arc-1 0.6.9 → 0.7.0

package/dist/extract-sap-cookies.js

@@ -0,0 +1,317 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { pathToFileURL } from 'node:url';
+import { config as loadDotEnv } from 'dotenv';
+const DEV_ONLY_BANNER = '⚠️  DEV-ONLY UTILITY. The resulting cookie file MUST NOT be used with SAP_PP_ENABLED=true — it would cause every per-user request to authenticate as you. Continue? [y/N] ';
+const PP_REFUSAL_MESSAGE = 'Refusing to run while SAP_PP_ENABLED=true. Cookie extraction is a shared-auth developer utility and must never run alongside principal propagation.';
+function getFlag(args, name) {
+    const prefix = `--${name}=`;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === `--${name}` && i + 1 < args.length) {
+            return args[i + 1];
+        }
+        if (args[i]?.startsWith(prefix)) {
+            return args[i].slice(prefix.length);
+        }
+    }
+    return undefined;
+}
+function parseScriptArgs(args) {
+    const browserRaw = getFlag(args, 'browser') ?? 'chrome';
+    const browser = browserRaw === 'chrome' || browserRaw === 'firefox' || browserRaw === 'edge' ? browserRaw : null;
+    if (!browser) {
+        throw new Error(`Unsupported --browser value '${browserRaw}'. Use one of: chrome, firefox, edge.`);
+    }
+    return {
+        browser,
+        output: getFlag(args, 'output'),
+        yes: args.includes('--yes'),
+        help: args.includes('--help') || args.includes('-h'),
+    };
+}
+// Keep this helper local to mirror the server config precedence for --url.
+export function parseServerArgs(args, env = process.env) {
+    return {
+        url: getFlag(args, 'url') ?? env.SAP_URL,
+        cookieFile: env.SAP_COOKIE_FILE,
+    };
+}
+function commandExists(command) {
+    const result = process.platform === 'win32'
+        ? spawnSync('where.exe', [command], { stdio: 'ignore' })
+        : spawnSync('command', ['-v', command], { stdio: 'ignore' });
+    return result.status === 0;
+}
+function resolveBrowserBinary(browser, platform) {
+    const win32Paths = (relativePath, exe) => {
+        const PF = process.env.PROGRAMFILES;
+        const PF86 = process.env['PROGRAMFILES(X86)'];
+        const LAD = process.env.LOCALAPPDATA;
+        return [
+            LAD ? `${LAD}\\${relativePath}` : undefined,
+            PF ? `${PF}\\${relativePath}` : undefined,
+            PF86 ? `${PF86}\\${relativePath}` : undefined,
+            exe,
+        ].filter((c) => Boolean(c));
+    };
+    const candidates = {
+        chrome: platform === 'darwin'
+            ? [
+                '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+                'google-chrome',
+                'google-chrome-stable',
+                'chromium',
+                'chromium-browser',
+            ]
+            : platform === 'win32'
+                ? win32Paths('Google\\Chrome\\Application\\chrome.exe', 'chrome.exe')
+                : ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'],
+        firefox: platform === 'darwin'
+            ? ['/Applications/Firefox.app/Contents/MacOS/firefox', 'firefox']
+            : platform === 'win32'
+                ? win32Paths('Mozilla Firefox\\firefox.exe', 'firefox.exe')
+                : ['firefox', 'firefox-esr'],
+        edge: platform === 'darwin'
+            ? ['/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge', 'microsoft-edge', 'microsoft-edge-stable']
+            : platform === 'win32'
+                ? win32Paths('Microsoft\\Edge\\Application\\msedge.exe', 'msedge.exe')
+                : ['microsoft-edge', 'microsoft-edge-stable'],
+    };
+    for (const candidate of candidates[browser]) {
+        if (isAbsolute(candidate)) {
+            if (existsSync(candidate))
+                return candidate;
+            continue;
+        }
+        if (platform === 'linux') {
+            if (commandExists(candidate))
+                return candidate;
+            continue;
+        }
+        if (platform === 'win32') {
+            if (spawnSync('where', [candidate], { stdio: 'ignore' }).status === 0)
+                return candidate;
+            continue;
+        }
+        if (commandExists(candidate))
+            return candidate;
+    }
+    throw new Error(`No runnable ${browser} binary found. Install the browser or pass an available binary via --browser (chrome|firefox|edge).`);
+}
+function printUsage() {
+    process.stderr.write(`Usage: arc1-cli extract-cookies --url <SAP_URL> [options]
+       (or: npx tsx src/extract-sap-cookies.ts --url <SAP_URL> [options])
+
+Options:
+  --url <url>               Target SAP URL (required). Precedence: CLI > env > .env
+  --browser <name>          Browser to launch: chrome | firefox | edge (default: chrome)
+  --output <path>           Output cookie file path. Precedence: CLI > SAP_COOKIE_FILE env > ./cookies.txt
+  --yes                     Skip the DEV-ONLY confirmation prompt
+  --help, -h                Show this help
+`);
+}
+function delay(ms) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, ms));
+}
+async function waitForDebuggerWebSocketUrl(port, timeoutMs = 25_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(`http://127.0.0.1:${port}/json/version`);
+            if (response.ok) {
+                const payload = (await response.json());
+                if (payload.webSocketDebuggerUrl)
+                    return payload.webSocketDebuggerUrl;
+            }
+        }
+        catch {
+            // Browser not ready yet.
+        }
+        await delay(300);
+    }
+    throw new Error(`Timed out waiting for browser debugging endpoint on http://127.0.0.1:${port}/json/version`);
+}
+async function waitForEnter(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        await rl.question(prompt);
+    }
+    finally {
+        rl.close();
+    }
+}
+async function maybePromptConfirmation(skipPrompt) {
+    if (skipPrompt)
+        return;
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(DEV_ONLY_BANNER)).trim().toLowerCase();
+        if (answer !== 'y' && answer !== 'yes') {
+            throw new Error('Aborted by user.');
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+function startBrowser(browserBinary, browser, url, port, profileDir) {
+    const args = browser === 'firefox'
+        ? ['--remote-debugging-port', String(port), '-profile', profileDir, url]
+        : [
+            `--remote-debugging-port=${port}`,
+            `--user-data-dir=${profileDir}`,
+            '--no-first-run',
+            '--no-default-browser-check',
+            '--new-window',
+            url,
+        ];
+    return spawn(browserBinary, args, { stdio: 'ignore' });
+}
+function cookieMatchesHost(cookieDomain, hostname) {
+    const normalized = cookieDomain.startsWith('.') ? cookieDomain.slice(1) : cookieDomain;
+    return hostname === normalized || hostname.endsWith(`.${normalized}`);
+}
+async function fetchCookiesViaCdp(wsUrl, origin) {
+    const hostname = new URL(origin).hostname;
+    return new Promise((resolvePromise, rejectPromise) => {
+        const ws = new WebSocket(wsUrl);
+        let nextId = 1;
+        let settled = false;
+        const pending = new Map();
+        const settleOnce = (resolver) => {
+            if (settled)
+                return;
+            settled = true;
+            resolver();
+        };
+        const rejectAllPending = (error) => {
+            for (const request of pending.values()) {
+                request.reject(error);
+            }
+            pending.clear();
+        };
+        const send = (method, params = {}) => new Promise((resolveSend, rejectSend) => {
+            const id = nextId++;
+            pending.set(id, { resolve: resolveSend, reject: rejectSend });
+            ws.send(JSON.stringify({ id, method, params }));
+        });
+        ws.onerror = () => {
+            settleOnce(() => rejectPromise(new Error('Failed to connect to browser debugging websocket.')));
+            rejectAllPending(new Error('CDP websocket error'));
+        };
+        ws.onmessage = (event) => {
+            const raw = typeof event.data === 'string' ? event.data : Buffer.from(event.data).toString('utf-8');
+            const msg = JSON.parse(raw);
+            if (!msg.id)
+                return;
+            const request = pending.get(msg.id);
+            if (!request)
+                return;
+            pending.delete(msg.id);
+            if (msg.error) {
+                request.reject(new Error(msg.error.message ?? 'Unknown CDP error'));
+            }
+            else {
+                request.resolve(msg.result);
+            }
+        };
+        ws.onclose = () => {
+            if (!settled) {
+                settleOnce(() => rejectPromise(new Error('Browser debugging websocket closed unexpectedly.')));
+            }
+            rejectAllPending(new Error('CDP websocket closed'));
+        };
+        ws.onopen = async () => {
+            try {
+                const result = (await send('Storage.getCookies'));
+                ws.close();
+                const filtered = (result.cookies ?? []).filter((c) => cookieMatchesHost(c.domain, hostname));
+                settleOnce(() => resolvePromise(filtered));
+            }
+            catch (error) {
+                ws.close();
+                const message = error instanceof Error ? error.message : String(error);
+                settleOnce(() => rejectPromise(new Error(message)));
+            }
+        };
+    });
+}
+function formatNetscapeCookieLine(cookie) {
+    const domain = cookie.domain || '';
+    const includeSubdomains = domain.startsWith('.') ? 'TRUE' : 'FALSE';
+    const path = cookie.path || '/';
+    const secure = cookie.secure ? 'TRUE' : 'FALSE';
+    const expires = cookie.expires && cookie.expires > 0 ? String(Math.floor(cookie.expires)) : '0';
+    return `${domain}\t${includeSubdomains}\t${path}\t${secure}\t${expires}\t${cookie.name}\t${cookie.value}`;
+}
+function toNetscapeCookieFile(cookies) {
+    const header = ['# Netscape HTTP Cookie File', '# Generated by ARC-1 extract-sap-cookies.ts'];
+    const lines = cookies.map(formatNetscapeCookieLine);
+    return `${[...header, ...lines].join('\n')}\n`;
+}
+export function planExtraction(input) {
+    if (input.env.SAP_PP_ENABLED === 'true') {
+        throw new Error(PP_REFUSAL_MESSAGE);
+    }
+    const scriptArgs = parseScriptArgs(input.args);
+    const serverArgs = parseServerArgs(input.args, input.env);
+    if (!serverArgs.url) {
+        throw new Error('Missing SAP URL. Set --url <...> (preferred) or SAP_URL (CLI > env > .env). See --help for usage.');
+    }
+    const parsedUrl = new URL(serverArgs.url);
+    const browserBinary = resolveBrowserBinary(scriptArgs.browser, input.platform);
+    return {
+        url: serverArgs.url,
+        origin: parsedUrl.origin,
+        browser: scriptArgs.browser,
+        browserBinary,
+        outputPath: resolve(input.cwd, scriptArgs.output ?? serverArgs.cookieFile ?? './cookies.txt'),
+        yes: scriptArgs.yes,
+    };
+}
+export async function run(argv = process.argv.slice(2)) {
+    loadDotEnv();
+    const scriptArgs = parseScriptArgs(argv);
+    if (scriptArgs.help) {
+        printUsage();
+        return;
+    }
+    const plan = planExtraction({
+        args: argv,
+        env: process.env,
+        cwd: process.cwd(),
+        platform: process.platform,
+    });
+    await maybePromptConfirmation(plan.yes);
+    const port = 9222;
+    const profileDir = mkdtempSync(join(tmpdir(), 'arc1-cookie-extract-'));
+    const browserProcess = startBrowser(plan.browserBinary, plan.browser, plan.url, port, profileDir);
+    try {
+        const wsUrl = await waitForDebuggerWebSocketUrl(port);
+        process.stderr.write(`Browser started (${plan.browser}). Complete login for ${plan.origin}, then press Enter to capture cookies.\n`);
+        await waitForEnter('');
+        const cookies = await fetchCookiesViaCdp(wsUrl, plan.origin);
+        if (cookies.length === 0) {
+            throw new Error(`No cookies were returned for ${plan.origin}. Ensure you are logged in and try again.`);
+        }
+        const cookieFileContent = toNetscapeCookieFile(cookies);
+        mkdirSync(dirname(plan.outputPath), { recursive: true });
+        writeFileSync(plan.outputPath, cookieFileContent, { encoding: 'utf-8', mode: 0o600 });
+        chmodSync(plan.outputPath, 0o600);
+        process.stderr.write(`Cookies written to ${plan.outputPath} with mode 0600. Use with: SAP_COOKIE_FILE=${plan.outputPath} SAP_URL=${plan.url} arc-1. Rotate regularly — cookies expire.\n`);
+    }
+    finally {
+        browserProcess.kill('SIGTERM');
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    run().catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`${message}\n`);
+        process.exit(message === PP_REFUSAL_MESSAGE ? 2 : 1);
+    });
+}
+//# sourceMappingURL=extract-sap-cookies.js.map

package/dist/extract-sap-cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-sap-cookies.js","sourceRoot":"","sources":["../src/extract-sap-cookies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAyC9C,MAAM,eAAe,GACnB,4KAA4K,CAAC;AAC/K,MAAM,kBAAkB,GACtB,qJAAqJ,CAAC;AAExJ,SAAS,OAAO,CAAC,IAAc,EAAE,IAAY;IAC3C,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACjH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,uCAAuC,CAAC,CAAC;IACrG,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO;QACxC,UAAU,EAAE,GAAG,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAsB,EAAE,QAAyB;IAC7E,MAAM,UAAU,GAAG,CAAC,YAAoB,EAAE,GAAW,EAAY,EAAE;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,OAAO;YACL,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;YAC3C,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;YACzC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7C,GAAG;SACJ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,UAAU,GAAoC;QAClD,MAAM,EACJ,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC;gBACE,8DAA8D;gBAC9D,eAAe;gBACf,sBAAsB;gBACtB,UAAU;gBACV,kBAAkB;aACnB;YACH,CAAC,CAAC,QAAQ,KAAK,OAAO;gBACpB,CAAC,CAAC,UAAU,CAAC,yCAAyC,EAAE,YAAY,CAAC;gBACrE,CAAC,CAAC,CAAC,eAAe,EAAE,sBAAsB,EAAE,UAAU,EAAE,kBAAkB,CAAC;QACjF,OAAO,EACL,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,CAAC,kDAAkD,EAAE,SAAS,CAAC;YACjE,CAAC,CAAC,QAAQ,KAAK,OAAO;gBACpB,CAAC,CAAC,UAAU,CAAC,8BAA8B,EAAE,aAAa,CAAC;gBAC3D,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC;QAClC,IAAI,EACF,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,CAAC,gEAAgE,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;YAC/G,CAAC,CAAC,QAAQ,KAAK,OAAO;gBACpB,CAAC,CAAC,UAAU,CAAC,0CAA0C,EAAE,YAAY,CAAC;gBACtE,CAAC,CAAC,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;KACpD,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,aAAa,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxF,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,qGAAqG,CAC5H,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;CAStB,CAAC,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,IAAY,EAAE,SAAS,GAAG,MAAM;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,eAAe,CAAC,CAAC;YACtE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsC,CAAC;gBAC7E,IAAI,OAAO,CAAC,oBAAoB;oBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,IAAI,eAAe,CAAC,CAAC;AAC/G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,UAAmB;IACxD,IAAI,UAAU;QAAE,OAAO;IACvB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,aAAqB,EAAE,OAAsB,EAAE,GAAW,EAAE,IAAY,EAAE,UAAkB;IAChH,MAAM,IAAI,GACR,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC;QACxE,CAAC,CAAC;YACE,2BAA2B,IAAI,EAAE;YACjC,mBAAmB,UAAU,EAAE;YAC/B,gBAAgB;YAChB,4BAA4B;YAC5B,cAAc;YACd,GAAG;SACJ,CAAC;IACR,OAAO,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB;IAC/D,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACvF,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAc,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiF,CAAC;QAEzG,MAAM,UAAU,GAAG,CAAC,QAAoB,EAAQ,EAAE;YAChD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,CAAC,KAAY,EAAQ,EAAE;YAC9C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,SAAkC,EAAE,EAAoB,EAAE,CACtF,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEL,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE;YAChB,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC,CAAC;YAChG,gBAAgB,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC;QAEF,EAAE,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;YACvB,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoE,CAAC;YAC/F,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;QAEF,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE;YAChB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC,CAAC;YACjG,CAAC;YACD,gBAAgB,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC;QAEF,EAAE,CAAC,MAAM,GAAG,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAA8B,CAAC;gBAC/E,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC7F,UAAU,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAiB;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChG,OAAO,GAAG,MAAM,KAAK,iBAAiB,KAAK,IAAI,KAAK,MAAM,KAAK,OAAO,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;AAC5G,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAoB;IAChD,MAAM,MAAM,GAAG,CAAC,6BAA6B,EAAE,6CAA6C,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE/E,OAAO;QACL,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,aAAa;QACb,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,UAAU,IAAI,eAAe,CAAC;QAC7F,GAAG,EAAE,UAAU,CAAC,GAAG;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,UAAU,EAAE,CAAC;IACb,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExC,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAElG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,IAAI,CAAC,OAAO,yBAAyB,IAAI,CAAC,MAAM,0CAA0C,CAC/G,CAAC;QACF,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,2CAA2C,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACxD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAElC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,IAAI,CAAC,UAAU,8CAA8C,IAAI,CAAC,UAAU,YAAY,IAAI,CAAC,GAAG,8CAA8C,CACrK,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/handlers/hyperfocused.d.ts

@@ -1,18 +1,19 @@
 /**
  * Hyperfocused mode — a single universal `SAP` tool (~200 tokens of schema).
  *
- * Instead of 11 intent-based tools (~14K tokens), hyperfocused mode exposes
+ * Instead of 12 intent-based tools (~14K tokens), hyperfocused mode exposes
  * a single `SAP` tool that routes to all operations via an `action` parameter.
  * This is useful for token-constrained scenarios (small context windows,
  * cost optimization, or when the LLM already knows the ARC-1 API).
  *
  * Activate with: --tool-mode hyperfocused or ARC1_TOOL_MODE=hyperfocused
  */
+import type { ResolvedFeatures } from '../adt/types.js';
 import type { ServerConfig } from '../server/types.js';
 import type { ToolDefinition } from './tools.js';
 /**
  * Get the required scope for a hyperfocused action.
- * Must stay consistent with TOOL_SCOPES in intent.ts.
+ * Must stay consistent with ACTION_POLICY.
  */
 export declare function getHyperfocusedScope(action: string): string;
 /**
@@ -32,5 +33,5 @@ export declare function expandHyperfocusedArgs(args: Record<string, unknown>): {
 /**
  * Get the hyperfocused tool definition (~200 tokens).
  */
-export declare function getHyperfocusedToolDefinition(config: ServerConfig): ToolDefinition;
+export declare function getHyperfocusedToolDefinition(config: ServerConfig, resolvedFeatures?: ResolvedFeatures): ToolDefinition;
 //# sourceMappingURL=hyperfocused.d.ts.map

package/dist/handlers/hyperfocused.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hyperfocused.d.ts","sourceRoot":"","sources":["../../src/handlers/hyperfocused.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsBjD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChE;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAwBpB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CA+BlF"}
+{"version":3,"file":"hyperfocused.d.ts","sourceRoot":"","sources":["../../src/handlers/hyperfocused.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkBjD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChE;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAwBpB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,YAAY,EACpB,gBAAgB,CAAC,EAAE,gBAAgB,GAClC,cAAc,CA+ChB"}

package/dist/handlers/hyperfocused.js

@@ -1,13 +1,14 @@
 /**
  * Hyperfocused mode — a single universal `SAP` tool (~200 tokens of schema).
  *
- * Instead of 11 intent-based tools (~14K tokens), hyperfocused mode exposes
+ * Instead of 12 intent-based tools (~14K tokens), hyperfocused mode exposes
  * a single `SAP` tool that routes to all operations via an `action` parameter.
  * This is useful for token-constrained scenarios (small context windows,
  * cost optimization, or when the LLM already knows the ARC-1 API).
  *
  * Activate with: --tool-mode hyperfocused or ARC1_TOOL_MODE=hyperfocused
  */
+import { getActionPolicy } from '../authz/policy.js';
 /** Map hyperfocused action to the real tool name */
 const ACTION_TO_TOOL = {
     read: 'SAPRead',
@@ -19,23 +20,16 @@ const ACTION_TO_TOOL = {
     lint: 'SAPLint',
     diagnose: 'SAPDiagnose',
     transport: 'SAPTransport',
+    git: 'SAPGit',
     context: 'SAPContext',
     manage: 'SAPManage',
 };
-/** Actions that require write scope */
-const WRITE_ACTIONS = new Set(['write', 'activate', 'manage', 'transport']);
-/** Actions that require sql scope */
-const SQL_ACTIONS = new Set(['query']);
 /**
  * Get the required scope for a hyperfocused action.
- * Must stay consistent with TOOL_SCOPES in intent.ts.
+ * Must stay consistent with ACTION_POLICY.
  */
 export function getHyperfocusedScope(action) {
-    if (SQL_ACTIONS.has(action))
-        return 'sql';
-    if (WRITE_ACTIONS.has(action))
-        return 'write';
-    return 'read';
+    return getActionPolicy('SAP', action)?.scope ?? 'read';
 }
 /**
  * Resolve the real tool name from a hyperfocused action.
@@ -72,11 +66,26 @@ export function expandHyperfocusedArgs(args) {
 /**
  * Get the hyperfocused tool definition (~200 tokens).
  */
-export function getHyperfocusedToolDefinition(config) {
-    const readActions = ['read', 'search', 'query', 'navigate', 'context', 'lint', 'diagnose'];
-    const writeActions = config.readOnly ? [] : ['write', 'activate', 'manage'];
-    const adminActions = config.enableTransports ? ['transport'] : [];
-    const allActions = [...readActions, ...writeActions, ...adminActions];
+export function getHyperfocusedToolDefinition(config, resolvedFeatures) {
+    const gitAvailable = resolvedFeatures !== undefined
+        ? !!(resolvedFeatures.gcts?.available || resolvedFeatures.abapGit?.available)
+        : config.featureAbapGit !== 'off' || config.featureGcts !== 'off';
+    // Mixed delegators stay visible when their read sub-actions are usable.
+    // Mutating sub-actions are enforced downstream by the concrete tool policy.
+    const readActions = [
+        'read',
+        'search',
+        ...(config.allowFreeSQL ? ['query'] : []),
+        'navigate',
+        'context',
+        'lint',
+        'diagnose',
+        ...(config.featureTransport === 'off' ? [] : ['transport']),
+        ...(gitAvailable ? ['git'] : []),
+        'manage',
+    ];
+    const writeActions = config.allowWrites ? ['write', 'activate'] : [];
+    const allActions = [...readActions, ...writeActions];
     return {
         name: 'SAP',
         description: 'Universal SAP tool. Actions: ' +

package/dist/handlers/hyperfocused.js.map

@@ -1 +1 @@
-{"version":3,"file":"hyperfocused.js","sourceRoot":"","sources":["../../src/handlers/hyperfocused.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,oDAAoD;AACpD,MAAM,cAAc,GAA2B;IAC7C,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;IACzB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,uCAAuC;AACvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5E,qCAAqC;AACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA6B;IAMlE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,oBAAoB,MAAM,qBAAqB,YAAY,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAI,IAAI,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC9D,MAAM,YAAY,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAE5D,iCAAiC;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAE3D,iEAAiE;IACjE,iFAAiF;IACjF,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1C,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAoB;IAChE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,CAAC;IAEtE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,WAAW,EACT,+BAA+B;YAC/B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACrB,kGAAkG;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,sBAAsB;iBACpC;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kEAAkE,EAAE;gBACzG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE;gBACpD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;oBAC5E,oBAAoB,EAAE,IAAI;iBAC3B;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hyperfocused.js","sourceRoot":"","sources":["../../src/handlers/hyperfocused.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIrD,oDAAoD;AACpD,MAAM,cAAc,GAA2B;IAC7C,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;IACzB,GAAG,EAAE,QAAQ;IACb,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA6B;IAMlE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,oBAAoB,MAAM,qBAAqB,YAAY,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAI,IAAI,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC9D,MAAM,YAAY,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAE5D,iCAAiC;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAE3D,iEAAiE;IACjE,iFAAiF;IACjF,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1C,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAoB,EACpB,gBAAmC;IAEnC,MAAM,YAAY,GAChB,gBAAgB,KAAK,SAAS;QAC5B,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,IAAI,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7E,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,WAAW,GAAG;QAClB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,UAAU;QACV,SAAS;QACT,MAAM;QACN,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,QAAQ;KACT,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC,CAAC;IAErD,OAAO;QACL,IAAI,EAAE,KAAK;QACX,WAAW,EACT,+BAA+B;YAC/B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACrB,kGAAkG;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,sBAAsB;iBACpC;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kEAAkE,EAAE;gBACzG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE;gBACpD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;oBAC5E,oBAAoB,EAAE,IAAI;iBAC3B;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/intent.d.ts

@@ -2,7 +2,7 @@
  * Intent-based tool handler for ARC-1.
  *
  * Routes MCP tool calls to the appropriate ADT client methods.
- * Each of the 11 tools (SAPRead, SAPSearch, etc.) dispatches
+ * Each of the 12 tools (SAPRead, SAPSearch, etc.) dispatches
  * based on its `type` or `action` parameter.
  *
  * Error handling: all errors are caught and returned as MCP error
@@ -24,20 +24,12 @@ export interface ToolResult {
     isError?: boolean;
 }
 /**
- * Scope required for each tool.
- *
- * Scope enforcement is ADDITIVE to the safety system:
- * - Safety system (readOnly, allowedOps, etc.) gates operations at the ADT client level
- * - Scopes gate operations at the MCP tool level (only enforced when authInfo is present)
- * - Both must pass for an operation to succeed
- *
- * A user with `write` scope but `readOnly=true` in config still can't write.
+ * Back-compat re-export of a tool→scope map derived from ACTION_POLICY.
+ * New code should use `getActionPolicy(tool, action)` directly.
  */
 export declare const TOOL_SCOPES: Record<string, string>;
 /**
- * Check if authInfo has the required scope, respecting implied scopes:
- * - `write` implies `read`
- * - `sql` implies `data`
+ * Check if authInfo has the required scope, routing through policy.hasRequiredScope.
  */
 export declare function hasRequiredScope(authInfo: AuthInfo, requiredScope: string): boolean;
 /**

package/dist/handlers/intent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intent.d.ts","sourceRoot":"","sources":["../../src/handlers/intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAuFlD,OAAO,KAAK,EAA0C,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGhG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAc9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD,2BAA2B;AAC3B,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAY9C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CASnF;AAeD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAe1F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASzD;AA2KD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,CAAC,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,YAAY,EAC3B,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,UAAU,CAAC,CAsLrB;AAu5BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAyB1E;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CA6NR;AAwCD,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxD;AA45DD,0CAA0C;AAC1C,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAE9E;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAEhE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAEnE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE1D"}
+{"version":3,"file":"intent.d.ts","sourceRoot":"","sources":["../../src/handlers/intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAqBxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAkHlD,OAAO,KAAK,EAAsD,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAG5G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAc9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD,2BAA2B;AAC3B,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiBD;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAe9C,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAKnF;AAqFD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAe1F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASzD;AAwoBD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,CAAC,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,YAAY,EAC3B,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,UAAU,CAAC,CA+MrB;AA46BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAyB1E;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CA6NR;AAwCD,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxD;AAk8FD,0CAA0C;AAC1C,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAE9E;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAEhE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAEnE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE1D"}