved this step', 409);
+        step.approvals.push({ by, at: new Date().toISOString(), ...(reason ? { reason } : {}) });
+        if (override || step.approvals.length >= step.required) {
+            step.status = 'approved';
+            req.current++;
+            if (req.current >= req.steps.length)
+                return this.finish(id, 'approved', by);
+            req.steps[req.current].status = 'pending';
+            const steps = h.steps;
+            if (steps)
+                this.armEscalation(h, steps);
+        }
+        return req;
+    }
+    pending() {
+        return [...this.held.values()].map((h) => h.req);
+    }
+    get(id) {
+        return this.held.get(id)?.req ?? this.history.find((x) => x.id === id);
+    }
+    close() {
+        for (const id of [...this.held.keys()])
+            this.finish(id, 'expired', undefined, 'gateway stopped');
+    }
+}
+export const flowQueue = new FlowQueue();
+const settings = (cfg) => {
+    if (!cfg.approvalFlows)
+        return undefined;
+    const c = ApprovalFlowsSchema.parse(cfg.approvalFlows);
+    return c.enabled ? c : undefined;
+};
+registerCallHook({
+    id: 'approval-flows',
+    before: async (call, cfg) => {
+        const c = settings(cfg);
+        if (!c)
+            return;
+        const m = matchFlow(c, call);
+        if (!m || !m.steps.length)
+            return;
+        const r = await flowQueue.start(m.flow, m.steps, call);
+        if (r.status === 'approved')
+            return;
+        const step = r.steps[Math.min(r.current, r.steps.length - 1)];
+        return {
+            refuse: {
+                code: ERR_APPROVAL_REJECTED,
+                message: r.status === 'expired' ? `Tool call was not approved in time (flow ${r.flow}, step ${step?.name})` : `Tool call was denied (flow ${r.flow}, step ${step?.name})`,
+                data: { flow: r.flow, step: step?.name, approval: r.status, requestId: r.id, ...(r.reason ? { reason: r.reason } : {}) },
+            },
+        };
+    },
+});
+function decideRoute(router, operator) {
+    for (const action of ['approve', 'deny']) {
+        router.post(`/:id/${action}`, (req, res) => {
+            const b = (req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : {});
+            const by = clientIdOf(req) ?? 'anonymous';
+            try {
+                const r = flowQueue.decide(String(req.params.id), action === 'approve', operator ? `operator:${by}` : by, typeof b.reason === 'string' ? b.reason : undefined, operator);
+                res.json(r);
+            }
+            catch (err) {
+                if (err instanceof FlowError)
+                    return void res.status(err.status).json({ error: err.status === 404 ? 'Not Found' : err.status === 409 ? 'Conflict' : 'Forbidden', message: err.message });
+                throw err;
+            }
+        });
+    }
+}
+registerFeature({
+    id: 'approval-flows',
+    since: '7.7.0',
+    summary: 'Approvals 2.0: multi-step, conditional approval flows with named approvers and escalation',
+    mount: (router, ctx) => {
+        ctx.onStop?.(() => flowQueue.close());
+        router.get('/', (_req, res) => {
+            const c = settings(ctx.config());
+            res.json({ enabled: !!c, flows: c?.flows ?? [], pending: flowQueue.pending(), recent: flowQueue.history.slice(0, 50) });
+        });
+        router.post('/evaluate', (req, res) => {
+            const b = objectBody(req, res);
+            if (!b)
+                return;
+            if (typeof b.server !== 'string' || typeof b.tool !== 'string')
+                return badRequest(res, 'Body must be { "server", "tool", "client"?, "arguments"? }');
+            const c = settings(ctx.config());
+            const m = c ? matchFlow(c, { serverId: b.server, tool: b.tool, clientId: typeof b.client === 'string' ? b.client : undefined, args: b.arguments ?? {} }) : undefined;
+            res.json(m ? { flow: m.flow.id, steps: m.steps.map((s) => ({ name: s.name, approvers: s.approvers, required: s.required })), held: m.steps.length > 0 } : { flow: null, steps: [], held: false });
+        });
+        router.get('/:id', (req, res) => {
+            const r = flowQueue.get(req.params.id);
+            if (!r)
+                return void res.status(404).json({ error: 'Not Found', message: 'Approval request not found' });
+            res.json(r);
+        });
+        decideRoute(router, true);
+    },
+    mountClient: (router) => {
+        router.get('/inbox', (req, res) => {
+            const me = clientIdOf(req) ?? 'anonymous';
+            res.json({ client: me, pending: flowQueue.pending().filter((r) => flowQueue.canApprove(r, me)) });
+        });
+        router.get('/mine', (req, res) => {
+            const me = clientIdOf(req) ?? 'anonymous';
+            res.json({ client: me, pending: flowQueue.pending().filter((r) => r.clientId === me), recent: flowQueue.history.filter((r) => r.clientId === me).slice(0, 50) });
+        });
+        decideRoute(router, false);
+    },
+});
+//# sourceMappingURL=approval-flows.js.map

package/dist/features/approval-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-flows.js","sourceRoot":"","sources":["../../src/features/approval-flows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACjJ,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;AACvH,CAAC,CAAC,CAAC;AACL,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;KAC/I,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAML,MAAM,GAAG,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAElL,yDAAyD;AACzD,MAAM,UAAU,IAAI,CAAC,CAAQ,EAAE,IAAa;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,CAAC,KAAK,SAAS,CAAC;QACzB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,IAAI;YACP,OAAQ,CAAC,CAAC,KAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtF,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;AACH,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,EAAW,EAAE,IAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3E,MAAM,OAAO,GAAG,CAAC,EAAqB,EAAE,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,CAAM,EAAE,IAA0E;IAC1G,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;YAAE,SAAS;QAC7E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA4BD,MAAM,OAAO,SAAU,SAAQ,KAAK;IACI;IAAtC,YAAY,OAAe,EAAW,MAAuB;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,WAAM,GAAN,MAAM,CAAiB;IAE7D,CAAC;CACF;AAQD,MAAM,OAAO,SAAS;IAGA;IAFZ,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;IACvC,OAAO,GAAkB,EAAE,CAAC;IAC5B,YAAoB,cAAc,GAAG;QAAjB,gBAAW,GAAX,WAAW,CAAM;IAAG,CAAC;IAEzC,KAAK,CAAC,IAAW,EAAE,KAAqB,EAAE,IAA0E;QAClH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAgB;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAChM,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACpE,CAAC;QACF,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,CAAC,GAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAC1H,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,CAAO,EAAE,KAAqB;QAClD,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG;gBAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,SAAS,GAAG,IAAI,CAAC;QAC9F,CAAC,EAAE,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAuC,CAAC,KAAK,GAAG,KAAK,CAAC;IACzD,CAAC;IAEO,MAAM,CAAC,EAAU,EAAE,MAA6B,EAAE,EAAW,EAAE,MAAe;QACpF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,EAAE;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;QAC7B,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QACnF,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,CAAC,GAAG,CAAC;IACf,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,GAAgB,EAAE,MAAc;QACzC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,EAAU,EAAE,OAAgB,EAAE,EAAU,EAAE,MAAe,EAAE,QAAQ,GAAG,KAAK;QAChF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC5G,MAAM,IAAI,SAAS,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC5G,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,IAAI,mBAAmB,IAAI,CAAC,IAAI,GAAG,CAAE,CAAC;QAC/F,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACpG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;YACzB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,MAAM,GAAG,SAAS,CAAC;YAC3C,MAAM,KAAK,GAAI,CAAuC,CAAC,KAAK,CAAC;YAC7D,IAAI,KAAK;gBAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACnG,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,MAAM,QAAQ,GAAG,CAAC,GAAkB,EAAmB,EAAE;IACvD,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC,CAAC;AAEF,gBAAgB,CAAC;IACf,EAAE,EAAE,gBAAgB;IACpB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO;QAClC,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO;YACL,MAAM,EAAE;gBACN,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,IAAI,UAAU,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,IAAI,UAAU,IAAI,EAAE,IAAI,GAAG;gBACzK,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzH;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAc,EAAE,QAAiB;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,MAAM,CAAU,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,QAAQ,MAAM,EAAE,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;YAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;YAC5H,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACzK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,SAAS;oBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzL,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,eAAe,CAAC;IACd,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,2FAA2F;IACpG,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACrB,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,4DAA4D,CAAC,CAAC;YACrJ,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpM,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/B,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACnK,CAAC,CAAC,CAAC;QACH,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC,CAAC"}

package/dist/features/index.d.ts

@@ -25,5 +25,6 @@ import './sanitize.js';
 import './semantic-cache.js';
 import './rollouts.js';
 import './offline.js';
+import './approval-flows.js';
 export { listFeatures, registerFeature, createFeatureRouter } from '../gateway/features.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/features/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,eAAe,CAAC;AACvB,OAAO,UAAU,CAAC;AAClB,OAAO,eAAe,CAAC;AACvB,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AACxB,OAAO,iBAAiB,CAAC;AACzB,OAAO,eAAe,CAAC;AACvB,OAAO,iBAAiB,CAAC;AACzB,OAAO,cAAc,CAAC;AACtB,OAAO,cAAc,CAAC;AACtB,OAAO,UAAU,CAAC;AAClB,OAAO,gBAAgB,CAAC;AACxB,OAAO,cAAc,CAAC;AACtB,OAAO,eAAe,CAAC;AACvB,OAAO,qBAAqB,CAAC;AAC7B,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AAEtB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,eAAe,CAAC;AACvB,OAAO,UAAU,CAAC;AAClB,OAAO,eAAe,CAAC;AACvB,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AACxB,OAAO,iBAAiB,CAAC;AACzB,OAAO,eAAe,CAAC;AACvB,OAAO,iBAAiB,CAAC;AACzB,OAAO,cAAc,CAAC;AACtB,OAAO,cAAc,CAAC;AACtB,OAAO,UAAU,CAAC;AAClB,OAAO,gBAAgB,CAAC;AACxB,OAAO,cAAc,CAAC;AACtB,OAAO,eAAe,CAAC;AACvB,OAAO,qBAAqB,CAAC;AAC7B,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AACtB,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/features/index.js

@@ -25,5 +25,6 @@ import './sanitize.js';
 import './semantic-cache.js';
 import './rollouts.js';
 import './offline.js';
+import './approval-flows.js';
 export { listFeatures, registerFeature, createFeatureRouter } from '../gateway/features.js';
 //# sourceMappingURL=index.js.map

package/dist/features/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,eAAe,CAAC;AACvB,OAAO,UAAU,CAAC;AAClB,OAAO,eAAe,CAAC;AACvB,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AACxB,OAAO,iBAAiB,CAAC;AACzB,OAAO,eAAe,CAAC;AACvB,OAAO,iBAAiB,CAAC;AACzB,OAAO,cAAc,CAAC;AACtB,OAAO,cAAc,CAAC;AACtB,OAAO,UAAU,CAAC;AAClB,OAAO,gBAAgB,CAAC;AACxB,OAAO,cAAc,CAAC;AACtB,OAAO,eAAe,CAAC;AACvB,OAAO,qBAAqB,CAAC;AAC7B,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AAEtB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/features/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,cAAc,CAAC;AACtB,OAAO,iBAAiB,CAAC;AACzB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,eAAe,CAAC;AACvB,OAAO,UAAU,CAAC;AAClB,OAAO,eAAe,CAAC;AACvB,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AACxB,OAAO,iBAAiB,CAAC;AACzB,OAAO,eAAe,CAAC;AACvB,OAAO,iBAAiB,CAAC;AACzB,OAAO,cAAc,CAAC;AACtB,OAAO,cAAc,CAAC;AACtB,OAAO,UAAU,CAAC;AAClB,OAAO,gBAAgB,CAAC;AACxB,OAAO,cAAc,CAAC;AACtB,OAAO,eAAe,CAAC;AACvB,OAAO,qBAAqB,CAAC;AAC7B,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AACtB,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/features/k8s.d.ts

@@ -49,11 +49,11 @@ export declare const McpGatewaySpecSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     config: Record<string, unknown>;
     port: number;
-    replicas: number;
     resources: {
         requests?: Record<string, string> | undefined;
         limits?: Record<string, string> | undefined;
     };
+    replicas: number;
     serviceMonitor: boolean;
     image?: string | undefined;
     envFromSecret?: string | undefined;
@@ -66,11 +66,11 @@ export declare const McpGatewaySpecSchema: z.ZodObject<{
 }, {
     config?: Record<string, unknown> | undefined;
     port?: number | undefined;
-    replicas?: number | undefined;
     resources?: {
         requests?: Record<string, string> | undefined;
         limits?: Record<string, string> | undefined;
     } | undefined;
+    replicas?: number | undefined;
     image?: string | undefined;
     envFromSecret?: string | undefined;
     autoscaling?: {

package/dist/features/policy-sim.d.ts

@@ -43,9 +43,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
             notUnder: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strict", z.ZodTypeAny, {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -55,9 +55,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
             notUnder?: string[] | undefined;
         }, {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -76,9 +76,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -96,9 +96,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -120,9 +120,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -143,9 +143,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -166,9 +166,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -189,9 +189,9 @@ export declare const CandidatePolicySchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -224,9 +224,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
             notUnder: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strict", z.ZodTypeAny, {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -236,9 +236,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
             notUnder?: string[] | undefined;
         }, {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -257,9 +257,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -277,9 +277,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -302,9 +302,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -326,9 +326,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -350,9 +350,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;
@@ -374,9 +374,9 @@ export declare const PolicyShadowSchema: z.ZodEffects<z.ZodObject<{
         clients?: string[] | undefined;
         args?: {
             path: string;
+            in?: (string | number | boolean)[] | undefined;
             exists?: boolean | undefined;
             equals?: string | number | boolean | undefined;
-            in?: (string | number | boolean)[] | undefined;
             glob?: string[] | undefined;
             notGlob?: string[] | undefined;
             regex?: string | undefined;