boondmanager-mcp-server 2.1.1 → 2.2.0

package/README.md

@@ -423,6 +423,27 @@ Pour eviter qu'une boucle d'outils emballee n'inonde l'API (et n'enchaine les `4
 | `BOOND_HTTP_RATE_LIMIT_RPS` | `10` | Debit soutenu (requetes/seconde). `0` desactive completement. |
 | `BOOND_HTTP_RATE_LIMIT_BURST` | `20` | Capacite du bucket = taille maximale de rafale immediate. |
 
+### Restriction d'accès (domaines / lecture seule)
+
+Vous pouvez restreindre **ce que l'IA voit et peut faire**, entièrement par
+variables d'environnement : exposer seulement certains domaines (ex. la
+comptabilité), et/ou bloquer les écritures et suppressions.
+
+| Variable | Effet |
+|----------|-------|
+| `BOOND_MCP_DOMAINS` | Liste blanche de domaines (CSV). Absente = tous. Ex. `invoices,payments,application` |
+| `BOOND_MCP_EXCLUDE_DOMAINS` | Liste noire de domaines (CSV), appliquée après la liste blanche. Ex. `candidates,resources` |
+| `BOOND_MCP_OPERATIONS` | Opérations autorisées (CSV) parmi `read,create,update,delete`. Absente = toutes. |
+| `BOOND_MCP_READ_ONLY` | Raccourci : `true` équivaut à `BOOND_MCP_OPERATIONS=read` (tout en lecture seule). |
+
+> ⚠️ **Ce n'est pas une frontière de sécurité dure.** Le filtre masque des
+> outils à l'IA mais n'altère pas les droits du compte BoondManager utilisé.
+> Pour un vrai cloisonnement, configurez d'abord les droits du compte/rôle
+> BoondManager (lecture seule, périmètre comptable…) ; ce filtre vient en
+> complément (économie de tokens, garde-fou anti-action accidentelle).
+
+Guide complet, règles de résolution et exemples : [docs/access-control.md](docs/access-control.md).
+
 ## Transports
 
 Le serveur supporte deux transports MCP, selectionnables via la variable d'environnement `MCP_TRANSPORT`.

package/dist/config/access-policy.d.ts

@@ -0,0 +1,68 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Access policy: operator-side restriction of what the MCP server exposes,
+ * driven entirely by environment variables. Two orthogonal axes:
+ *
+ *  1. Domain filtering (allow-list + deny-list): restrict the server to a
+ *     subset of business domains (e.g. accounting only).
+ *  2. Operation filtering: restrict which kinds of action are exposed
+ *     (`read` / `create` / `update` / `delete`), e.g. read-only mode.
+ *
+ * ⚠️ This is NOT a hard security boundary. The server keeps using the
+ * configured BoondManager credentials; if those credentials may write, this
+ * filter only HIDES the tools from the model; it does not revoke anything
+ * API-side. The real boundary is the BoondManager account/role rights. The
+ * two are complementary: Boond rights = hard wall; this filter = ergonomics,
+ * token economy, and a guard-rail against accidental actions.
+ *
+ * Env vars (all optional; absent = no restriction = current behaviour):
+ *  - `BOOND_MCP_DOMAINS`         CSV allow-list of domains. Absent = all.
+ *  - `BOOND_MCP_EXCLUDE_DOMAINS` CSV deny-list. Applied AFTER the allow-list.
+ *  - `BOOND_MCP_OPERATIONS`      CSV of `read,create,update,delete`. Absent = all.
+ *  - `BOOND_MCP_READ_ONLY`       Boolean shortcut, equivalent to OPERATIONS=read.
+ */
+export type Operation = "read" | "create" | "update" | "delete";
+export declare const ALL_OPERATIONS: readonly Operation[];
+/** Subset of the MCP tool annotations we use to classify a tool's operation. */
+export interface ToolAnnotations {
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    openWorldHint?: boolean;
+}
+export interface AccessPolicy {
+    /** `null` = all domains allowed (no allow-list). Otherwise the set of allowed canonical (dash) domain names. */
+    allowedDomains: Set<string> | null;
+    /** Canonical (dash) domain names explicitly denied. Applied after the allow-list. */
+    excludedDomains: Set<string>;
+    /** Operations the server is allowed to expose. */
+    operations: Set<Operation>;
+}
+/**
+ * Build the effective access policy from the environment. Resilient: unknown
+ * domains/operations are warned-and-ignored, never fatal.
+ */
+export declare function resolveAccessPolicy(env?: NodeJS.ProcessEnv): AccessPolicy;
+/** Is a business domain allowed by the policy? (deny-list wins over allow-list.) */
+export declare function isDomainAllowed(policy: AccessPolicy, domain: string): boolean;
+/**
+ * Classify a tool into a single operation from its MCP annotations.
+ * Order matters: read-only first, then destructive (delete), then idempotent
+ * writes (update), else non-idempotent writes (create). A tool with no
+ * `readOnlyHint:true` is treated as a write (the safe default in read-only mode).
+ */
+export declare function operationOf(annotations: ToolAnnotations | undefined): Operation;
+/** Is a tool (by its annotations) allowed under the policy's operation set? */
+export declare function isOperationAllowed(policy: AccessPolicy, annotations: ToolAnnotations | undefined): boolean;
+/**
+ * Wrap an McpServer so that `registerTool` silently drops tools whose operation
+ * is not allowed by the policy. Implemented as a Proxy (no mutation of the
+ * instance, typing preserved). Methods are bound to the real target so the
+ * SDK's private fields keep working. Other methods (`registerPrompt`,
+ * `registerResource`, …) pass straight through.
+ *
+ * Fast path: when all operations are allowed, the original server is returned
+ * untouched (zero overhead in the default, unrestricted case).
+ */
+export declare function withPolicy(server: McpServer, policy: AccessPolicy): McpServer;
+//# sourceMappingURL=access-policy.d.ts.map

package/dist/config/access-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AA2ED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAiDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}

package/dist/config/access-policy.js

@@ -0,0 +1,169 @@
+import { REGISTERED_DOMAINS } from "../constants.js";
+import { logger } from "../services/logger.js";
+export const ALL_OPERATIONS = ["read", "create", "update", "delete"];
+// --- Env parsing helpers (mirroring the patterns already used across the
+// codebase: see transports/http.ts, services/oauth.ts, services/update-checker.ts) ---
+function readEnv(env, key) {
+    const raw = env[key];
+    if (raw === undefined)
+        return undefined;
+    // Ignore unresolved placeholders like "${SOMETHING}" (same guard as http.ts).
+    if (raw.startsWith("${"))
+        return undefined;
+    return raw;
+}
+/** Split a CSV / whitespace-separated env value into trimmed, non-empty tokens. */
+function parseList(raw) {
+    if (!raw)
+        return [];
+    return raw
+        .split(/[\s,]+/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+function parseBoolean(raw) {
+    const v = (raw ?? "").toLowerCase().trim();
+    return v === "1" || v === "true" || v === "yes";
+}
+/** Normalise a user-supplied domain to the canonical (dash, lowercase) form. */
+function normalizeDomain(domain) {
+    return domain.toLowerCase().trim().replace(/_/g, "-");
+}
+function normalizeAndValidateDomains(items, known, varName, log) {
+    const out = new Set();
+    for (const raw of items) {
+        const norm = normalizeDomain(raw);
+        if (known.has(norm)) {
+            out.add(norm);
+        }
+        else {
+            log.warn({ value: raw, normalized: norm, var: varName }, `${varName}: unknown domain "${raw}" ignored (not one of the ${known.size} known domains)`);
+        }
+    }
+    return out;
+}
+function validateOperations(items, log) {
+    const out = new Set();
+    for (const raw of items) {
+        const op = raw.toLowerCase();
+        if (ALL_OPERATIONS.includes(op)) {
+            out.add(op);
+        }
+        else {
+            log.warn({ value: raw }, `BOOND_MCP_OPERATIONS: unknown operation "${raw}" ignored (expected read/create/update/delete)`);
+        }
+    }
+    // If the operator provided only invalid values, fall back to "all" rather
+    // than silently exposing zero tools (that would look like a broken server).
+    if (out.size === 0) {
+        log.warn("BOOND_MCP_OPERATIONS contained no valid operation; defaulting to all operations");
+        return new Set(ALL_OPERATIONS);
+    }
+    return out;
+}
+/**
+ * Build the effective access policy from the environment. Resilient: unknown
+ * domains/operations are warned-and-ignored, never fatal.
+ */
+export function resolveAccessPolicy(env = process.env) {
+    const log = logger.child({ component: "access-policy" });
+    const known = new Set(REGISTERED_DOMAINS);
+    // --- Domains ---
+    const allowItems = parseList(readEnv(env, "BOOND_MCP_DOMAINS"));
+    const excludeItems = parseList(readEnv(env, "BOOND_MCP_EXCLUDE_DOMAINS"));
+    const allowedDomains = allowItems.length > 0 ? normalizeAndValidateDomains(allowItems, known, "BOOND_MCP_DOMAINS", log) : null;
+    const excludedDomains = normalizeAndValidateDomains(excludeItems, known, "BOOND_MCP_EXCLUDE_DOMAINS", log);
+    // --- Operations ---
+    const opItems = parseList(readEnv(env, "BOOND_MCP_OPERATIONS"));
+    const readOnlyShortcut = parseBoolean(readEnv(env, "BOOND_MCP_READ_ONLY"));
+    let operations;
+    if (opItems.length > 0) {
+        operations = validateOperations(opItems, log);
+        if (readOnlyShortcut) {
+            log.warn("Both BOOND_MCP_OPERATIONS and BOOND_MCP_READ_ONLY are set; BOOND_MCP_OPERATIONS takes precedence");
+        }
+    }
+    else if (readOnlyShortcut) {
+        operations = new Set(["read"]);
+    }
+    else {
+        operations = new Set(ALL_OPERATIONS);
+    }
+    const policy = { allowedDomains, excludedDomains, operations };
+    // --- Surface the effective policy + a guard-rail warning for `application` ---
+    const restricted = allowedDomains !== null || excludedDomains.size > 0 || operations.size !== ALL_OPERATIONS.length;
+    if (restricted) {
+        if (!isDomainAllowed(policy, "application")) {
+            log.warn("Domain `application` is filtered out; dictionary lookups (state/type labels) and current-user resolution will be unavailable, degrading many tools/resources");
+        }
+        log.info({
+            allowedDomains: allowedDomains ? [...allowedDomains] : "all",
+            excludedDomains: [...excludedDomains],
+            operations: [...operations],
+        }, "Access policy active: the exposed tool/prompt surface is restricted");
+    }
+    return policy;
+}
+/** Is a business domain allowed by the policy? (deny-list wins over allow-list.) */
+export function isDomainAllowed(policy, domain) {
+    const norm = normalizeDomain(domain);
+    if (policy.excludedDomains.has(norm))
+        return false;
+    if (policy.allowedDomains !== null && !policy.allowedDomains.has(norm))
+        return false;
+    return true;
+}
+/**
+ * Classify a tool into a single operation from its MCP annotations.
+ * Order matters: read-only first, then destructive (delete), then idempotent
+ * writes (update), else non-idempotent writes (create). A tool with no
+ * `readOnlyHint:true` is treated as a write (the safe default in read-only mode).
+ */
+export function operationOf(annotations) {
+    if (annotations?.readOnlyHint === true)
+        return "read";
+    if (annotations?.destructiveHint === true)
+        return "delete";
+    if (annotations?.idempotentHint === true)
+        return "update";
+    return "create";
+}
+/** Is a tool (by its annotations) allowed under the policy's operation set? */
+export function isOperationAllowed(policy, annotations) {
+    return policy.operations.has(operationOf(annotations));
+}
+/**
+ * Wrap an McpServer so that `registerTool` silently drops tools whose operation
+ * is not allowed by the policy. Implemented as a Proxy (no mutation of the
+ * instance, typing preserved). Methods are bound to the real target so the
+ * SDK's private fields keep working. Other methods (`registerPrompt`,
+ * `registerResource`, …) pass straight through.
+ *
+ * Fast path: when all operations are allowed, the original server is returned
+ * untouched (zero overhead in the default, unrestricted case).
+ */
+export function withPolicy(server, policy) {
+    if (policy.operations.size === ALL_OPERATIONS.length)
+        return server;
+    return new Proxy(server, {
+        get(target, prop) {
+            // receiver = target so any getters/private fields resolve against the real instance.
+            const value = Reflect.get(target, prop, target);
+            if (typeof value !== "function")
+                return value;
+            if (prop === "registerTool") {
+                return (...args) => {
+                    const config = args[1];
+                    if (!isOperationAllowed(policy, config?.annotations)) {
+                        return undefined; // skip registration; callers ignore the return value
+                    }
+                    return value.apply(target, args);
+                };
+            }
+            // Bind every other method to the real target (avoids private-field errors
+            // that occur when an unbound method runs with `this` = Proxy).
+            return value.bind(target);
+        },
+    });
+}
+//# sourceMappingURL=access-policy.js.map

package/dist/config/access-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AA2B/C,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE1E,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAE3E,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/constants.d.ts

@@ -54,6 +54,8 @@ export declare const API_PATHS: {
     readonly reportingSynthesis: "/reporting-synthesis";
     readonly reportingProductionPlans: "/reporting-production-plans";
 };
+export declare const REGISTERED_DOMAINS: readonly ["candidates", "resources", "contacts", "companies", "opportunities", "actions", "timesheets", "projects", "invoices", "orders", "deliveries", "absences", "expenses", "products", "positionings", "payments", "advantages", "application", "contracts", "purchases", "provider-invoices", "accounts", "agencies", "business-units", "roles", "logs", "notifications", "threads", "todolists", "flags", "calendars", "webhooks", "validations", "poles", "reporting", "planning-absences", "workflows"];
+export type DomainName = (typeof REGISTERED_DOMAINS)[number];
 export declare const ENTITY_TABS: {
     readonly candidates: readonly ["information", "technical-data", "administrative", "actions", "positionings"];
     readonly resources: readonly ["information", "technical-data", "administrative", "advantages", "actions", "positionings", "projects", "times-reports", "expenses-reports", "absences-reports"];

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gBAAgB,oCAAoC,CAAC;AAClE,eAAO,MAAM,eAAe,QAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC;AAKjC,eAAO,MAAM,eAAe,MAAM,CAAC;AAKnC,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAK9C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAM/C,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAGhD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CZ,CAAC;AAGX,eAAO,MAAM,WAAW;;;;;;;;;CASd,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gBAAgB,oCAAoC,CAAC;AAClE,eAAO,MAAM,eAAe,QAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC;AAKjC,eAAO,MAAM,eAAe,MAAM,CAAC;AAKnC,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAK9C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAM/C,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAGhD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CZ,CAAC;AAOX,eAAO,MAAM,kBAAkB,kfAsCrB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAG7D,eAAO,MAAM,WAAW;;;;;;;;;CAsCd,CAAC"}

package/dist/constants.js

@@ -69,14 +69,87 @@ export const API_PATHS = {
     reportingSynthesis: "/reporting-synthesis",
     reportingProductionPlans: "/reporting-production-plans",
 };
+// Canonical list of tool domains exposed by the server, in registration order.
+// Domain names use dashes; the matching tool-name prefix replaces them with
+// underscores (e.g. `provider-invoices` -> `boond_provider_invoices_*`).
+// Lives here (not in server.ts) so the access-policy layer can validate
+// configured domains without importing server.ts (avoids an import cycle).
+export const REGISTERED_DOMAINS = [
+    "candidates",
+    "resources",
+    "contacts",
+    "companies",
+    "opportunities",
+    "actions",
+    "timesheets",
+    "projects",
+    "invoices",
+    "orders",
+    "deliveries",
+    "absences",
+    "expenses",
+    "products",
+    "positionings",
+    "payments",
+    "advantages",
+    "application",
+    "contracts",
+    "purchases",
+    "provider-invoices",
+    "accounts",
+    "agencies",
+    "business-units",
+    "roles",
+    "logs",
+    "notifications",
+    "threads",
+    "todolists",
+    "flags",
+    "calendars",
+    "webhooks",
+    "validations",
+    "poles",
+    "reporting",
+    "planning-absences",
+    "workflows",
+];
 // Tab names available on entities (matching actual API endpoints)
 export const ENTITY_TABS = {
     candidates: ["information", "technical-data", "administrative", "actions", "positionings"],
-    resources: ["information", "technical-data", "administrative", "advantages", "actions", "positionings", "projects", "times-reports", "expenses-reports", "absences-reports"],
+    resources: [
+        "information",
+        "technical-data",
+        "administrative",
+        "advantages",
+        "actions",
+        "positionings",
+        "projects",
+        "times-reports",
+        "expenses-reports",
+        "absences-reports",
+    ],
     contacts: ["information", "actions", "opportunities", "projects", "orders", "invoices"],
-    companies: ["information", "contacts", "actions", "opportunities", "projects", "orders", "invoices", "purchases", "provider-invoices"],
+    companies: [
+        "information",
+        "contacts",
+        "actions",
+        "opportunities",
+        "projects",
+        "orders",
+        "invoices",
+        "purchases",
+        "provider-invoices",
+    ],
     opportunities: ["information", "actions", "positionings", "projects", "simulation"],
-    projects: ["information", "actions", "simulation", "deliveries-groupments", "orders", "purchases", "productivity"],
+    projects: [
+        "information",
+        "actions",
+        "simulation",
+        "deliveries-groupments",
+        "orders",
+        "purchases",
+        "productivity",
+    ],
     invoices: ["information", "actions", "billable-items"],
     orders: ["information", "actions", "invoices"],
 };

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,uBAAuB;AACvB,qEAAqE;AACrE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,4EAA4E;AAC5E,6EAA6E;AAC7E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,YAAY;AACZ,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,aAAa;IACzB,oBAAoB,EAAE,wBAAwB;IAC9C,QAAQ,EAAE,WAAW;IACrB,eAAe,EAAE,mBAAmB;IACpC,QAAQ,EAAE,WAAW;IACrB,eAAe,EAAE,mBAAmB;IACpC,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,gBAAgB;IAC9B,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,oBAAoB;IACtC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,aAAa,EAAE,iBAAiB;IAChC,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,OAAO;IACb,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,QAAQ;IACf,gBAAgB,EAAE,oBAAoB;IACtC,kBAAkB,EAAE,sBAAsB;IAC1C,iBAAiB,EAAE,qBAAqB;IACxC,kBAAkB,EAAE,sBAAsB;IAC1C,kBAAkB,EAAE,sBAAsB;IAC1C,wBAAwB,EAAE,6BAA6B;CAC/C,CAAC;AAEX,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,CAAU;IACnG,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,CAAU;IACrL,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAU;IAChG,SAAS,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,CAAU;IAC/I,aAAa,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,CAAU;IAC5F,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,CAAU;IAC3H,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAU;IAC/D,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAU;CAC/C,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,uBAAuB;AACvB,qEAAqE;AACrE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,4EAA4E;AAC5E,6EAA6E;AAC7E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,YAAY;AACZ,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,aAAa;IACzB,oBAAoB,EAAE,wBAAwB;IAC9C,QAAQ,EAAE,WAAW;IACrB,eAAe,EAAE,mBAAmB;IACpC,QAAQ,EAAE,WAAW;IACrB,eAAe,EAAE,mBAAmB;IACpC,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,gBAAgB;IAC9B,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,oBAAoB;IACtC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,aAAa,EAAE,iBAAiB;IAChC,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,OAAO;IACb,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,QAAQ;IACf,gBAAgB,EAAE,oBAAoB;IACtC,kBAAkB,EAAE,sBAAsB;IAC1C,iBAAiB,EAAE,qBAAqB;IACxC,kBAAkB,EAAE,sBAAsB;IAC1C,kBAAkB,EAAE,sBAAsB;IAC1C,wBAAwB,EAAE,6BAA6B;CAC/C,CAAC;AAEX,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,UAAU;IACV,WAAW;IACX,eAAe;IACf,SAAS;IACT,YAAY;IACZ,UAAU;IACV,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,cAAc;IACd,UAAU;IACV,YAAY;IACZ,aAAa;IACb,WAAW;IACX,WAAW;IACX,mBAAmB;IACnB,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,aAAa;IACb,OAAO;IACP,WAAW;IACX,mBAAmB;IACnB,WAAW;CACH,CAAC;AAIX,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,CAAU;IACnG,SAAS,EAAE;QACT,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,YAAY;QACZ,SAAS;QACT,cAAc;QACd,UAAU;QACV,eAAe;QACf,kBAAkB;QAClB,kBAAkB;KACV;IACV,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAU;IAChG,SAAS,EAAE;QACT,aAAa;QACb,UAAU;QACV,SAAS;QACT,eAAe;QACf,UAAU;QACV,QAAQ;QACR,UAAU;QACV,WAAW;QACX,mBAAmB;KACX;IACV,aAAa,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,CAAU;IAC5F,QAAQ,EAAE;QACR,aAAa;QACb,SAAS;QACT,YAAY;QACZ,uBAAuB;QACvB,QAAQ;QACR,WAAW;QACX,cAAc;KACN;IACV,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAU;IAC/D,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAU;CAC/C,CAAC"}

package/dist/prompts/index.d.ts

@@ -1,14 +1,26 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import type { DomainName } from "../constants.js";
+import { type AccessPolicy } from "../config/access-policy.js";
 export interface PromptDefinition {
     name: string;
     title: string;
     description: string;
     argsSchema: z.ZodRawShape;
+    /**
+     * Business domains this prompt's runbook orchestrates. Used by the access
+     * policy: the prompt (and its mirror workflow tool in `tools/workflows.ts`)
+     * is cut when ANY of these domains is filtered out, so a surfaced runbook
+     * never points the model at tools that aren't registered. Optional
+     * name-resolution helpers (e.g. resolving a manager name via
+     * `boond_resources_search`) are intentionally NOT listed: if their domain
+     * is filtered, the user simply passes a numeric id instead.
+     */
+    domains: readonly DomainName[];
     build: (args: Record<string, string | undefined>) => string;
 }
 export declare const PROMPTS: PromptDefinition[];
-export declare function registerAllPrompts(server: McpServer): void;
+export declare function registerAllPrompts(server: McpServer, policy?: AccessPolicy): void;
 /** Exposed for tests so we can assert names/coverage without instantiating a server. */
 export declare const REGISTERED_PROMPTS: {
     name: string;

package/dist/prompts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC;IAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,MAAM,CAAC;CAC7D;AA2DD,eAAO,MAAM,OAAO,EAAE,gBAAgB,EAgkBrC,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAY1D;AAED,wFAAwF;AACxF,eAAO,MAAM,kBAAkB;;;;;GAK5B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAsBhF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC;IAC1B;;;;;;;;OAQG;IACH,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,MAAM,CAAC;CAC7D;AA2DD,eAAO,MAAM,OAAO,EAAE,gBAAgB,EA2kBrC,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAejF;AAED,wFAAwF;AACxF,eAAO,MAAM,kBAAkB;;;;;GAK5B,CAAC"}

package/dist/prompts/index.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { isDomainAllowed } from "../config/access-policy.js";
 /**
  * Pre-orchestrated MCP prompts for the most common Boond workflows.
  *
@@ -67,6 +68,7 @@ export const PROMPTS = [
                 .optional()
                 .describe("Période d'analyse libre (ex: 'cette semaine', 'avril 2026'). Défaut: mois en cours."),
         },
+        domains: ["resources", "application"],
         build: ({ manager_id, periode }) => {
             const periodeText = periode || "le mois en cours";
             let preamble = "";
@@ -105,6 +107,7 @@ export const PROMPTS = [
                 ID_OR_NAME_HINT_RESOURCE +
                 " Si absent, scope = équipe de l'utilisateur courant via `perimeterDynamic: ['data']`."),
         },
+        domains: ["opportunities", "application"],
         build: ({ date_debut, date_fin, manager_id }) => {
             let preamble = "";
             let scopeFilter;
@@ -134,6 +137,7 @@ export const PROMPTS = [
                 .optional()
                 .describe("Société ciblée pour la relance. " + ID_OR_NAME_HINT_SOCIETY),
         },
+        domains: ["invoices", "application"],
         build: ({ society_id }) => {
             let preamble = "";
             let filterLine;
@@ -159,6 +163,7 @@ export const PROMPTS = [
         argsSchema: {
             opportunity_id: z.string().describe("Opportunité à pourvoir. " + ID_OR_NAME_HINT_OPPORTUNITY),
         },
+        domains: ["candidates", "opportunities", "application"],
         build: ({ opportunity_id }) => {
             const r = resolveEntity(opportunity_id ?? "", "opportunity", "<OPPORTUNITY_ID>");
             const oppLit = r.idForFilter;
@@ -176,6 +181,7 @@ export const PROMPTS = [
         argsSchema: {
             resource_id: z.string().describe("Ressource ciblée. " + ID_OR_NAME_HINT_RESOURCE),
         },
+        domains: ["resources"],
         build: ({ resource_id }) => {
             const r = resolveEntity(resource_id ?? "", "resource", "<RESOURCE_ID>");
             const idLit = r.idForFilter;
@@ -206,6 +212,7 @@ export const PROMPTS = [
                 ID_OR_NAME_HINT_RESOURCE +
                 " Si absent, scope = mon équipe via `perimeterDynamic: ['managers']`."),
         },
+        domains: ["resources", "application"],
         build: ({ start_date, end_date, competences, manager_id }) => {
             let preamble = "";
             let scope;
@@ -250,6 +257,7 @@ export const PROMPTS = [
                 ID_OR_NAME_HINT_RESOURCE +
                 " Si absent, scope = mon équipe via `perimeterDynamic: ['managers']`."),
         },
+        domains: ["resources", "application"],
         build: ({ horizon_jours, manager_id }) => {
             const horizon = horizon_jours || "60";
             let preamble = "";
@@ -290,6 +298,7 @@ export const PROMPTS = [
                 .describe("Agence pour cartographier toute une agence (alternatif à `manager_id`). " + ID_OR_NAME_HINT_AGENCY),
             top_n: z.string().optional().describe("Nombre de compétences à mettre en avant dans le top (défaut: 20)."),
         },
+        domains: ["resources", "opportunities", "application"],
         build: ({ manager_id, agency_id, top_n }) => {
             const top = top_n || "20";
             let preamble = "";
@@ -331,6 +340,7 @@ export const PROMPTS = [
                 ID_OR_NAME_HINT_RESOURCE +
                 " Si absent, scope = mon équipe via `perimeterDynamic: ['managers']`."),
         },
+        domains: ["resources", "application"],
         build: ({ seuil_mois, manager_id }) => {
             const seuil = seuil_mois || "12";
             let preamble = "";
@@ -381,6 +391,7 @@ export const PROMPTS = [
                 ID_OR_NAME_HINT_RESOURCE +
                 " Sinon scope ouvert (toute l'organisation accessible)."),
         },
+        domains: ["resources", "candidates", "application"],
         build: ({ competences, experience_min, dispo_avant, inclure_candidats, manager_id }) => {
             const includeCandidates = (inclure_candidats || "oui").toLowerCase() !== "non";
             let preamble = "";
@@ -421,6 +432,7 @@ export const PROMPTS = [
                 .optional()
                 .describe("Semaine ciblée (ex: 'cette semaine', 'la semaine prochaine'). Défaut: cette semaine."),
         },
+        domains: ["resources", "opportunities", "projects", "application"],
         build: ({ semaine }) => {
             const semaineText = semaine || "cette semaine";
             return [
@@ -443,8 +455,12 @@ export const PROMPTS = [
         },
     },
 ];
-export function registerAllPrompts(server) {
+export function registerAllPrompts(server, policy) {
     for (const p of PROMPTS) {
+        // Cut a prompt when any domain it orchestrates is filtered out, so the
+        // surfaced runbook never references tools that aren't registered.
+        if (policy && !p.domains.every((d) => isDomainAllowed(policy, d)))
+            continue;
         server.registerPrompt(p.name, {
             title: p.title,
             description: p.description,

package/dist/prompts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC;CAChF,CAAC,CAAC;AAoBH,MAAM,mBAAmB,GAA+B;IACtD,QAAQ,EAAE,wBAAwB;IAClC,OAAO,EAAE,wBAAwB;IACjC,WAAW,EAAE,4BAA4B;IACzC,MAAM,EAAE,uBAAuB;CAChC,CAAC;AAEF,MAAM,aAAa,GAA+B;IAChD,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAE,QAAQ;CACjB,CAAC;AASF,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,IAAgB,EAAE,WAAmB,EAAY,EAAE;IACvF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG;QACf,kCAAkC,KAAK,UAAU,OAAO,+BAA+B;QACvF,eAAe,IAAI,wBAAwB,OAAO,yBAAyB;QAC3E,0EAA0E,WAAW,kDAAkD;QACvI,+FAA+F;QAC/F,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAC5B,sHAAsH,CAAC;AACzH,MAAM,uBAAuB,GAC3B,wGAAwG,CAAC;AAC3G,MAAM,2BAA2B,GAC/B,mHAAmH,CAAC;AACtH,MAAM,sBAAsB,GAC1B,qGAAqG,CAAC;AAExG,MAAM,CAAC,MAAM,OAAO,GAAuB;IACzC;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,mFAAmF;YACnF,sEAAsE;QACxE,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,iBAAiB;gBACf,wBAAwB;gBACxB,oFAAoF,CACvF;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qFAAqF,CAAC;SACnG;QACD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,OAAO,IAAI,kBAAkB,CAAC;YAClD,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,WAAmB,CAAC;YACxB,IAAI,YAAoB,CAAC;YACzB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC;gBAC7B,WAAW,GAAG,gCAAgC,YAAY,KAAK,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,cAAc,CAAC;gBAC9B,WAAW;oBACT,8HAA8H,CAAC;YACnI,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,yCAAyC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,WAAW,EACX,EAAE,EACF,UAAU,EACV,6FAA6F,YAAY,sKAAsK,EAC/Q,8DAA8D,EAC9D,+DAA+D,EAC/D,qEAAqE,EACrE,gFAAgF,EAChF,qHAAqH,EACrH,iHAAiH,CAClH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,oFAAoF;YACpF,qDAAqD;QACvD,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACjE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAC7D,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,oBAAoB;gBAClB,wBAAwB;gBACxB,uFAAuF,CAC1F;SACJ;QACD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC9C,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,WAAmB,CAAC;YACxB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,WAAW,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,iDAAiD,CAAC;YAClE,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,sDAAsD,UAAU,OAAO,QAAQ,GAAG,EAAE,EAAE,CAAC,CAAC;YACjH,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,WAAW,GAAG,EAC7B,EAAE,EACF,UAAU,EACV,gDAAgD,EAChD,gCAAgC,EAChC,sBAAsB,UAAU,oBAAoB,QAAQ,KAAK,EACjE,QAAQ,WAAW,EAAE,EACrB,sBAAsB,EACtB,kDAAkD,EAClD,8IAA8I,EAC9I,gBAAgB,EAChB,4CAA4C,EAC5C,iEAAiE,EACjE,mEAAmE,EACnE,+GAA+G,CAChH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,qFAAqF;YACrF,uDAAuD;QACzD,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,GAAG,uBAAuB,CAAC;SAC1E;QACD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YACxB,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,UAAkB,CAAC;YACvB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;gBAC/D,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,UAAU,GAAG,sBAAsB,CAAC,CAAC,WAAW,KAAK,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,qEAAqE,CAAC;YACrF,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,4EAA4E,EAAE,EAAE,CAAC,CAAC;YAC3G,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,UAAU,EACV,sCAAsC,EACtC,UAAU,EACV,sBAAsB,EACtB,8JAA8J,EAC9J,sJAAsJ,EACtJ,sIAAsI,EACtI,qLAAqL,EACrL,wCAAwC,CACzC,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,yGAAyG;QAC3G,UAAU,EAAE;YACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,GAAG,2BAA2B,CAAC;SAC9F;QACD,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;YAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,cAAc,IAAI,EAAE,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YAC7B,MAAM,KAAK,GAAa,CAAC,sDAAsD,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CACR,UAAU,EACV,2EAA2E,MAAM,kEAAkE,EACnJ,iIAAiI,EACjI,6CAA6C,EAC7C,6JAA6J,EAC7J,sCAAsC,EACtC,uCAAuC,EACvC,mHAAmH,EACnH,uHAAuH,EACvH,qBAAqB,EACrB,sHAAsH,EACtH,2GAA2G,CAC5G,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE,4FAA4F;QACzG,UAAU,EAAE;YACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,GAAG,wBAAwB,CAAC;SAClF;QACD,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,aAAa,CAAC,WAAW,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YAC5B,MAAM,KAAK,GAAa,CAAC,6CAA6C,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CACR,mDAAmD,EACnD,wCAAwC,KAAK,kCAAkC,EAC/E,2CAA2C,KAAK,6CAA6C,EAC7F,2CAA2C,KAAK,uDAAuD,EACvG,yCAAyC,KAAK,8CAA8C,EAC5F,qCAAqC,KAAK,gCAAgC,EAC1E,6CAA6C,KAAK,6CAA6C,EAC/F,0CAA0C,KAAK,gCAAgC,EAC/E,EAAE,EACF,wRAAwR,CACzR,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,0CAA0C;QACjD,WAAW,EACT,yFAAyF;YACzF,sEAAsE;YACtE,0FAA0F;QAC5F,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;YACzE,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yHAAyH,CAC1H;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yCAAyC;gBACvC,wBAAwB;gBACxB,sEAAsE,CACzE;SACJ;QACD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE;YAC3D,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,yDAAyD,CAAC;YACpE,CAAC;YACD,MAAM,UAAU,GAAG,WAAW;gBAC5B,CAAC,CAAC,+BAA+B,WAAW,2HAA2H;gBACvK,CAAC,CAAC,uEAAuE,CAAC;YAC5E,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,2HAA2H;gBAC7H,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAa;gBACtB,wEAAwE,UAAU,OAAO,QAAQ,GAAG;gBACpG,EAAE;aACH,CAAC;YACF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,UAAU,EACV,4CAA4C,EAC5C,+CAA+C,UAAU,oBAAoB,QAAQ,KAAK,EAC1F,QAAQ,KAAK,EAAE,EACf,SAAS,EACT,iJAAiJ,EACjJ,6DAA6D,EAC7D,iEAAiE,EACjE,wGAAwG,EACxG,2FAA2F,EAC3F,gJAAgJ,EAChJ,8JAA8J,CAC/J,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF;IAED;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,4EAA4E;YAC5E,gGAAgG;QAClG,UAAU,EAAE;YACV,aAAa,EAAE,CAAC;iBACb,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4FAA4F,CAAC;YACzG,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yCAAyC;gBACvC,wBAAwB;gBACxB,sEAAsE,CACzE;SACJ;QACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,aAAa,IAAI,IAAI,CAAC;YACtC,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kCAAkC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAa;gBACtB,4DAA4D,OAAO,mBAAmB;gBACtF,EAAE;aACH,CAAC;YACF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,kDAAkD,OAAO,8DAA8D,EACvH,4CAA4C,EAC5C,4DAA4D,EAC5D,QAAQ,KAAK,EAAE,EACf,4FAA4F,EAC5F,8DAA8D,EAC9D,0HAA0H,EAC1H,0CAA0C,EAC1C,yKAAyK,EACzK,0EAA0E,EAC1E,oLAAoL,EACpL,4CAA4C,EAC5C,8DAA8D,EAC9D,8DAA8D,EAC9D,iGAAiG,CAClG,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,2FAA2F;YAC3F,4GAA4G;QAC9G,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kCAAkC;gBAChC,wBAAwB;gBACxB,sEAAsE,CACzE;YACH,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,0EAA0E,GAAG,sBAAsB,CAAC;YAChH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;SAC3G;QACD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC;YAC1B,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;gBAC5D,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kCAAkC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,uDAAuD,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,iEAAiE,EACjE,QAAQ,KAAK,EAAE,EACf,+HAA+H,EAC/H,yCAAyC,EACzC,0KAA0K,EAC1K,+JAA+J,EAC/J,yBAAyB,EACzB,cAAc,GAAG,2DAA2D,EAC5E,iFAAiF,EACjF,4FAA4F,EAC5F,8KAA8K,EAC9K,8HAA8H,EAC9H,8BAA8B,EAC9B,YAAY,GAAG,wEAAwE,EACvF,uGAAuG,EACvG,2BAA2B,EAC3B,uFAAuF,CACxF,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,8CAA8C;QACrD,WAAW,EACT,oGAAoG;YACpG,uFAAuF;QACzF,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4FAA4F,CAAC;YACzG,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kCAAkC;gBAChC,wBAAwB;gBACxB,sEAAsE,CACzE;SACJ;QACD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC;YACjC,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kCAAkC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAa;gBACtB,+EAA+E,KAAK,SAAS;gBAC7F,EAAE;aACH,CAAC;YACF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,iEAAiE,EACjE,QAAQ,KAAK,EAAE,EACf,4FAA4F,EAC5F,8CAA8C,EAC9C,sGAAsG,EACtG,wCAAwC,EACxC,4CAA4C,EAC5C,gDAAgD,EAChD,uCAAuC,EACvC,mGAAmG,EACnG,6CAA6C,KAAK,WAAW,EAC7D,6BAA6B,EAC7B,qDAAqD,EACrD,oCAAoC,EACpC,oMAAoM,EACpM,gNAAgN,EAChN,+GAA+G,CAChH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EACT,oGAAoG;YACpG,sHAAsH;QACxH,UAAU,EAAE;YACV,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CAAC,iGAAiG,CAAC;YAC9G,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,sHAAsH,CACvH;YACH,iBAAiB,EAAE,CAAC;iBACjB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,mHAAmH,CACpH;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yDAAyD;gBACvD,wBAAwB;gBACxB,wDAAwD,CAC3D;SACJ;QACD,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,EAAE;YACrF,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;YAC/E,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,WAAmB,CAAC;YACxB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,WAAW,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;gBAC1D,KAAK,GAAG,WAAW,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,iFAAiF,CAAC;gBAC1F,WAAW,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,6CAA6C,WAAW,4CAA4C;gBACtG,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,cAAc;gBAC5B,CAAC,CAAC,uCAAuC,cAAc,mGAAmG;gBAC1J,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAa,CAAC,yDAAyD,WAAW,KAAK,EAAE,EAAE,CAAC,CAAC;YACxG,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,+BAA+B,KAAK,GAAG,EACvC,kCAAkC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EACtE,EAAE,EACF,UAAU,EACV,mDAAmD,EACnD,mFAAmF,EACnF,gGAAgG,EAChG,gHAAgH,EAChH,OAAO,EACP,0EAA0E,EAC1E,gIAAgI,EAChI,6CAA6C,EAC7C,cAAc,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,EACvE,SAAS,EACT,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EACxC,8EAA8E,EAC9E,qBAAqB,EACrB,iBAAiB;gBACf,CAAC,CAAC,sKAAsK;gBACxK,CAAC,CAAC,wDAAwD,EAC5D,4KAA4K,EAC5K,+MAA+M,EAC/M,sKAAsK,CACvK,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF;IAED;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,mIAAmI;QACrI,UAAU,EAAE;YACV,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sFAAsF,CAAC;SACpG;QACD,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACrB,MAAM,WAAW,GAAG,OAAO,IAAI,eAAe,CAAC;YAC/C,OAAO;gBACL,0BAA0B,WAAW,GAAG;gBACxC,EAAE;gBACF,UAAU;gBACV,4DAA4D;gBAC5D,mBAAmB;gBACnB,wJAAwJ;gBACxJ,8FAA8F;gBAC9F,+FAA+F;gBAC/F,oIAAoI;gBACpI,iIAAiI;gBACjI,8BAA8B;gBAC9B,mFAAmF;gBACnF,wEAAwE;gBACxE,0FAA0F;gBAC1F,2FAA2F;aAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,cAAc,CACnB,CAAC,CAAC,IAAI,EACN;YACE,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC,CAAC,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;CACnC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAqB,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC;CAChF,CAAC,CAAC;AA8BH,MAAM,mBAAmB,GAA+B;IACtD,QAAQ,EAAE,wBAAwB;IAClC,OAAO,EAAE,wBAAwB;IACjC,WAAW,EAAE,4BAA4B;IACzC,MAAM,EAAE,uBAAuB;CAChC,CAAC;AAEF,MAAM,aAAa,GAA+B;IAChD,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAE,QAAQ;CACjB,CAAC;AASF,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,IAAgB,EAAE,WAAmB,EAAY,EAAE;IACvF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG;QACf,kCAAkC,KAAK,UAAU,OAAO,+BAA+B;QACvF,eAAe,IAAI,wBAAwB,OAAO,yBAAyB;QAC3E,0EAA0E,WAAW,kDAAkD;QACvI,+FAA+F;QAC/F,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAC5B,sHAAsH,CAAC;AACzH,MAAM,uBAAuB,GAC3B,wGAAwG,CAAC;AAC3G,MAAM,2BAA2B,GAC/B,mHAAmH,CAAC;AACtH,MAAM,sBAAsB,GAC1B,qGAAqG,CAAC;AAExG,MAAM,CAAC,MAAM,OAAO,GAAuB;IACzC;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,mFAAmF;YACnF,sEAAsE;QACxE,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,iBAAiB;gBACf,wBAAwB;gBACxB,oFAAoF,CACvF;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qFAAqF,CAAC;SACnG;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,OAAO,IAAI,kBAAkB,CAAC;YAClD,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,WAAmB,CAAC;YACxB,IAAI,YAAoB,CAAC;YACzB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC;gBAC7B,WAAW,GAAG,gCAAgC,YAAY,KAAK,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,cAAc,CAAC;gBAC9B,WAAW;oBACT,8HAA8H,CAAC;YACnI,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,yCAAyC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,WAAW,EACX,EAAE,EACF,UAAU,EACV,6FAA6F,YAAY,sKAAsK,EAC/Q,8DAA8D,EAC9D,+DAA+D,EAC/D,qEAAqE,EACrE,gFAAgF,EAChF,qHAAqH,EACrH,iHAAiH,CAClH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,oFAAoF;YACpF,qDAAqD;QACvD,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACjE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAC7D,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,oBAAoB;gBAClB,wBAAwB;gBACxB,uFAAuF,CAC1F;SACJ;QACD,OAAO,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;QACzC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC9C,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,WAAmB,CAAC;YACxB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,WAAW,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,iDAAiD,CAAC;YAClE,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,sDAAsD,UAAU,OAAO,QAAQ,GAAG,EAAE,EAAE,CAAC,CAAC;YACjH,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,WAAW,GAAG,EAC7B,EAAE,EACF,UAAU,EACV,gDAAgD,EAChD,gCAAgC,EAChC,sBAAsB,UAAU,oBAAoB,QAAQ,KAAK,EACjE,QAAQ,WAAW,EAAE,EACrB,sBAAsB,EACtB,kDAAkD,EAClD,8IAA8I,EAC9I,gBAAgB,EAChB,4CAA4C,EAC5C,iEAAiE,EACjE,mEAAmE,EACnE,+GAA+G,CAChH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,qFAAqF;YACrF,uDAAuD;QACzD,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,GAAG,uBAAuB,CAAC;SAC1E;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;QACpC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YACxB,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,UAAkB,CAAC;YACvB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;gBAC/D,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,UAAU,GAAG,sBAAsB,CAAC,CAAC,WAAW,KAAK,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,qEAAqE,CAAC;YACrF,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,4EAA4E,EAAE,EAAE,CAAC,CAAC;YAC3G,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,UAAU,EACV,sCAAsC,EACtC,UAAU,EACV,sBAAsB,EACtB,8JAA8J,EAC9J,sJAAsJ,EACtJ,sIAAsI,EACtI,qLAAqL,EACrL,wCAAwC,CACzC,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,yGAAyG;QAC3G,UAAU,EAAE;YACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,GAAG,2BAA2B,CAAC;SAC9F;QACD,OAAO,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC;QACvD,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;YAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,cAAc,IAAI,EAAE,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YAC7B,MAAM,KAAK,GAAa,CAAC,sDAAsD,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CACR,UAAU,EACV,2EAA2E,MAAM,kEAAkE,EACnJ,iIAAiI,EACjI,6CAA6C,EAC7C,6JAA6J,EAC7J,sCAAsC,EACtC,uCAAuC,EACvC,mHAAmH,EACnH,uHAAuH,EACvH,qBAAqB,EACrB,sHAAsH,EACtH,2GAA2G,CAC5G,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE,4FAA4F;QACzG,UAAU,EAAE;YACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,GAAG,wBAAwB,CAAC;SAClF;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,aAAa,CAAC,WAAW,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YAC5B,MAAM,KAAK,GAAa,CAAC,6CAA6C,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CACR,mDAAmD,EACnD,wCAAwC,KAAK,kCAAkC,EAC/E,2CAA2C,KAAK,6CAA6C,EAC7F,2CAA2C,KAAK,uDAAuD,EACvG,yCAAyC,KAAK,8CAA8C,EAC5F,qCAAqC,KAAK,gCAAgC,EAC1E,6CAA6C,KAAK,6CAA6C,EAC/F,0CAA0C,KAAK,gCAAgC,EAC/E,EAAE,EACF,wRAAwR,CACzR,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,0CAA0C;QACjD,WAAW,EACT,yFAAyF;YACzF,sEAAsE;YACtE,0FAA0F;QAC5F,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;YACzE,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yHAAyH,CAC1H;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yCAAyC;gBACvC,wBAAwB;gBACxB,sEAAsE,CACzE;SACJ;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE;YAC3D,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,yDAAyD,CAAC;YACpE,CAAC;YACD,MAAM,UAAU,GAAG,WAAW;gBAC5B,CAAC,CAAC,+BAA+B,WAAW,2HAA2H;gBACvK,CAAC,CAAC,uEAAuE,CAAC;YAC5E,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,2HAA2H;gBAC7H,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAa;gBACtB,wEAAwE,UAAU,OAAO,QAAQ,GAAG;gBACpG,EAAE;aACH,CAAC;YACF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,UAAU,EACV,4CAA4C,EAC5C,+CAA+C,UAAU,oBAAoB,QAAQ,KAAK,EAC1F,QAAQ,KAAK,EAAE,EACf,SAAS,EACT,iJAAiJ,EACjJ,6DAA6D,EAC7D,iEAAiE,EACjE,wGAAwG,EACxG,2FAA2F,EAC3F,gJAAgJ,EAChJ,8JAA8J,CAC/J,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF;IAED;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,4EAA4E;YAC5E,gGAAgG;QAClG,UAAU,EAAE;YACV,aAAa,EAAE,CAAC;iBACb,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4FAA4F,CAAC;YACzG,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yCAAyC;gBACvC,wBAAwB;gBACxB,sEAAsE,CACzE;SACJ;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,aAAa,IAAI,IAAI,CAAC;YACtC,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kCAAkC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAa;gBACtB,4DAA4D,OAAO,mBAAmB;gBACtF,EAAE;aACH,CAAC;YACF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,kDAAkD,OAAO,8DAA8D,EACvH,4CAA4C,EAC5C,4DAA4D,EAC5D,QAAQ,KAAK,EAAE,EACf,4FAA4F,EAC5F,8DAA8D,EAC9D,0HAA0H,EAC1H,0CAA0C,EAC1C,yKAAyK,EACzK,0EAA0E,EAC1E,oLAAoL,EACpL,4CAA4C,EAC5C,8DAA8D,EAC9D,8DAA8D,EAC9D,iGAAiG,CAClG,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,2FAA2F;YAC3F,4GAA4G;QAC9G,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kCAAkC;gBAChC,wBAAwB;gBACxB,sEAAsE,CACzE;YACH,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,0EAA0E,GAAG,sBAAsB,CAAC;YAChH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;SAC3G;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC;QACtD,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC;YAC1B,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;gBAC5D,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kCAAkC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,uDAAuD,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,iEAAiE,EACjE,QAAQ,KAAK,EAAE,EACf,+HAA+H,EAC/H,yCAAyC,EACzC,0KAA0K,EAC1K,+JAA+J,EAC/J,yBAAyB,EACzB,cAAc,GAAG,2DAA2D,EAC5E,iFAAiF,EACjF,4FAA4F,EAC5F,8KAA8K,EAC9K,8HAA8H,EAC9H,8BAA8B,EAC9B,YAAY,GAAG,wEAAwE,EACvF,uGAAuG,EACvG,2BAA2B,EAC3B,uFAAuF,CACxF,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,8CAA8C;QACrD,WAAW,EACT,oGAAoG;YACpG,uFAAuF;QACzF,UAAU,EAAE;YACV,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4FAA4F,CAAC;YACzG,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kCAAkC;gBAChC,wBAAwB;gBACxB,sEAAsE,CACzE;SACJ;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC;YACjC,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kCAAkC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAa;gBACtB,+EAA+E,KAAK,SAAS;gBAC7F,EAAE;aACH,CAAC;YACF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,GAAG,EACvB,EAAE,EACF,UAAU,EACV,iEAAiE,EACjE,QAAQ,KAAK,EAAE,EACf,4FAA4F,EAC5F,8CAA8C,EAC9C,sGAAsG,EACtG,wCAAwC,EACxC,4CAA4C,EAC5C,gDAAgD,EAChD,uCAAuC,EACvC,mGAAmG,EACnG,6CAA6C,KAAK,WAAW,EAC7D,6BAA6B,EAC7B,qDAAqD,EACrD,oCAAoC,EACpC,oMAAoM,EACpM,gNAAgN,EAChN,+GAA+G,CAChH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF;IAED;QACE,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EACT,oGAAoG;YACpG,sHAAsH;QACxH,UAAU,EAAE;YACV,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CAAC,iGAAiG,CAAC;YAC9G,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,sHAAsH,CACvH;YACH,iBAAiB,EAAE,CAAC;iBACjB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,mHAAmH,CACpH;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,yDAAyD;gBACvD,wBAAwB;gBACxB,wDAAwD,CAC3D;SACJ;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC;QACnD,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,EAAE;YACrF,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;YAC/E,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,WAAmB,CAAC;YACxB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;gBAChE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,WAAW,GAAG,yBAAyB,CAAC,CAAC,WAAW,KAAK,CAAC;gBAC1D,KAAK,GAAG,WAAW,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,iFAAiF,CAAC;gBAC1F,WAAW,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,6CAA6C,WAAW,4CAA4C;gBACtG,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,cAAc;gBAC5B,CAAC,CAAC,uCAAuC,cAAc,mGAAmG;gBAC1J,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAa,CAAC,yDAAyD,WAAW,KAAK,EAAE,EAAE,CAAC,CAAC;YACxG,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,+BAA+B,KAAK,GAAG,EACvC,kCAAkC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EACtE,EAAE,EACF,UAAU,EACV,mDAAmD,EACnD,mFAAmF,EACnF,gGAAgG,EAChG,gHAAgH,EAChH,OAAO,EACP,0EAA0E,EAC1E,gIAAgI,EAChI,6CAA6C,EAC7C,cAAc,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,EACvE,SAAS,EACT,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EACxC,8EAA8E,EAC9E,qBAAqB,EACrB,iBAAiB;gBACf,CAAC,CAAC,sKAAsK;gBACxK,CAAC,CAAC,wDAAwD,EAC5D,4KAA4K,EAC5K,+MAA+M,EAC/M,sKAAsK,CACvK,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF;IAED;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,mIAAmI;QACrI,UAAU,EAAE;YACV,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sFAAsF,CAAC;SACpG;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,CAAC;QAClE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACrB,MAAM,WAAW,GAAG,OAAO,IAAI,eAAe,CAAC;YAC/C,OAAO;gBACL,0BAA0B,WAAW,GAAG;gBACxC,EAAE;gBACF,UAAU;gBACV,4DAA4D;gBAC5D,mBAAmB;gBACnB,wJAAwJ;gBACxJ,8FAA8F;gBAC9F,+FAA+F;gBAC/F,oIAAoI;gBACpI,iIAAiI;gBACjI,8BAA8B;gBAC9B,mFAAmF;gBACnF,wEAAwE;gBACxE,0FAA0F;gBAC1F,2FAA2F;aAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAqB;IACzE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5E,MAAM,CAAC,cAAc,CACnB,CAAC,CAAC,IAAI,EACN;YACE,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC,CAAC,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;CACnC,CAAC,CAAC,CAAC"}

package/dist/schemas/index.d.ts

@@ -25,9 +25,9 @@ export declare const ResourceSearchSchema: z.ZodObject<{
     perimeterPoles: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterBusinessUnits: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterDynamic: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        data: "data";
         agencies: "agencies";
         poles: "poles";
+        data: "data";
         businessUnits: "businessUnits";
         managers: "managers";
     }>>>;
@@ -86,9 +86,9 @@ export declare const CandidateSearchSchema: z.ZodObject<{
     perimeterPoles: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterBusinessUnits: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterDynamic: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        data: "data";
         agencies: "agencies";
         poles: "poles";
+        data: "data";
         businessUnits: "businessUnits";
         managers: "managers";
     }>>>;
@@ -149,9 +149,9 @@ export declare const ContactSearchSchema: z.ZodObject<{
     perimeterPoles: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterBusinessUnits: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterDynamic: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        data: "data";
         agencies: "agencies";
         poles: "poles";
+        data: "data";
         businessUnits: "businessUnits";
         managers: "managers";
     }>>>;
@@ -196,9 +196,9 @@ export declare const CompanySearchSchema: z.ZodObject<{
     perimeterPoles: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterBusinessUnits: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterDynamic: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        data: "data";
         agencies: "agencies";
         poles: "poles";
+        data: "data";
         businessUnits: "businessUnits";
         managers: "managers";
     }>>>;
@@ -231,9 +231,9 @@ export declare const OpportunitySearchSchema: z.ZodObject<{
     perimeterPoles: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterBusinessUnits: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterDynamic: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        data: "data";
         agencies: "agencies";
         poles: "poles";
+        data: "data";
         businessUnits: "businessUnits";
         managers: "managers";
     }>>>;
@@ -275,9 +275,9 @@ export declare const ProjectSearchSchema: z.ZodObject<{
     perimeterPoles: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterBusinessUnits: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     perimeterDynamic: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        data: "data";
         agencies: "agencies";
         poles: "poles";
+        data: "data";
         businessUnits: "businessUnits";
         managers: "managers";
     }>>>;

package/dist/server.d.ts

@@ -1,6 +1,34 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DomainName } from "./constants.js";
+import { type AccessPolicy } from "./config/access-policy.js";
+export { REGISTERED_DOMAINS } from "./constants.js";
+export type { DomainName } from "./constants.js";
 export declare const SERVER_NAME = "boondmanager-mcp-server";
 export declare const SERVER_VERSION: string;
-export declare const REGISTERED_DOMAINS: readonly ["candidates", "resources", "contacts", "companies", "opportunities", "actions", "timesheets", "projects", "invoices", "orders", "deliveries", "absences", "expenses", "products", "positionings", "payments", "advantages", "application", "contracts", "purchases", "provider-invoices", "accounts", "agencies", "business-units", "roles", "logs", "notifications", "threads", "todolists", "flags", "calendars", "webhooks", "validations", "poles", "reporting", "planning-absences", "workflows"];
+/**
+ * Domain → registration function, in the canonical order of REGISTERED_DOMAINS.
+ * Coupling the domain name to its registrar lets the access policy filter by
+ * domain WITHOUT parsing tool names (no fragile regex on multi-word domains
+ * like `provider-invoices`). Each registrar accepts an optional policy; only
+ * `registerWorkflowTools` uses it (to mirror the prompt-level domain filter),
+ * the others ignore the extra argument.
+ *
+ * Exported so the TOOLS.md generator can reuse the exact same list/order
+ * instead of duplicating it.
+ */
+export declare const TOOL_REGISTRARS: ReadonlyArray<readonly [DomainName, (server: McpServer, policy?: AccessPolicy) => void]>;
+/**
+ * Register the full (policy-filtered) tool/prompt/resource surface onto a
+ * server. Extracted from createMcpServer so tests can exercise the exact same
+ * wiring against a stub server with an arbitrary policy.
+ *
+ * - `target` is either the server itself (no operation filter) or a Proxy that
+ *   drops disallowed-operation tools at registration time.
+ * - Tool domains are skipped wholesale when the domain is disallowed.
+ * - Prompts are domain-filtered (a prompt is cut if any domain it orchestrates
+ *   is disallowed, so the runbook never points at missing tools).
+ * - Resources (reference dictionaries) are left intact (the lookup substrate).
+ */
+export declare function registerAll(server: McpServer, policy: AccessPolicy): void;
 export declare function createMcpServer(): McpServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA2CpE,eAAO,MAAM,WAAW,4BAA4B,CAAC;AAwBrD,eAAO,MAAM,cAAc,QAAuB,CAAC;AAEnD,eAAO,MAAM,kBAAkB,kfAsCrB,CAAC;AAEX,wBAAgB,eAAe,IAAI,SAAS,CAgD3C"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0CpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAoD,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGhH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,eAAO,MAAM,WAAW,4BAA4B,CAAC;AAwBrD,eAAO,MAAM,cAAc,QAAuB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC,CAuClH,CAAC;AAEJ;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAiBzE;AAED,wBAAgB,eAAe,IAAI,SAAS,CAU3C"}

package/dist/server.js

@@ -5,6 +5,9 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { registerCandidateTools, registerResourceTools, registerContactTools, registerCompanyTools, registerOpportunityTools, registerActionTools, registerTimesheetTools, registerProjectTools, registerInvoiceTools, registerOrderTools, registerDeliveryTools, registerAbsenceTools, registerExpenseTools, registerProductTools, registerPositioningTools, registerPaymentTools, registerAdvantageTools, registerApplicationTools, registerContractTools, registerPurchaseTools, registerProviderInvoiceTools, registerAccountTools, registerAgencyTools, registerBusinessUnitTools, registerRoleTools, registerLogTools, registerNotificationTools, registerThreadTools, registerTodolistTools, registerFlagTools, registerCalendarTools, registerWebhookTools, registerValidationTools, registerPoleTools, registerReportingTools, registerPlanningAbsenceTools, registerWorkflowTools, } from "./tools/index.js";
 import { registerAllPrompts } from "./prompts/index.js";
 import { registerAllResources } from "./resources/index.js";
+import { resolveAccessPolicy, isDomainAllowed, withPolicy } from "./config/access-policy.js";
+// Re-exported for the catalogue generator and tests that import it from here.
+export { REGISTERED_DOMAINS } from "./constants.js";
 export const SERVER_NAME = "boondmanager-mcp-server";
 /**
  * Read the package version from `package.json` so the value advertised over
@@ -30,89 +33,92 @@ function readPackageVersion() {
     return "0.0.0-unknown";
 }
 export const SERVER_VERSION = readPackageVersion();
-export const REGISTERED_DOMAINS = [
-    "candidates",
-    "resources",
-    "contacts",
-    "companies",
-    "opportunities",
-    "actions",
-    "timesheets",
-    "projects",
-    "invoices",
-    "orders",
-    "deliveries",
-    "absences",
-    "expenses",
-    "products",
-    "positionings",
-    "payments",
-    "advantages",
-    "application",
-    "contracts",
-    "purchases",
-    "provider-invoices",
-    "accounts",
-    "agencies",
-    "business-units",
-    "roles",
-    "logs",
-    "notifications",
-    "threads",
-    "todolists",
-    "flags",
-    "calendars",
-    "webhooks",
-    "validations",
-    "poles",
-    "reporting",
-    "planning-absences",
-    "workflows",
+/**
+ * Domain → registration function, in the canonical order of REGISTERED_DOMAINS.
+ * Coupling the domain name to its registrar lets the access policy filter by
+ * domain WITHOUT parsing tool names (no fragile regex on multi-word domains
+ * like `provider-invoices`). Each registrar accepts an optional policy; only
+ * `registerWorkflowTools` uses it (to mirror the prompt-level domain filter),
+ * the others ignore the extra argument.
+ *
+ * Exported so the TOOLS.md generator can reuse the exact same list/order
+ * instead of duplicating it.
+ */
+export const TOOL_REGISTRARS = [
+    ["candidates", registerCandidateTools],
+    ["resources", registerResourceTools],
+    ["contacts", registerContactTools],
+    ["companies", registerCompanyTools],
+    ["opportunities", registerOpportunityTools],
+    ["actions", registerActionTools],
+    ["timesheets", registerTimesheetTools],
+    ["projects", registerProjectTools],
+    ["invoices", registerInvoiceTools],
+    ["orders", registerOrderTools],
+    ["deliveries", registerDeliveryTools],
+    ["absences", registerAbsenceTools],
+    ["expenses", registerExpenseTools],
+    ["products", registerProductTools],
+    ["positionings", registerPositioningTools],
+    ["payments", registerPaymentTools],
+    ["advantages", registerAdvantageTools],
+    ["application", registerApplicationTools],
+    ["contracts", registerContractTools],
+    ["purchases", registerPurchaseTools],
+    ["provider-invoices", registerProviderInvoiceTools],
+    ["accounts", registerAccountTools],
+    ["agencies", registerAgencyTools],
+    ["business-units", registerBusinessUnitTools],
+    ["roles", registerRoleTools],
+    ["logs", registerLogTools],
+    ["notifications", registerNotificationTools],
+    ["threads", registerThreadTools],
+    ["todolists", registerTodolistTools],
+    ["flags", registerFlagTools],
+    ["calendars", registerCalendarTools],
+    ["webhooks", registerWebhookTools],
+    ["validations", registerValidationTools],
+    ["poles", registerPoleTools],
+    ["reporting", registerReportingTools],
+    ["planning-absences", registerPlanningAbsenceTools],
+    ["workflows", registerWorkflowTools],
 ];
+/**
+ * Register the full (policy-filtered) tool/prompt/resource surface onto a
+ * server. Extracted from createMcpServer so tests can exercise the exact same
+ * wiring against a stub server with an arbitrary policy.
+ *
+ * - `target` is either the server itself (no operation filter) or a Proxy that
+ *   drops disallowed-operation tools at registration time.
+ * - Tool domains are skipped wholesale when the domain is disallowed.
+ * - Prompts are domain-filtered (a prompt is cut if any domain it orchestrates
+ *   is disallowed, so the runbook never points at missing tools).
+ * - Resources (reference dictionaries) are left intact (the lookup substrate).
+ */
+export function registerAll(server, policy) {
+    const target = withPolicy(server, policy);
+    for (const [domain, register] of TOOL_REGISTRARS) {
+        // `workflows` is the tool-form mirror of the MCP prompts (1:1). It is
+        // therefore gated like the prompts themselves: each workflow tool is kept
+        // only when its source prompt's domains are all allowed (that per-prompt
+        // filter lives inside registerWorkflowTools), and is NOT subject to
+        // allow-list membership, so a prompt and its mirror tool always appear or
+        // disappear together. An explicit deny (`BOOND_MCP_EXCLUDE_DOMAINS=workflows`)
+        // still suppresses the whole tool-form mirror (e.g. "prompts only").
+        const allowed = domain === "workflows" ? !policy.excludedDomains.has("workflows") : isDomainAllowed(policy, domain);
+        if (allowed)
+            register(target, policy);
+    }
+    registerAllPrompts(target, policy);
+    registerAllResources(target);
+}
 export function createMcpServer() {
     const server = new McpServer({
         name: SERVER_NAME,
         version: SERVER_VERSION,
     });
-    registerCandidateTools(server);
-    registerResourceTools(server);
-    registerContactTools(server);
-    registerCompanyTools(server);
-    registerOpportunityTools(server);
-    registerActionTools(server);
-    registerTimesheetTools(server);
-    registerProjectTools(server);
-    registerInvoiceTools(server);
-    registerOrderTools(server);
-    registerDeliveryTools(server);
-    registerAbsenceTools(server);
-    registerExpenseTools(server);
-    registerProductTools(server);
-    registerPositioningTools(server);
-    registerPaymentTools(server);
-    registerAdvantageTools(server);
-    registerApplicationTools(server);
-    registerContractTools(server);
-    registerPurchaseTools(server);
-    registerProviderInvoiceTools(server);
-    registerAccountTools(server);
-    registerAgencyTools(server);
-    registerBusinessUnitTools(server);
-    registerRoleTools(server);
-    registerLogTools(server);
-    registerNotificationTools(server);
-    registerThreadTools(server);
-    registerTodolistTools(server);
-    registerFlagTools(server);
-    registerCalendarTools(server);
-    registerWebhookTools(server);
-    registerValidationTools(server);
-    registerPoleTools(server);
-    registerReportingTools(server);
-    registerPlanningAbsenceTools(server);
-    registerWorkflowTools(server);
-    registerAllPrompts(server);
-    registerAllResources(server);
+    // Operator-configured restrictions (env-driven). Absent config = full surface.
+    registerAll(server, resolveAccessPolicy());
     return server;
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD;;;;;;;;GAQG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0B,CAAC;QAC/E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sDAAsD;IACxD,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,UAAU;IACV,WAAW;IACX,eAAe;IACf,SAAS;IACT,YAAY;IACZ,UAAU;IACV,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,cAAc;IACd,UAAU;IACV,YAAY;IACZ,aAAa;IACb,WAAW;IACX,WAAW;IACX,mBAAmB;IACnB,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,aAAa;IACb,OAAO;IACP,WAAW;IACX,mBAAmB;IACnB,WAAW;CACH,CAAC;AAEX,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE7B,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAqB,MAAM,2BAA2B,CAAC;AAEhH,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD;;;;;;;;GAQG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0B,CAAC;QAC/E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sDAAsD;IACxD,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B;IACE,CAAC,YAAY,EAAE,sBAAsB,CAAC;IACtC,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACpC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,WAAW,EAAE,oBAAoB,CAAC;IACnC,CAAC,eAAe,EAAE,wBAAwB,CAAC;IAC3C,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAChC,CAAC,YAAY,EAAE,sBAAsB,CAAC;IACtC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAC9B,CAAC,YAAY,EAAE,qBAAqB,CAAC;IACrC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAC1C,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,YAAY,EAAE,sBAAsB,CAAC;IACtC,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACzC,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACpC,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACpC,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IACnD,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACjC,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAC7C,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC5B,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAC1B,CAAC,eAAe,EAAE,yBAAyB,CAAC;IAC5C,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAChC,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACpC,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC5B,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACpC,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAClC,CAAC,aAAa,EAAE,uBAAuB,CAAC;IACxC,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC5B,CAAC,WAAW,EAAE,sBAAsB,CAAC;IACrC,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IACnD,CAAC,WAAW,EAAE,qBAAqB,CAAC;CACrC,CAAC;AAEJ;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,MAAoB;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC;QACjD,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpH,IAAI,OAAO;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,+EAA+E;IAC/E,WAAW,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tools/workflows.d.ts

@@ -1,4 +1,5 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type AccessPolicy } from "../config/access-policy.js";
 /**
  * Workflow tools — same runbooks as the MCP prompts in `src/prompts/index.ts`,
  * but exposed via `tools/list` instead of `prompts/list`.
@@ -17,5 +18,5 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  * Same args, same output. The runbook returned in the tool result is
  * exactly the text the prompt would have produced.
  */
-export declare function registerWorkflowTools(server: McpServer): void;
+export declare function registerWorkflowTools(server: McpServer, policy?: AccessPolicy): void;
 //# sourceMappingURL=workflows.d.ts.map

package/dist/tools/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/tools/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2B7D"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/tools/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CA+BpF"}

package/dist/tools/workflows.js

@@ -1,4 +1,5 @@
 import { PROMPTS } from "../prompts/index.js";
+import { isDomainAllowed } from "../config/access-policy.js";
 /**
  * Workflow tools — same runbooks as the MCP prompts in `src/prompts/index.ts`,
  * but exposed via `tools/list` instead of `prompts/list`.
@@ -17,8 +18,13 @@ import { PROMPTS } from "../prompts/index.js";
  * Same args, same output. The runbook returned in the tool result is
  * exactly the text the prompt would have produced.
  */
-export function registerWorkflowTools(server) {
+export function registerWorkflowTools(server, policy) {
     for (const p of PROMPTS) {
+        // Mirror the prompt-level domain filter: cut a workflow tool when any
+        // domain its source prompt orchestrates is filtered out (keeps the
+        // workflow tools and the MCP prompts perfectly in sync).
+        if (policy && !p.domains.every((d) => isDomainAllowed(policy, d)))
+            continue;
         server.registerTool(`boond_workflow_${p.name}`, {
             title: p.title,
             description: p.description +

package/dist/tools/workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/tools/workflows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,YAAY,CACjB,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAC1B;YACE,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EACT,CAAC,CAAC,WAAW;gBACb,wCAAwC,CAAC,CAAC,IAAI,KAAK;gBACnD,0FAA0F;gBAC1F,wGAAwG;YAC1G,WAAW,EAAE,CAAC,CAAC,UAAU;YACzB,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI;gBAClB,eAAe,EAAE,KAAK;gBACtB,cAAc,EAAE,IAAI;gBACpB,aAAa,EAAE,KAAK;aACrB;SACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,CAAuC,CAAC,CAAC;YAC3E,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/tools/workflows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAqB,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAqB;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,sEAAsE;QACtE,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5E,MAAM,CAAC,YAAY,CACjB,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAC1B;YACE,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EACT,CAAC,CAAC,WAAW;gBACb,wCAAwC,CAAC,CAAC,IAAI,KAAK;gBACnD,0FAA0F;gBAC1F,wGAAwG;YAC1G,WAAW,EAAE,CAAC,CAAC,UAAU;YACzB,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI;gBAClB,eAAe,EAAE,KAAK;gBACtB,cAAc,EAAE,IAAI;gBACpB,aAAa,EAAE,KAAK;aACrB;SACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,CAAuC,CAAC,CAAC;YAC3E,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "boondmanager-mcp-server",
   "display_name": "BoondManager MCP Server",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "MCP Server for BoondManager API - 167 tools, 11 prompts, 21 resources (ERP/CRM)",
   "author": {
     "name": "Frédéric Auguste",
@@ -29,7 +29,11 @@
         "BOOND_CLIENT_KEY": "${user_config.client_key}",
         "BOOND_API_TOKEN": "${user_config.api_token}",
         "BOOND_USER": "${user_config.user}",
-        "BOOND_PASSWORD": "${user_config.password}"
+        "BOOND_PASSWORD": "${user_config.password}",
+        "BOOND_MCP_DOMAINS": "${user_config.mcp_domains}",
+        "BOOND_MCP_EXCLUDE_DOMAINS": "${user_config.mcp_exclude_domains}",
+        "BOOND_MCP_OPERATIONS": "${user_config.mcp_operations}",
+        "BOOND_MCP_READ_ONLY": "${user_config.mcp_read_only}"
       }
     }
   },
@@ -81,6 +85,31 @@
       "description": "Mot de passe BoondManager pour l'authentification BasicAuth.",
       "sensitive": true,
       "required": false
+    },
+    "mcp_domains": {
+      "type": "string",
+      "title": "Restriction : domaines autorisés",
+      "description": "Liste blanche de domaines séparés par des virgules (ex: invoices,payments,application). Vide = tous les domaines. Voir docs/access-control.md.",
+      "required": false
+    },
+    "mcp_exclude_domains": {
+      "type": "string",
+      "title": "Restriction : domaines exclus",
+      "description": "Liste noire de domaines séparés par des virgules (ex: candidates,resources), appliquée après la liste blanche. Vide = aucune exclusion.",
+      "required": false
+    },
+    "mcp_operations": {
+      "type": "string",
+      "title": "Restriction : opérations autorisées",
+      "description": "Opérations autorisées séparées par des virgules parmi read,create,update,delete. Vide = toutes. Ignoré si 'Lecture seule' est activé.",
+      "required": false
+    },
+    "mcp_read_only": {
+      "type": "boolean",
+      "title": "Restriction : lecture seule",
+      "description": "Si activé, expose uniquement les outils de lecture (bloque création, modification et suppression). N'est pas une frontière de sécurité dure : les droits du compte BoondManager s'appliquent en plus.",
+      "default": false,
+      "required": false
     }
   },
   "tools_generated": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boondmanager-mcp-server",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "MCP Server for BoondManager API - 167 tools, 11 prompts, 21 resources (ERP/CRM)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",