approval-md 0.0.1 → 0.2.0

package/dist/src/mcp/server.js

@@ -0,0 +1,602 @@
+/**
+ * The MCP wrapper of SPEC.md §10.5 — the same verbs as tools, over the CLI's
+ * own code paths (APRV-87).
+ *
+ * §10.5 asks for "a thin MCP server exposing the same verbs as tools … for
+ * clients where MCP is more ergonomic than shelling out", and says plainly that
+ * "it shares the CLI's code paths". Both halves of that sentence are load-
+ * bearing here, and the second one is the whole design: **there is no second
+ * implementation of any verb in this file.** A tool call builds an argv, hands
+ * it to the function `src/cli/main.ts` dispatches to, captures the `--json`
+ * object the CLI would have printed, and returns it. A refusal is the refusal
+ * the CLI prints, with the same machine-readable `error.code`.
+ *
+ * ## The scoping decision: agent-facing only
+ *
+ * SPEC.md §11 names the agent the **untrusted policy** and the human the
+ * **trusted, expensive overseer**. An MCP client is an agent's harness. Offering
+ * `grant` to it hands the untrusted policy the overseer's pen, and no amount of
+ * care inside the tool implementation would undo that. So the tool list is
+ * exactly {@link VERB_REGISTRY} filtered by `human_only === false`, minus the
+ * transport exclusions in {@link EXCLUDED_VERBS}, and the registry's `human_only`
+ * marker — not a list kept here — is what decides. `verb-registry.ts` says it in
+ * its own header: the marker "exists so a wrapper does not offer an agent a door
+ * the runtime will only slam".
+ *
+ * The runtime would slam it anyway (the CLI layer refuses, core refuses again,
+ * and the event schema refuses a third time). Publishing the door would still be
+ * wrong: a tool list is a statement about what this surface is for.
+ *
+ * ## Identity is the server's, and a tool call cannot change it
+ *
+ * The server runs AS one agent identity, fixed when the operator starts it
+ * (`--as agent:<id>`, or `APPROVAL_AGENT`). `human:` and `system:` are refused at
+ * startup. Every tool whose verb accepts `--as` gets the server's identity
+ * appended LAST, after anything the caller supplied, and `--as` is removed from
+ * every published input schema so that a client sending it is refused by the
+ * schema rather than quietly ignored. Two mechanisms for one rule, because the
+ * rule is the reason this server is safe to run at all.
+ *
+ * ## Guest mode narrows, and never widens (APRV-175)
+ *
+ * A server built with `guest: true` publishes {@link GUEST_VERBS} INTERSECTED
+ * with the list above, refuses anything else at call time with
+ * `mcp-guest-restricted` even when a client crafted the name itself, clamps
+ * `wait` to {@link GUEST_WAIT_TIMEOUT_MS}, and says all of that in
+ * {@link GUEST_INSTRUCTIONS}. Two properties are worth stating plainly: the
+ * intersection means guest mode can only ever take tools away, so no name the
+ * full server withholds becomes reachable by turning it on; and the refusal
+ * lives at CALL time, so `tools/list` describes the boundary rather than being
+ * it. The human-only arm is unchanged and is checked first, because "no session
+ * on any transport may do this" outranks "this session may not".
+ *
+ * ## What this server does NOT do
+ *
+ * - It reads no `.approval/env` (SPEC.md §11.1 invariant 7). The environment a
+ *   gate operation runs under is the one the operator launched this process
+ *   with, exactly as for any other `approval` invocation.
+ * - It maps nothing onto the MCP tasks/elicitation extension. §10.5 says the
+ *   tasks extension MAY be mapped onto `awaiting` "when client support
+ *   stabilizes"; that is post-v1, and until then `wait` blocks and answers.
+ * - It appends nothing of its own. `tools/list` touches no file.
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
+import { commandAdapter } from "../cli/adapter.js";
+import { commandChannel } from "../cli/channel.js";
+import { commandPayload } from "../cli/payload.js";
+import { commandDoctor } from "../cli/doctor.js";
+import { commandRun } from "../cli/execute.js";
+import { main } from "../cli/main.js";
+import { VERB_REGISTRY, verbLabel, } from "../cli/verb-registry.js";
+import { parseDuration } from "../core/policy-load.js";
+import { SPEC_VERSION } from "../core/version.js";
+// ---------------------------------------------------------------------------
+// The tool list
+// ---------------------------------------------------------------------------
+/**
+ * Agent-facing verbs that are still not tools, each for a reason that is about
+ * the TRANSPORT or the verb's role rather than about authority. Anything
+ * excluded for authority reasons is `human_only` in the registry instead, which
+ * is where that judgment belongs.
+ */
+export const EXCLUDED_VERBS = new Map([
+    [
+        "consume",
+        "internal plumbing: its own purpose says so. `run` wraps it and is published instead, so a client that reached for `consume` would be spending a token outside the verb that records the outcome.",
+    ],
+    [
+        "log follow",
+        "it is an unbounded foreground stream. MCP tool calls share a finite request queue and return one finite result, so publishing this verb would occupy that queue indefinitely; MCP clients can poll log verify or use the CLI stream as a separate process.",
+    ],
+    [
+        "hook claude-code",
+        "it reads one PreToolUse event from STDIN and its registry input schema has nowhere to put that event. On a stdio server, stdin is the JSON-RPC stream: a tool that read it would eat the protocol. It is also the wrong shape for MCP — a harness that can call tools calls `request` and `wait` directly.",
+    ],
+    [
+        "hook cursor",
+        "it reads one Cursor preToolUse event from STDIN and its registry input schema has nowhere to put that event. On a stdio server, stdin is the JSON-RPC stream: a tool that read it would eat the protocol. It is also the wrong shape for MCP — a harness that can call tools calls `request` and `wait` directly.",
+    ],
+    [
+        "hook codex",
+        "it reads one Codex PreToolUse or PostToolUse event from STDIN and its registry input schema has nowhere to put that event. On a stdio server, stdin is the JSON-RPC stream: a tool that read it would eat the protocol. It is also the wrong shape for MCP — a harness that can call tools calls `request` and `wait` directly.",
+    ],
+]);
+/**
+ * The verbs a GUEST session may call (APRV-175), as registry labels.
+ *
+ * A POSITIVE allowlist, and the direction is the whole point. Guest mode exists
+ * so strangers can drive a gate over the network without executing anything on
+ * the host, and the two verbs that make that dangerous are not the only ones:
+ * `run` spawns argv on the server machine, an `adapter <name>` spends vault
+ * credentials, `token` hands out spend material, `journal write` writes a local
+ * file the operator reads. A deny list would have to name each of those and
+ * every one that lands next; this list names what a guest MAY do, so a verb
+ * added tomorrow is absent until someone decides otherwise. Fail closed, per
+ * SPEC.md §11.
+ *
+ * The list is the demo's shape: read the guide (`instructions`), declare and
+ * ask (`register`, `request`), watch (`wait`, `status`, `queue`), and inspect
+ * (`log verify`, `policy check`, `policy test`). Nothing here executes a side
+ * effect, and nothing here is a human's authority — those are `human_only` in
+ * the registry and were never published on any transport.
+ *
+ * This narrows and never widens: {@link publishedVerbs} intersects it with the
+ * ordinary filter, so a name the full server does not publish cannot become a
+ * tool by turning guest mode on.
+ */
+export const GUEST_VERBS = new Set([
+    "instructions",
+    "register",
+    "request",
+    "wait",
+    "status",
+    "queue",
+    "log verify",
+    "policy check",
+    "policy test",
+]);
+/** Guest `wait` never blocks the shared queue for longer than this. */
+export const GUEST_WAIT_TIMEOUT_MS = 5_000;
+/** `<name>_<subcommand words>` — `log_verify`, `channel_telegram_health`. */
+export function toolName(spec) {
+    const words = spec.subcommand === undefined ? [] : spec.subcommand.split(" ");
+    return [spec.name, ...words].join("_");
+}
+/**
+ * The verbs this server publishes, in registry order.
+ *
+ * Under `guest`, the ordinary filter is INTERSECTED with {@link GUEST_VERBS}:
+ * guest mode subtracts and can never add.
+ */
+export function publishedVerbs(guest = false) {
+    return VERB_REGISTRY.filter((spec) => !spec.human_only &&
+        !EXCLUDED_VERBS.has(verbLabel(spec)) &&
+        (!guest || GUEST_VERBS.has(verbLabel(spec))));
+}
+/**
+ * The input schema for one tool: the registry's input schema, with the single
+ * documented deletion of `--as`.
+ *
+ * Nothing else is translated, reshaped or regenerated. The registry's schemas
+ * are already `{type:"object", properties:{positionals, flags, trailing?}}` with
+ * `additionalProperties:false` throughout, which is exactly what MCP wants a
+ * tool `inputSchema` to be, so the SDK's low-level {@link Server} is used rather
+ * than `McpServer`: `McpServer.registerTool` takes Zod, and translating JSON
+ * Schema into Zod so the SDK can translate it back would put a lossy round trip
+ * between the one source and the published contract.
+ *
+ * `additionalProperties:false` is also what refuses `{"as":"human:carter"}`:
+ * there is no such property, at any level, on any published tool.
+ */
+export function toolInputSchema(spec) {
+    const schema = structuredClone(spec.input);
+    const flagProperties = schema.properties?.flags?.properties;
+    if (flagProperties !== undefined)
+        delete flagProperties["--as"];
+    return schema;
+}
+/** The `tools/list` answer, derived entirely from the registry. */
+export function toolDefinitions(guest = false) {
+    return publishedVerbs(guest).map((spec) => ({
+        name: toolName(spec),
+        title: `approval ${verbLabel(spec)}`,
+        description: spec.purpose,
+        inputSchema: toolInputSchema(spec),
+    }));
+}
+// ---------------------------------------------------------------------------
+// Identity
+// ---------------------------------------------------------------------------
+/** The environment variable an operator may use instead of `--as`. */
+export const AGENT_ACTOR_ENV = "APPROVAL_AGENT";
+/** `agent:<id>` and nothing else. */
+const AGENT_ACTOR = /^agent:.+/u;
+/**
+ * Resolve and validate the identity this server acts as.
+ *
+ * A `human:` value is refused rather than accepted-and-downgraded: an operator
+ * who typed one meant something, and the something they meant is not available
+ * here. `system:` is refused for the same reason `expire` takes no identity —
+ * the runtime's own actor is not a thing a caller supplies.
+ */
+export function resolveAgentActor(flag, env = process.env) {
+    const raw = flag ?? env[AGENT_ACTOR_ENV] ?? null;
+    if (raw === null || raw.trim().length === 0) {
+        return {
+            ok: false,
+            message: `no agent identity: pass --as agent:<id> or set ${AGENT_ACTOR_ENV}=agent:<id>. The MCP server runs as ONE agent and every tool call is recorded under that identity`,
+        };
+    }
+    if (!AGENT_ACTOR.test(raw)) {
+        return {
+            ok: false,
+            // APRV-102: no SPEC citation on an error line. The reason this server is
+            // agent-facing by construction is in `MCP_HELP` and in this file's header,
+            // which are the two places APRV-91 put rationale.
+            message: `--as expects agent:<id>, got ${JSON.stringify(raw)}. This server is agent-facing by construction, so it refuses to act as a human or as the system`,
+        };
+    }
+    return { ok: true, actor: raw };
+}
+/** The flag names one verb accepts, from its registry input schema. */
+function flagNamesOf(spec) {
+    const input = spec.input;
+    return new Set(Object.keys(input.properties?.flags?.properties ?? {}));
+}
+function acceptsTrailing(spec) {
+    const input = spec.input;
+    return (input.properties ?? {})["trailing"] !== undefined;
+}
+/**
+ * The `--timeout` a guest's `wait` actually runs with (APRV-175).
+ *
+ * A clamp rather than an override: a caller asking for less than the ceiling
+ * gets what they asked for, and anything larger, unparseable or absent becomes
+ * {@link GUEST_WAIT_TIMEOUT_MS}. It is appended LAST, the same mechanism that
+ * pins `--as`, so the caller's own value loses without being rejected.
+ *
+ * The ceiling is not politeness. `wait` blocks the event loop (`Atomics.wait`)
+ * and every HTTP session shares one invoke queue, so an unbounded `wait` is one
+ * stranger stalling every other session and the listener with them.
+ */
+export function guestWaitTimeout(rawFlags) {
+    const flags = (rawFlags ?? {});
+    const asked = typeof flags["--timeout"] === "string" ? parseDuration(flags["--timeout"]) : null;
+    const ms = asked === null ? GUEST_WAIT_TIMEOUT_MS : Math.min(asked, GUEST_WAIT_TIMEOUT_MS);
+    return `${ms}ms`;
+}
+function refuse(code, message) {
+    return { ok: false, code, message };
+}
+/**
+ * Map one tool call's arguments onto the argv the CLI would have been given.
+ *
+ * Validation here is deliberate rather than delegated: the low-level MCP
+ * {@link Server} does not validate `arguments` against a tool's `inputSchema`,
+ * and "the schema said additionalProperties:false" has to be enforced by
+ * something. So an unknown top-level key, an unknown flag, or a non-string
+ * argument is refused, which is what makes `{"as":"human:carter"}` a refusal
+ * instead of a silently dropped field.
+ */
+export function buildArgv(spec, rawArgs, options) {
+    const args = (rawArgs ?? {});
+    if (typeof args !== "object" || Array.isArray(args)) {
+        return refuse("mcp-invalid-arguments", "arguments must be a JSON object");
+    }
+    const allowedKeys = new Set(["positionals", "flags"]);
+    if (acceptsTrailing(spec))
+        allowedKeys.add("trailing");
+    for (const key of Object.keys(args)) {
+        if (allowedKeys.has(key))
+            continue;
+        return refuse("mcp-unknown-property", `unknown property ${JSON.stringify(key)}; \`${verbLabel(spec)}\` accepts ${[...allowedKeys]
+            .map((name) => JSON.stringify(name))
+            .join(", ")} and nothing else. Identity in particular is NOT an argument: this server acts as ${options.actor}, fixed when it was started, and no tool call can change it`);
+    }
+    const positionals = [];
+    const rawPositionals = args["positionals"];
+    if (rawPositionals !== undefined) {
+        if (!Array.isArray(rawPositionals)) {
+            return refuse("mcp-invalid-arguments", "positionals must be an array of strings");
+        }
+        for (const value of rawPositionals) {
+            if (typeof value !== "string") {
+                return refuse("mcp-invalid-arguments", "every positional must be a string");
+            }
+            positionals.push(value);
+        }
+    }
+    const flagArgv = [];
+    const accepted = flagNamesOf(spec);
+    const rawFlags = args["flags"];
+    if (rawFlags !== undefined) {
+        if (typeof rawFlags !== "object" || rawFlags === null || Array.isArray(rawFlags)) {
+            return refuse("mcp-invalid-arguments", "flags must be an object");
+        }
+        for (const [flag, value] of Object.entries(rawFlags)) {
+            if (flag === "--as") {
+                return refuse("mcp-identity-fixed", `--as is not accepted from a tool call. This server acts as ${options.actor}, chosen by the operator who started it; an identity a caller could name would be an identity the caller could escalate (SPEC.md §11)`);
+            }
+            if (!accepted.has(flag)) {
+                return refuse("mcp-unknown-flag", `unknown flag ${JSON.stringify(flag)} for \`${verbLabel(spec)}\``);
+            }
+            if (typeof value === "boolean") {
+                if (value)
+                    flagArgv.push(flag);
+                continue;
+            }
+            if (typeof value !== "string") {
+                return refuse("mcp-invalid-arguments", `flag ${JSON.stringify(flag)} expects a string or a boolean`);
+            }
+            flagArgv.push(flag, value);
+        }
+    }
+    const trailing = [];
+    const rawTrailing = args["trailing"];
+    if (rawTrailing !== undefined) {
+        if (!acceptsTrailing(spec)) {
+            return refuse("mcp-unknown-property", `\`${verbLabel(spec)}\` takes no trailing argv`);
+        }
+        if (!Array.isArray(rawTrailing) || rawTrailing.length === 0) {
+            return refuse("mcp-invalid-arguments", "trailing must be a non-empty array of strings");
+        }
+        for (const value of rawTrailing) {
+            if (typeof value !== "string") {
+                return refuse("mcp-invalid-arguments", "every trailing argument must be a string");
+            }
+            trailing.push(value);
+        }
+    }
+    // `-` means "read it from stdin" everywhere in this CLI, and on a stdio
+    // server stdin is the JSON-RPC stream. Reading it would deadlock the
+    // connection and steal the client's next request, so it is refused with a
+    // code that says what to do instead.
+    for (const value of [...positionals, ...flagArgv]) {
+        if (value !== "-")
+            continue;
+        return refuse("mcp-stdin-unavailable", "`-` (read from stdin) is not available over MCP: stdin is the JSON-RPC transport. Write the bytes to a file and pass its path");
+    }
+    // Injected LAST so the operator's pins and the server's identity win over
+    // anything the caller supplied: `parseFlags` keeps the last occurrence.
+    const injected = [];
+    if (options.guest === true && verbLabel(spec) === "wait") {
+        injected.push("--timeout", guestWaitTimeout(rawFlags));
+    }
+    if (options.log !== undefined && accepted.has("--log"))
+        injected.push("--log", options.log);
+    if (options.policy !== undefined && accepted.has("--policy")) {
+        injected.push("--policy", options.policy);
+    }
+    if (accepted.has("--as"))
+        injected.push("--as", options.actor);
+    if (accepted.has("--json"))
+        injected.push("--json");
+    return {
+        ok: true,
+        argv: [
+            ...positionals,
+            ...flagArgv,
+            ...injected,
+            ...(trailing.length === 0 ? [] : ["--", ...trailing]),
+        ],
+    };
+}
+function collector() {
+    const out = [];
+    const err = [];
+    return {
+        streams: { out: (text) => out.push(text), err: (text) => err.push(text) },
+        out,
+        err,
+    };
+}
+/**
+ * Run one verb.
+ *
+ * The default arm is `main()` itself — the CLI's real dispatch, so a verb whose
+ * argv handling changes changes here too, with nothing to keep in step. The
+ * three exceptions each have a reason that is about this transport:
+ *
+ * - `run` spawns a child, and `stdio: "inherit"` would hand that child the
+ *   JSON-RPC pipe. It is called through the `childIo` seam `execute.ts` exposes
+ *   for exactly this, which pipes the child's output back as tool content.
+ * - `doctor` and every `adapter <name>` are asynchronous, and `main()` drops their
+ *   promise into `process.exitCode` rather than returning it. Awaiting the
+ *   command function is the only way to get the code.
+ *
+ * `channel telegram health` goes through `commandChannel` for the same reason:
+ * its dispatch arm in `main()` is the promise-unwrapping one.
+ */
+async function invoke(spec, argv, options) {
+    const sink = collector();
+    const { streams } = sink;
+    const cwd = options.cwd;
+    const label = verbLabel(spec);
+    let code;
+    let child;
+    if (label === "run") {
+        let captured;
+        code = commandRun(argv, streams, cwd, {
+            stdio: ["ignore", "pipe", "pipe"],
+            onOutput: (output) => {
+                captured = output;
+            },
+        });
+        child = captured;
+    }
+    else if (label === "doctor") {
+        code = await commandDoctor(argv, streams, cwd);
+    }
+    else if (spec.name === "adapter") {
+        // Every `adapter <name>`, not the one that shipped first (APRV-221): the
+        // reason this arm exists is the promise `main()` drops, and that is true of
+        // the verb rather than of any adapter behind it.
+        const words = spec.subcommand === undefined ? [] : spec.subcommand.split(" ");
+        code = await commandAdapter([...words, ...argv], streams, cwd);
+    }
+    else if (spec.name === "channel") {
+        const words = spec.subcommand === undefined ? [] : spec.subcommand.split(" ");
+        code = await commandChannel([...words, ...argv], streams, cwd);
+    }
+    else if (spec.name === "payload") {
+        // `payload agentmail-draft` reads a draft over HTTPS (APRV-223), so this
+        // verb family joined the promise-unwrapping arm of `main()`. `payload hash`
+        // still answers synchronously, and `await` on a number is a number.
+        const words = spec.subcommand === undefined ? [] : spec.subcommand.split(" ");
+        code = await commandPayload([...words, ...argv], streams, cwd);
+    }
+    else {
+        const words = spec.subcommand === undefined ? [] : spec.subcommand.split(" ");
+        // `main()` is asynchronous since APRV-209 (every verb is loaded on demand),
+        // so the default arm awaits it. `main()` now awaits the asynchronous verbs
+        // too, so the arms above no longer HAVE to exist for the promise's sake;
+        // they are kept because calling the command function is the more direct
+        // route and `run`'s `childIo` seam needs it regardless.
+        code = await main([spec.name, ...words, ...argv], { streams, cwd });
+    }
+    return {
+        code,
+        stdout: sink.out.join(""),
+        stderr: sink.err.join(""),
+        ...(child === undefined ? {} : { child }),
+    };
+}
+// ---------------------------------------------------------------------------
+// Invocation -> CallToolResult
+// ---------------------------------------------------------------------------
+/** The last line of `text` that parses as a JSON object, or null. */
+function lastJsonObject(text) {
+    const lines = text.split("\n");
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+        const line = (lines[index] ?? "").trim();
+        if (line.length === 0 || !line.startsWith("{"))
+            continue;
+        try {
+            const value = JSON.parse(line);
+            if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+                return value;
+            }
+        }
+        catch {
+            // Not JSON; keep walking backwards.
+        }
+    }
+    return null;
+}
+/** The `_meta` key prefix this server stamps its out-of-band facts under. */
+export const META_PREFIX = "approval.md/";
+/**
+ * Shape one invocation into a tool result.
+ *
+ * A gate refusal is a RESULT, never a thrown JSON-RPC error: the command was
+ * well-formed and the runtime's answer was no, which is a fact the caller must
+ * be able to read as data. It comes back as `isError: true` carrying the same
+ * `{"error":{"code","message"}}` object the CLI prints, so a client branches on
+ * `error.code` exactly as it would on the CLI's stderr.
+ *
+ * A non-zero exit that carries a SUCCESS-shaped object is not an error: `wait`
+ * exits 1 on a rejection and 6 on a timeout, `status` exits 1 when something
+ * needs attention, `log verify` exits 3 on a torn tail. Those are answers. The
+ * exit code always travels in `_meta` so nothing is lost either way.
+ */
+export function toolResult(result) {
+    // stdout first, then stderr: `run` prints its summary on stderr because
+    // stdout belongs to the child, and every refusal goes to stderr too.
+    const payload = lastJsonObject(result.stdout) ?? lastJsonObject(result.stderr);
+    const isError = payload === null ? result.code !== 0 : payload["error"] !== undefined;
+    const content = [
+        {
+            type: "text",
+            text: payload === null
+                ? `${result.stdout}${result.stderr}`.trim() ||
+                    `the command produced no output and exited ${result.code}`
+                : JSON.stringify(payload),
+        },
+    ];
+    if (result.child !== undefined) {
+        if (result.child.stdout.length > 0) {
+            content.push({ type: "text", text: `child stdout:\n${result.child.stdout}` });
+        }
+        if (result.child.stderr.length > 0) {
+            content.push({ type: "text", text: `child stderr:\n${result.child.stderr}` });
+        }
+    }
+    return {
+        content,
+        ...(payload === null ? {} : { structuredContent: payload }),
+        ...(isError ? { isError: true } : {}),
+        _meta: {
+            [`${META_PREFIX}exit_code`]: result.code,
+            ...(result.child === undefined ? {} : { [`${META_PREFIX}child`]: result.child }),
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// The server
+// ---------------------------------------------------------------------------
+/**
+ * Serialize everything.
+ *
+ * Two reasons, and only the first is about this process. In-process, several
+ * verbs are synchronous and blocking (`wait` sleeps with `Atomics.wait`, `run`
+ * uses `spawnSync`), so overlapping them buys nothing and interleaves their
+ * captured output. Across processes, an append still goes through
+ * `core/log.ts`'s lockfile and compare-and-append, so a CLI running beside this
+ * server is safe whatever this queue does — the queue is politeness, the
+ * lockfile is the guarantee.
+ *
+ * APRV-174: over HTTP one process serves many sessions, and the first reason
+ * above is about the process. `ServerOptions.serialize` therefore lets the HTTP
+ * listener hand every session the SAME queue; stdio passes nothing and gets a
+ * fresh one, exactly as before.
+ */
+export function serializer() {
+    let tail = Promise.resolve();
+    return (work) => {
+        const next = tail.then(work, work);
+        tail = next.then(() => undefined, () => undefined);
+        return next;
+    };
+}
+/**
+ * What a GUEST session is told at connect time (APRV-175).
+ *
+ * Distinct from the full text because the situation is distinct, and the two
+ * facts a guest most needs are the two a full client never needs: `wait` comes
+ * back fast, and a granted request executes NOWHERE. Saying the second one
+ * plainly matters more than it looks. A stranger who saw their action granted
+ * and assumed an email went out has learned the wrong thing about this system;
+ * what they are driving is the approval flow itself.
+ */
+export const GUEST_INSTRUCTIONS = "approval.md gates agent actions that touch the world, and you are connected to it as a GUEST. The tools here are a narrow slice of the agent surface: read the guide (`instructions`), declare an action in a task envelope and register it (`register`), ask for it (`request`), then watch (`wait`, `status`, `queue`) and inspect (`log_verify`, `policy_check`, `policy_test`). Calling anything else is refused `mcp-guest-restricted` whether or not it is listed, because everything else executes on, or spends the credentials of, the machine hosting this gate. Two things to expect. `wait` returns FAST: a guest's timeout is clamped to five seconds server-side, so treat it as a poll and call `status` again rather than asking for a longer one. And NOTHING YOU ARE GRANTED EXECUTES ANYWHERE: there is no `run` here, no adapter, and no side effect at the end of the flow. What you are driving is the approval flow itself — a real request, a real human decision, a real hash-chained record of both. Your identity is this session's alone (`agent:guest-<id>`, chosen by the server), and everything you do is recorded under it.";
+/** Build the MCP server. Nothing is connected until {@link Server.connect}. */
+export function createApprovalMcpServer(options) {
+    const server = new Server({ name: "approval-md", version: SPEC_VERSION }, {
+        capabilities: { tools: {} },
+        instructions: options.guest === true
+            ? GUEST_INSTRUCTIONS
+            : "approval.md gates agent actions that touch the world. The tools here are the AGENT surface only: declare an action in a task envelope, register it, request it, wait for a decision, then run it. There is deliberately no grant, reject, revoke, attest or vault tool — those record a human's authority and are not available to a client of this server (SPEC.md §11). One tool is not gated at all: `journal_write` appends free text to a local file, is never classified or routed through policy, can be neither approved nor denied, and writes no event — it is there so you can say what an exit code cannot (that you are complying and think this is wrong, that something reads as odd, that you are stuck). The operator reads it; nothing written there changes any verdict. One tool runs the other way: `values` prints the operator's stated preferences from APPROVAL.md, which is guidance rather than policy — it grants nothing and changes no verdict — and reading it before you start is how you know what they value. `feedback` is that channel in the other direction: what the operator said about work that already happened, human-authored GUIDANCE that is not policy: it grants nothing, forbids nothing, and changes no verdict, sampling probability or budget. Call `instructions` first; it prints the full guide.",
+    });
+    const guest = options.guest === true;
+    const byName = new Map(publishedVerbs(guest).map((spec) => [toolName(spec), spec]));
+    const serialize = options.serialize ?? serializer();
+    server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: toolDefinitions(guest) }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const name = request.params.name;
+        const spec = byName.get(name);
+        if (spec === undefined) {
+            const human = VERB_REGISTRY.find((candidate) => toolName(candidate) === name && candidate.human_only);
+            if (human !== undefined) {
+                // Checked FIRST, and the same answer for a guest as for anyone else:
+                // this verb records a human's authority, which is true of no session on
+                // any transport. Invariant 9 is not a guest-mode feature.
+                throw new McpError(ErrorCode.InvalidParams, `unknown tool ${JSON.stringify(name)}: \`approval ${verbLabel(human)}\` records or establishes a human's authority and this server publishes no tool for it. An MCP client is an agent's harness, and SPEC.md §11 makes the agent the untrusted policy; the human decides at their own surface (\`approval channel cli\`, the web page, or Telegram)`);
+            }
+            // The advertised list is NEVER the enforcement (APRV-175). A guest who
+            // crafted the request name reaches this arm, which is the same defence in
+            // depth `mcp-identity-fixed` is: the refusal is here, at call time, and
+            // `tools/list` merely describes it.
+            const withheld = guest
+                ? publishedVerbs().find((candidate) => toolName(candidate) === name)
+                : undefined;
+            if (withheld !== undefined) {
+                throw new McpError(ErrorCode.InvalidParams, `mcp-guest-restricted: \`approval ${verbLabel(withheld)}\` is not available to a guest session. This server runs in GUEST mode, where a session may call only ${[...byName.keys()].join(", ")} — the verbs that declare, ask and observe. Everything else executes on, or spends the credentials of, the machine hosting this gate, which is not what a guest connected to`);
+            }
+            throw new McpError(ErrorCode.InvalidParams, `unknown tool ${JSON.stringify(name)}`);
+        }
+        const built = buildArgv(spec, request.params.arguments, options);
+        if (!built.ok) {
+            throw new McpError(ErrorCode.InvalidParams, `${built.code}: ${built.message}`);
+        }
+        return toolResult(await serialize(() => invoke(spec, built.argv, options)));
+    });
+    return server;
+}
+/** Build the server and connect it to `transport`. Resolves once connected. */
+export async function serveApprovalMcp(options, transport) {
+    const server = createApprovalMcpServer(options);
+    await server.connect(transport);
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/src/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,sBAAsB,EACtB,QAAQ,GAGT,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAgB,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,SAAS,GAGV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgC,IAAI,GAAG,CAAC;IACjE;QACE,SAAS;QACT,kMAAkM;KACnM;IACD;QACE,YAAY;QACZ,4PAA4P;KAC7P;IACD;QACE,kBAAkB;QAClB,4SAA4S;KAC7S;IACD;QACE,aAAa;QACb,mTAAmT;KACpT;IACD;QACE,YAAY;QACZ,iUAAiU;KAClU;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,cAAc;IACd,UAAU;IACV,SAAS;IACT,MAAM;IACN,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,IAAc;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAK,GAAG,KAAK;IAC1C,OAAO,aAAa,CAAC,MAAM,CACzB,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU;QAChB,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAExC,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;IAC5D,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,KAAK,GAAG,KAAK;IAC3C,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,YAAY,SAAS,CAAC,IAAI,CAAC,EAAE;QACpC,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,WAAW,EAAE,eAAe,CAAC,IAAI,CAAwB;KAC1D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,qCAAqC;AACrC,MAAM,WAAW,GAAG,YAAY,CAAC;AAMjC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAmB,EACnB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,kDAAkD,eAAe,mGAAmG;SAC9K,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,yEAAyE;YACzE,2EAA2E;YAC3E,kDAAkD;YAClD,OAAO,EAAE,gCAAgC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,iGAAiG;SAC9J,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAClC,CAAC;AAqCD,uEAAuE;AACvE,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAElB,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAiD,CAAC;IACrE,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,MAAM,EAAE,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC3F,OAAO,GAAG,EAAE,IAAI,CAAC;AACnB,CAAC;AAMD,SAAS,MAAM,CAAC,IAAY,EAAE,OAAe;IAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CACvB,IAAc,EACd,OAAgB,EAChB,OAAsB;IAEtB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,OAAO,MAAM,CACX,sBAAsB,EACtB,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;aACxF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aACnC,IAAI,CAAC,IAAI,CAAC,qFAAqF,OAAO,CAAC,KAAK,6DAA6D,CAC7K,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,uBAAuB,EAAE,yCAAyC,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,MAAM,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,OAAO,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;YAChF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,8DAA8D,OAAO,CAAC,KAAK,uIAAuI,CACnN,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,kBAAkB,EAClB,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,IAAI,CAAC,IAAI,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,MAAM,CACX,uBAAuB,EACvB,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gCAAgC,CAC7D,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,sBAAsB,EAAE,KAAK,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,uBAAuB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,MAAM,CAAC,uBAAuB,EAAE,0CAA0C,CAAC,CAAC;YACrF,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,qCAAqC;IACrC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,GAAG;YAAE,SAAS;QAC5B,OAAO,MAAM,CACX,uBAAuB,EACvB,+HAA+H,CAChI,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,GAAG,WAAW;YACd,GAAG,QAAQ;YACX,GAAG,QAAQ;YACX,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;SACtD;KACF,CAAC;AACJ,CAAC;AAcD,SAAS,SAAS;IAChB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzE,GAAG;QACH,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,MAAM,CACnB,IAAc,EACd,IAAc,EACd,OAAsB;IAEtB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,KAAqD,CAAC;IAE1D,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,QAAwD,CAAC;QAC7D,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;YACpC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;gBACnB,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;SACF,CAAC,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC;IACnB,CAAC;SAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,yEAAyE;QACzE,4EAA4E;QAC5E,iDAAiD;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,yEAAyE;QACzE,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,qEAAqE;AACrE,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAgC,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;IAEtF,MAAM,OAAO,GAA8B;QACzC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EACF,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;oBACzC,6CAA6C,MAAM,CAAC,IAAI,EAAE;gBAC5D,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,KAAK,EAAE;YACL,CAAC,GAAG,WAAW,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI;YACxC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SACjF;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO,CAAI,IAAsB,EAAc,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,CAAC,IAAI,CACd,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,8lCAA8lC,CAAC;AAEjmC,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,OAAsB;IAC5D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,EAC9C;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,YAAY,EACV,OAAO,CAAC,KAAK,KAAK,IAAI;YACpB,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,0xCAA0xC;KACjyC,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;IAEpD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;QACzF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CACpE,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,wEAAwE;gBACxE,0DAA0D;gBAC1D,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,SAAS,CAAC,KAAK,CAAC,iRAAiR,CACtV,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,oCAAoC;YACpC,MAAM,QAAQ,GAAG,KAAK;gBACpB,CAAC,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;gBACpE,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,oCAAoC,SAAS,CAAC,QAAQ,CAAC,yGAAyG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8KAA8K,CAC5W,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO,UAAU,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAsB,EACtB,SAAoB;IAEpB,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC"}