boondmanager-mcp-server 2.16.0 → 2.17.0

package/README.md

@@ -31,7 +31,7 @@
 
 Serveur MCP (Model Context Protocol) pour l'API BoondManager, permettant a Claude (Desktop, Cowork, Code) de rechercher, consulter, creer et modifier des enregistrements dans votre instance BoondManager.
 
-**182 outils** couvrant **38 domaines** de l'API BoondManager. Voir [TOOLS.md](./TOOLS.md) pour le catalogue auto-généré (outils + prompts + ressources).
+**235 outils** couvrant **42 domaines** de l'API BoondManager. Voir [TOOLS.md](./TOOLS.md) pour le catalogue auto-généré (outils + prompts + ressources).
 
 > **Sorties structurées.** En plus du texte lisible, les outils `search`, `create`, `update` et `delete` renvoient un `structuredContent` conforme à un `outputSchema` MCP : `search` → `{ total?, count, items[] }` (résumés compacts, pas les ressources JSON:API complètes), `create`/`update` → `{ id?, type? }`, `delete` → `{ id, deleted, reason? }`. Les clients MCP qui exploitent les sorties structurées obtiennent une référence d'entité fiable pour chaîner les appels. Les outils `get` restent en texte seul (leur texte est déjà du JSON exploitable).
 
@@ -133,8 +133,12 @@ Le serveur expose les dictionnaires de reference Boond comme **ressources MCP**
 | URI | Contenu |
 |-----|---------|
 | `boond://application/current-user` | Profil de l'utilisateur courant (id, agence, permissions) |
-| `boond://dictionary/states/{entity}` | Etats par entite : `resources`, `candidates`, `contacts`, `companies`, `opportunities`, `projects`, `invoices`, `orders`, `positionings`, `absences` |
-| `boond://dictionary/typeOf/{entity}` | Types par entite : `resources`, `candidates`, `contacts`, `projects`, `actions`, `absences` |
+| `boond://dictionary/states/{entity}` | Etats par entite : `resources`, `candidates`, `contacts`, `companies`, `opportunities`, `projects`, `invoices`, `orders`, `positionings`, `deliveries`, `payments`, `purchases`, `provider-invoices`, `products`, `quotations`, `probations` |
+| `boond://dictionary/typeOf/{entity}` | Types par entite : `resources`, `contacts`, `projects`, `contracts`, `deliveries`, `purchases`, `activities` |
+| `boond://dictionary/actions/{entity}` | Types d'action par entite de rattachement : `candidates`, `contacts`, `resources`, `opportunities`, `projects`, `invoices`, `orders` (le `typeOf` de `boond_actions_create`) |
+| `boond://dictionary/{sources,origins}` | Sources de candidature, origines d'opportunite |
+| `boond://dictionary/{paymentMethods,paymentTerms,taxRates,contractEndReasons}` | Parametres finance / RH utilises par les ecritures |
+| `boond://application/current-user/rights` | Niveau, agences / poles / BU, apps et droits par entite de l'utilisateur (vue condensee de `current-user`) |
 | `boond://dictionary/countries` | Liste des pays |
 | `boond://dictionary/currencies` | Liste des devises |
 | `boond://dictionary/languages` | Liste des langues |
@@ -515,6 +519,8 @@ Le serveur utilise [pino](https://getpino.io/) pour des logs structures JSON (ag
 
 En production (`NODE_ENV=production`), les logs sont en JSON par défaut. En dev, le format pretty (colorisé) est actif sauf si `LOG_FORMAT=json`. Chaque requête HTTP reçoit un `corrId` (8 hex) pour tracer la requête dans les logs.
 
+Les logs sont **toujours écrits sur stderr**, quel que soit le transport : en mode stdio, stdout est réservé au flux JSON-RPC et toute autre écriture corrompt la connexion côté client. Claude Desktop capture stderr dans son visualiseur de logs (Developer → Logs), c'est donc là que les avertissements (politique d'accès, mise à jour disponible, dictionnaires) sont visibles.
+
 ### Authentification
 
 **Option 1 : Token API JWT (recommande)**
@@ -528,6 +534,29 @@ export BOOND_USER="votre_login"
 export BOOND_PASSWORD="votre_mot_de_passe"
 ```
 
+### Transport HTTP en authentification statique (`BOOND_HTTP_STATIC_AUTH`)
+
+Par défaut, le transport HTTP (`MCP_TRANSPORT=http`) est une *ressource protégée OAuth2* : chaque requête MCP porte le token BoondManager de **son** utilisateur (voir [`docs/oauth.md`](docs/oauth.md)). `BOOND_HTTP_STATIC_AUTH=true` remplace ce modèle par les credentials d'environnement ci-dessus, partagés par toutes les requêtes — pour un déploiement mono-locataire auto-hébergé, un pipeline CI ou une passerelle interne sans flux OAuth.
+
+Dans ce mode, **plus rien n'authentifie le client MCP** : quiconque atteint le port agit avec les droits BoondManager de l'opérateur (lecture *et* écriture selon la politique d'accès). D'où :
+
+| Variable | Rôle |
+|----------|------|
+| `MCP_HTTP_API_KEY` | Secret partagé que le client doit présenter, en `Authorization: Bearer <clé>` ou `X-Api-Key: <clé>`. Comparaison en temps constant ; absente ou fausse → `401`. **Obligatoire** dès que le serveur n'écoute pas sur loopback (`0.0.0.0`, image Docker) : sinon il **refuse de démarrer**. |
+| `MCP_HTTP_INSECURE_STATIC_AUTH` | `1` pour accepter explicitement de démarrer sans clé hors loopback (réseau privé faisant office de frontière). Le nom dit ce qu'il fait. |
+
+```bash
+export MCP_TRANSPORT=http
+export MCP_HTTP_HOST=0.0.0.0
+export BOOND_HTTP_STATIC_AUTH=true
+export MCP_HTTP_API_KEY="$(openssl rand -hex 32)"
+export BOOND_USER_TOKEN=… BOOND_CLIENT_TOKEN=… BOOND_CLIENT_KEY=…
+npx boondmanager-mcp-server
+# côté client : Authorization: Bearer <MCP_HTTP_API_KEY>
+```
+
+`/healthz` reste accessible sans clé. En mode OAuth (défaut), `MCP_HTTP_API_KEY` est ignorée avec un avertissement : le Bearer y est le token BoondManager.
+
 ### URL personnalisee (si instance dediee)
 
 ```bash
@@ -569,6 +598,8 @@ Pour eviter qu'une boucle d'outils emballee n'inonde l'API (et n'enchaine les `4
 | `BOOND_HTTP_RATE_LIMIT_RPS` | `10` | Debit soutenu (requetes/seconde). `0` desactive completement. |
 | `BOOND_HTTP_RATE_LIMIT_BURST` | `20` | Capacite du bucket = taille maximale de rafale immediate. |
 
+En transport HTTP OAuth, le bucket est **par utilisateur** (identite derivee du Bearer) : la rafale d'un utilisateur ne ralentit pas les autres. En stdio et en static auth, une seule identite, donc un seul bucket — la limite est par identite, pas par processus.
+
 ### Cache du dictionnaire
 
 L'API BoondManager n'expose qu'un seul endpoint `/application/dictionary` qui renvoie l'intégralité des libellés (états, types, pays…). Le serveur le met en cache en mémoire pour éviter de le re-télécharger à chaque résolution état/type → libellé.
@@ -683,6 +714,7 @@ npx boondmanager-mcp-server
 | `MCP_HTTP_SESSION_SWEEP_INTERVAL_MS` | `300000` (5 min) | Frequence de balayage des sessions inactives. |
 | `MCP_HTTP_ALLOWED_HOSTS` | _(auto)_ | Liste blanche du header `Host` (anti DNS rebinding, CVE-2025-66414). `*` pour desactiver explicitement. |
 | `MCP_HTTP_ALLOWED_ORIGINS` | _(auto)_ | Liste blanche du header `Origin` (scheme + host + port) pour les clients navigateur ; un `Origin` hors liste recoit un `403` (exigence spec 2025-11-25). Defaut quand le serveur ecoute en loopback = **toute origine loopback, quel que soit le port** (`http`/`https` sur `localhost` / `127.0.0.1` / `[::1]`) plus l'origine de `MCP_HTTP_PUBLIC_URL` si elle est definie — MCP Inspector (`:6274`) ou un serveur de dev (`:5173`) fonctionnent sans configuration, et une origine distante recoit toujours un `403`. Validation desactivee sinon. Une liste explicite est en revanche comparee a l'identique (port compris). **Une requete sans `Origin` est toujours acceptee** (curl, gateways, clients MCP non-navigateur), et le document de decouverte `/.well-known/oauth-protected-resource` est exempte. `*` pour desactiver explicitement ; une valeur vide n'est pas une desactivation. |
+| `MCP_HTTP_VALIDATE_TOKEN` | `false` | Mode OAuth : valide chaque Bearer aupres de BoondManager (`GET /application/current-user`, mis en cache par token pendant `MCP_HTTP_TOKEN_VALIDATION_TTL_MS`, 60 s par defaut) **avant** de traiter la requete. Un token expire ou revoque recoit un `401` + `WWW-Authenticate: … error="invalid_token"`, ce que les clients MCP conformes transforment en nouvelle autorisation — sans l'option, le 401 n'apparait que dans le resultat d'un appel d'outil, d'ou aucun client ne relance l'OAuth. BoondManager injoignable → la requete passe (fail open). |
 
 **Variables OAuth2 — discovery (toutes optionnelles)**
 
@@ -900,7 +932,7 @@ sur leurs schemas (le SDK MCP convertit les schemas Zod avec `target: 'draft-7'`
 qui valide avec un validateur **2020-12 uniquement** refuse de compiler un tel schema.
 
 **Correctif : mettre a jour vers >= 2.12.2.** Depuis cette version le serveur n'annonce plus
-aucun dialecte (`src/schema-dialect.ts`), ce que la suite de tests verifie sur les 182 outils
+aucun dialecte (`src/schema-dialect.ts`), ce que la suite de tests verifie sur les 185 outils
 a travers un vrai client, sous validateur 2020-12 **et** draft-07.
 
 **Redemarrer le connecteur ne suffit pas** : un redemarrage relance le binaire installe, il ne le

package/dist/config/access-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AAuGD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAyDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}
+{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AA0FD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAyDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}

package/dist/config/access-policy.js

@@ -1,18 +1,10 @@
+import { readBool, readString } from "./env.js";
 import { REGISTERED_DOMAINS } from "../constants.js";
 import { logger } from "../services/logger.js";
 import { PROFILE_NAMES, resolveProfile } from "./profiles.js";
 export const ALL_OPERATIONS = ["read", "create", "update", "delete"];
 // --- Env parsing helpers (mirroring the patterns already used across the
 // codebase: see transports/http.ts, services/oauth.ts, services/update-checker.ts) ---
-function readEnv(env, key) {
-    const raw = env[key];
-    if (raw === undefined)
-        return undefined;
-    // Ignore unresolved placeholders like "${SOMETHING}" (same guard as http.ts).
-    if (raw.startsWith("${"))
-        return undefined;
-    return raw;
-}
 /** Split a CSV / whitespace-separated env value into trimmed, non-empty tokens. */
 function parseList(raw) {
     if (!raw)
@@ -22,10 +14,6 @@ function parseList(raw) {
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
 }
-function parseBoolean(raw) {
-    const v = (raw ?? "").toLowerCase().trim();
-    return v === "1" || v === "true" || v === "yes";
-}
 /** Normalise a user-supplied domain to the canonical (dash, lowercase) form. */
 function normalizeDomain(domain) {
     return domain.toLowerCase().trim().replace(/_/g, "-");
@@ -96,9 +84,9 @@ export function resolveAccessPolicy(env = process.env) {
     const log = logger.child({ component: "access-policy" });
     const known = new Set(REGISTERED_DOMAINS);
     // --- Domains ---
-    const allowItems = parseList(readEnv(env, "BOOND_MCP_DOMAINS"));
-    const profileItems = parseList(readEnv(env, "BOOND_MCP_PROFILE"));
-    const excludeItems = parseList(readEnv(env, "BOOND_MCP_EXCLUDE_DOMAINS"));
+    const allowItems = parseList(readString("BOOND_MCP_DOMAINS", env));
+    const profileItems = parseList(readString("BOOND_MCP_PROFILE", env));
+    const excludeItems = parseList(readString("BOOND_MCP_EXCLUDE_DOMAINS", env));
     // Explicit domains win over a profile bundle: the operator who listed
     // domains by hand is the one who knows exactly what they want exposed.
     const profileDomains = resolveProfileDomains(profileItems, log);
@@ -108,8 +96,8 @@ export function resolveAccessPolicy(env = process.env) {
     const allowedDomains = allowItems.length > 0 ? normalizeAndValidateDomains(allowItems, known, "BOOND_MCP_DOMAINS", log) : profileDomains;
     const excludedDomains = normalizeAndValidateDomains(excludeItems, known, "BOOND_MCP_EXCLUDE_DOMAINS", log);
     // --- Operations ---
-    const opItems = parseList(readEnv(env, "BOOND_MCP_OPERATIONS"));
-    const readOnlyShortcut = parseBoolean(readEnv(env, "BOOND_MCP_READ_ONLY"));
+    const opItems = parseList(readString("BOOND_MCP_OPERATIONS", env));
+    const readOnlyShortcut = readBool("BOOND_MCP_READ_ONLY", false, env);
     let operations;
     if (opItems.length > 0) {
         operations = validateOperations(opItems, log);

package/dist/config/access-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgC9D,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAe,EAAE,GAAkB;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EACpC,uCAAuC,GAAG,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE1E,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACpH,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAE3E,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgC9D,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAe,EAAE,GAAkB;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EACpC,uCAAuC,GAAG,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7E,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACpH,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAErE,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/config/dictionary-overrides.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dictionary-overrides.d.ts","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,eAAe,yEAA0E,CAAC;AAEvG,uEAAuE;AACvE,eAAO,MAAM,cAAc,0JAajB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjD,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1C;AA8CD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,GAAG,IAAI,CAuDxG;AASD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAMnE;AAED,wCAAwC;AACxC,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAaD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxG;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9F;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI3G"}
+{"version":3,"file":"dictionary-overrides.d.ts","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,eAAe,yEAA0E,CAAC;AAEvG,uEAAuE;AACvE,eAAO,MAAM,cAAc,0JAajB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjD,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1C;AAqCD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,GAAG,IAAI,CAuDxG;AASD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAMnE;AAED,wCAAwC;AACxC,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAaD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxG;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9F;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI3G"}

package/dist/config/dictionary-overrides.js

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { readString } from "./env.js";
 import { z } from "zod";
 import { logger } from "../services/logger.js";
 /**
@@ -51,17 +52,6 @@ const OverridesFileSchema = z
 })
     .strict();
 // --- Env parsing helper (mirroring config/access-policy.ts) ---
-function readEnv(env, key) {
-    const raw = env[key];
-    if (raw === undefined)
-        return undefined;
-    // Ignore unresolved placeholders like "${SOMETHING}" (same guard as http.ts).
-    if (raw.startsWith("${"))
-        return undefined;
-    if (raw.trim().length === 0)
-        return undefined;
-    return raw;
-}
 /** Keep only known entity keys; warn-and-ignore the rest (never fatal). */
 function filterKnownEntities(section, raw, known, log) {
     const out = {};
@@ -82,7 +72,7 @@ function filterKnownEntities(section, raw, known, log) {
  */
 export function loadDictionaryOverrides(env = process.env) {
     const log = logger.child({ component: "dictionary-overrides" });
-    const raw = readEnv(env, "BOOND_DICTIONARY_OVERRIDES");
+    const raw = readString("BOOND_DICTIONARY_OVERRIDES", env);
     if (raw === undefined)
         return null;
     // Inline JSON if the value starts with "{", otherwise a file path.

package/dist/config/dictionary-overrides.js.map

@@ -1 +1 @@
-{"version":3,"file":"dictionary-overrides.js","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAEvG,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,UAAU;IACV,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;CACD,CAAC;AAYX,gDAAgD;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iEAAiE;AAEjE,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,GAA6B,EAC7B,KAAwB,EACxB,GAAkB;IAElB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EACtC,uCAAuC,OAAO,YAAY,MAAM,WAAW,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,mEAAmE;IACnE,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxE,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,kEAAkE,CACnE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,uEAAuE,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAwB;QACrC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC;QACrF,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC;KAClF,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAI,CACN;QACE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5C,EACD,4EAA4E,CAC7E,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0CAA0C;AAC1C,8EAA8E;AAC9E,6CAA6C;AAE7C,IAAI,MAAM,GAA+B,IAAI,CAAC;AAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,gCAAgC;IAC9C,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,6BAA6B;AAE7B,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB,EAAE,MAAc;IAC3D,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwB,EAAE,MAAc,EAAE,KAAa;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAwB,EAAE,MAAc;IAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAwB,EAAE,MAAc;IACjG,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,GAAG,IAAI,iEAAiE,OAAO,EAAE,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"dictionary-overrides.js","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAEvG,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,UAAU;IACV,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;CACD,CAAC;AAYX,gDAAgD;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iEAAiE;AAEjE,2EAA2E;AAC3E,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,GAA6B,EAC7B,KAAwB,EACxB,GAAkB;IAElB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EACtC,uCAAuC,OAAO,YAAY,MAAM,WAAW,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,mEAAmE;IACnE,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxE,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,kEAAkE,CACnE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,uEAAuE,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAwB;QACrC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC;QACrF,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC;KAClF,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAI,CACN;QACE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5C,EACD,4EAA4E,CAC7E,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0CAA0C;AAC1C,8EAA8E;AAC9E,6CAA6C;AAE7C,IAAI,MAAM,GAA+B,IAAI,CAAC;AAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,gCAAgC;IAC9C,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,6BAA6B;AAE7B,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB,EAAE,MAAc;IAC3D,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwB,EAAE,MAAc,EAAE,KAAa;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAwB,EAAE,MAAc;IAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAwB,EAAE,MAAc;IACjG,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,GAAG,IAAI,iEAAiE,OAAO,EAAE,CAAC;AAC3F,CAAC"}

package/dist/config/env.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The one place configuration is read from the environment.
+ *
+ * Six readers used to coexist (`index.ts`, `transports/http.ts`,
+ * `services/oauth.ts`, `services/boond-client.ts`, `config/access-policy.ts`,
+ * `config/dictionary-overrides.ts`) and they disagreed on the one rule that
+ * matters for the packaged channels (issue #242): the MCPB manifest and the
+ * Claude Code plugin substitute `${user_config.KEY}` into **every** `BOOND_*`
+ * variable, so an option the user never filled arrives as `""`, as whitespace,
+ * or as the unsubstituted `"${…}"` — and only one of the six rejected the
+ * whitespace form. `MCP_HTTP_PATH=" "` became the endpoint path,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER=" "` broke the discovery document.
+ *
+ * Rule, applied by every reader here: `""`, whitespace-only and an
+ * unresolved `${…}` placeholder all mean *not configured*. A blank value must
+ * never switch a security control off (`MCP_HTTP_ALLOWED_HOSTS`) nor a
+ * restriction on (`BOOND_MCP_DOMAINS`); it falls through to the default.
+ *
+ * Every reader takes the environment as its last argument so the config
+ * modules that already accept an `env` for testing keep doing so.
+ */
+/** True when the raw value is one of the three "not configured" shapes. */
+export declare function isUnset(raw: string | undefined): boolean;
+/**
+ * The variable's value, or `undefined` when it is absent / blank / an
+ * unresolved placeholder. The value is returned as-is (not trimmed): a
+ * password may legitimately end with a space. Callers that want a token
+ * trim it themselves.
+ */
+export declare function readString(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * A boolean switch. `1/true/yes/on` → `true`, `0/false/no/off` → `false`,
+ * anything else (unset, blank, placeholder, garbage) → `fallback`. Both
+ * spellings are accepted because the packaged channels send booleans as
+ * strings with an explicit `default` — `"false"` must not read as "set,
+ * therefore on".
+ */
+export declare function readBool(name: string, fallback?: boolean, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * A positive integer (floored), or `fallback` for unset, non-numeric, negative
+ * or — unless `allowZero` — zero values.
+ */
+export declare function readPositiveInt(name: string, fallback: number, env?: NodeJS.ProcessEnv, options?: {
+    allowZero?: boolean;
+}): number;
+/**
+ * A list: comma and/or whitespace separated, trimmed, empties dropped.
+ * `undefined` when the variable is not configured **or** yields no token
+ * (`" , "`): a list with nothing in it is "unconfigured", never "allow
+ * nothing" — the `MCP_HTTP_ALLOWED_HOSTS` rule, applied to every list.
+ */
+export declare function readCsv(name: string, env?: NodeJS.ProcessEnv): string[] | undefined;
+/**
+ * An absolute URL, trimmed. Unset / blank / placeholder → `undefined`. A
+ * value that is present but not a URL **throws**, naming the variable: the
+ * URLs read here (`BOOND_BASE_URL`, `MCP_HTTP_PUBLIC_URL`,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER`) all decide where credentials are sent
+ * or where clients are told to go, so a typo must stop the start-up with a
+ * readable message rather than surface later as an opaque fetch error or a
+ * broken discovery document.
+ */
+export declare function readUrl(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=env.d.ts.map

package/dist/config/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,2EAA2E;AAC3E,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGjG;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,UAAQ,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAMtG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,GAAG,SAAS,CAQhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAa9F"}

package/dist/config/env.js

@@ -0,0 +1,116 @@
+/**
+ * The one place configuration is read from the environment.
+ *
+ * Six readers used to coexist (`index.ts`, `transports/http.ts`,
+ * `services/oauth.ts`, `services/boond-client.ts`, `config/access-policy.ts`,
+ * `config/dictionary-overrides.ts`) and they disagreed on the one rule that
+ * matters for the packaged channels (issue #242): the MCPB manifest and the
+ * Claude Code plugin substitute `${user_config.KEY}` into **every** `BOOND_*`
+ * variable, so an option the user never filled arrives as `""`, as whitespace,
+ * or as the unsubstituted `"${…}"` — and only one of the six rejected the
+ * whitespace form. `MCP_HTTP_PATH=" "` became the endpoint path,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER=" "` broke the discovery document.
+ *
+ * Rule, applied by every reader here: `""`, whitespace-only and an
+ * unresolved `${…}` placeholder all mean *not configured*. A blank value must
+ * never switch a security control off (`MCP_HTTP_ALLOWED_HOSTS`) nor a
+ * restriction on (`BOOND_MCP_DOMAINS`); it falls through to the default.
+ *
+ * Every reader takes the environment as its last argument so the config
+ * modules that already accept an `env` for testing keep doing so.
+ */
+const TRUE_VALUES = new Set(["1", "true", "yes", "on"]);
+const FALSE_VALUES = new Set(["0", "false", "no", "off"]);
+/** True when the raw value is one of the three "not configured" shapes. */
+export function isUnset(raw) {
+    if (raw === undefined)
+        return true;
+    const trimmed = raw.trim();
+    return trimmed.length === 0 || trimmed.startsWith("${");
+}
+/**
+ * The variable's value, or `undefined` when it is absent / blank / an
+ * unresolved placeholder. The value is returned as-is (not trimmed): a
+ * password may legitimately end with a space. Callers that want a token
+ * trim it themselves.
+ */
+export function readString(name, env = process.env) {
+    const raw = env[name];
+    return isUnset(raw) ? undefined : raw;
+}
+/**
+ * A boolean switch. `1/true/yes/on` → `true`, `0/false/no/off` → `false`,
+ * anything else (unset, blank, placeholder, garbage) → `fallback`. Both
+ * spellings are accepted because the packaged channels send booleans as
+ * strings with an explicit `default` — `"false"` must not read as "set,
+ * therefore on".
+ */
+export function readBool(name, fallback = false, env = process.env) {
+    const raw = readString(name, env)?.trim().toLowerCase();
+    if (raw === undefined)
+        return fallback;
+    if (TRUE_VALUES.has(raw))
+        return true;
+    if (FALSE_VALUES.has(raw))
+        return false;
+    return fallback;
+}
+/**
+ * A positive integer (floored), or `fallback` for unset, non-numeric, negative
+ * or — unless `allowZero` — zero values.
+ */
+export function readPositiveInt(name, fallback, env = process.env, options = {}) {
+    const raw = readString(name, env);
+    if (raw === undefined)
+        return fallback;
+    const parsed = Number(raw.trim());
+    if (!Number.isFinite(parsed))
+        return fallback;
+    if (parsed < 0)
+        return fallback;
+    if (parsed === 0 && !options.allowZero)
+        return fallback;
+    return Math.floor(parsed);
+}
+/**
+ * A list: comma and/or whitespace separated, trimmed, empties dropped.
+ * `undefined` when the variable is not configured **or** yields no token
+ * (`" , "`): a list with nothing in it is "unconfigured", never "allow
+ * nothing" — the `MCP_HTTP_ALLOWED_HOSTS` rule, applied to every list.
+ */
+export function readCsv(name, env = process.env) {
+    const raw = readString(name, env);
+    if (raw === undefined)
+        return undefined;
+    const items = raw
+        .split(/[\s,]+/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    return items.length > 0 ? items : undefined;
+}
+/**
+ * An absolute URL, trimmed. Unset / blank / placeholder → `undefined`. A
+ * value that is present but not a URL **throws**, naming the variable: the
+ * URLs read here (`BOOND_BASE_URL`, `MCP_HTTP_PUBLIC_URL`,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER`) all decide where credentials are sent
+ * or where clients are told to go, so a typo must stop the start-up with a
+ * readable message rather than surface later as an opaque fetch error or a
+ * broken discovery document.
+ */
+export function readUrl(name, env = process.env) {
+    const raw = readString(name, env)?.trim();
+    if (raw === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`Invalid ${name}: "${raw}" is not an absolute URL (expected e.g. https://host/path)`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Invalid ${name}: "${raw}" must use http:// or https://`);
+    }
+    return raw;
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,GAAuB;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAQ,GAAG,KAAK,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/config/profiles.d.ts

@@ -36,15 +36,29 @@ import type { DomainName } from "../constants.js";
  */
 declare const PROFILE_TABLE: {
     /** Recrutement / sourcing : viviers, positionnements, suivi d'activité. */
-    readonly recruiting: readonly ["candidates", "positionings", "opportunities", "contacts", "companies", "documents", "actions", "resources", "application", "workflows"];
-    /** Avant-vente / commerce : pipeline, comptes, commandes. */
-    readonly sales: readonly ["opportunities", "companies", "contacts", "actions", "projects", "orders", "products", "reporting", "resources", "application", "workflows"];
-    /** Gestion / compta : facturation client et fournisseur, encaissements. */
-    readonly finance: readonly ["invoices", "payments", "orders", "purchases", "provider-invoices", "expenses", "projects", "companies", "reporting", "application", "workflows"];
-    /** Delivery / staffing : missions, CRA, absences, validations. */
-    readonly delivery: readonly ["projects", "deliveries", "resources", "timesheets", "absences", "planning-absences", "validations", "application", "workflows"];
+    readonly recruiting: readonly ["candidates", "positionings", "opportunities", "contacts", "companies", "documents", "actions", "resources", "forms", "alerts", "application", "workflows"];
+    /**
+     * Avant-vente / commerce : pipeline, comptes, commandes. `absences` and
+     * `timesheets` are here for `recap_hebdo` (issue #260): its runbook reads the
+     * team's absences and CRA in one call each, and a prompt is cut as soon as
+     * one of its domains is filtered — without them the profile would keep the
+     * tools and lose the runbook, the trade this file's header argues against.
+     */
+    readonly sales: readonly ["opportunities", "companies", "contacts", "actions", "projects", "orders", "products", "reporting", "resources", "absences", "timesheets", "invoices", "alerts", "application", "workflows"];
+    /**
+     * Gestion / compta : facturation client et fournisseur, encaissements.
+     * `timesheets` and `deliveries` are here for `preparation_facturation`
+     * (issue #259): billing starts from validated CRA and running deliveries.
+     */
+    readonly finance: readonly ["invoices", "payments", "orders", "purchases", "provider-invoices", "expenses", "projects", "companies", "reporting", "timesheets", "deliveries", "alerts", "application", "workflows"];
+    /**
+     * Delivery / staffing : missions, CRA, absences, validations. `contracts`
+     * for `alertes_contrats` (issue #253): contract and probation ends are the
+     * delivery manager's calendar.
+     */
+    readonly delivery: readonly ["projects", "deliveries", "resources", "timesheets", "absences", "planning-absences", "validations", "contracts", "inactivities", "groupments", "forms", "alerts", "application", "workflows"];
     /** Administration de l'outil : référentiels d'organisation et journaux. */
-    readonly admin: readonly ["accounts", "agencies", "business-units", "poles", "roles", "logs", "webhooks", "flags", "application"];
+    readonly admin: readonly ["accounts", "agencies", "business-units", "poles", "roles", "logs", "webhooks", "flags", "alerts", "application"];
 };
 /** Profile name literals (`"recruiting" | "sales" | …`). */
 export type ProfileName = keyof typeof PROFILE_TABLE;

package/dist/config/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,aAAa;IACjB,2EAA2E;;IAa3E,6DAA6D;;IAc7D,2EAA2E;;IAc3E,kEAAkE;;IAYlE,2EAA2E;;CAEnB,CAAC;AAE3D,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,aAAa,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAiB,CAAC;AAEvF,oEAAoE;AACpE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAgD,CAAC;AAEjG;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,GAAG,SAAS,CAG9E"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,aAAa;IACjB,2EAA2E;;IAgB3E;;;;;;OAMG;;IAoBH;;;;OAIG;;IAiBH;;;;OAIG;;IAmBH,2EAA2E;;CAanB,CAAC;AAE3D,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,aAAa,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAiB,CAAC;AAEvF,oEAAoE;AACpE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAgD,CAAC;AAEjG;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,GAAG,SAAS,CAG9E"}

package/dist/config/profiles.js

@@ -44,10 +44,19 @@ const PROFILE_TABLE = {
         "documents",
         "actions",
         "resources",
+        // `forms` (issue #256): interview / evaluation forms are a recruiting object.
+        "forms",
+        "alerts",
         "application",
         "workflows",
     ],
-    /** Avant-vente / commerce : pipeline, comptes, commandes. */
+    /**
+     * Avant-vente / commerce : pipeline, comptes, commandes. `absences` and
+     * `timesheets` are here for `recap_hebdo` (issue #260): its runbook reads the
+     * team's absences and CRA in one call each, and a prompt is cut as soon as
+     * one of its domains is filtered — without them the profile would keep the
+     * tools and lose the runbook, the trade this file's header argues against.
+     */
     sales: [
         "opportunities",
         "companies",
@@ -58,10 +67,20 @@ const PROFILE_TABLE = {
         "products",
         "reporting",
         "resources",
+        "absences",
+        "timesheets",
+        // `invoices` for `preparation_rdv_client` (issue #259): a salesperson reads
+        // the client's overdue invoices before a meeting.
+        "invoices",
+        "alerts",
         "application",
         "workflows",
     ],
-    /** Gestion / compta : facturation client et fournisseur, encaissements. */
+    /**
+     * Gestion / compta : facturation client et fournisseur, encaissements.
+     * `timesheets` and `deliveries` are here for `preparation_facturation`
+     * (issue #259): billing starts from validated CRA and running deliveries.
+     */
     finance: [
         "invoices",
         "payments",
@@ -72,10 +91,17 @@ const PROFILE_TABLE = {
         "projects",
         "companies",
         "reporting",
+        "timesheets",
+        "deliveries",
+        "alerts",
         "application",
         "workflows",
     ],
-    /** Delivery / staffing : missions, CRA, absences, validations. */
+    /**
+     * Delivery / staffing : missions, CRA, absences, validations. `contracts`
+     * for `alertes_contrats` (issue #253): contract and probation ends are the
+     * delivery manager's calendar.
+     */
     delivery: [
         "projects",
         "deliveries",
@@ -84,11 +110,29 @@ const PROFILE_TABLE = {
         "absences",
         "planning-absences",
         "validations",
+        "contracts",
+        // Issue #256: bench periods, delivery groupments (multi-delivery billing) and
+        // end-of-mission / annual forms.
+        "inactivities",
+        "groupments",
+        "forms",
+        "alerts",
         "application",
         "workflows",
     ],
     /** Administration de l'outil : référentiels d'organisation et journaux. */
-    admin: ["accounts", "agencies", "business-units", "poles", "roles", "logs", "webhooks", "flags", "application"],
+    admin: [
+        "accounts",
+        "agencies",
+        "business-units",
+        "poles",
+        "roles",
+        "logs",
+        "webhooks",
+        "flags",
+        "alerts",
+        "application",
+    ],
 };
 /**
  * The profile bundles. Keyed by `string` for iteration/lookup convenience;

package/dist/config/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,aAAa,GAAG;IACpB,2EAA2E;IAC3E,UAAU,EAAE;QACV,YAAY;QACZ,cAAc;QACd,eAAe;QACf,UAAU;QACV,WAAW;QACX,WAAW;QACX,SAAS;QACT,WAAW;QACX,aAAa;QACb,WAAW;KACZ;IACD,6DAA6D;IAC7D,KAAK,EAAE;QACL,eAAe;QACf,WAAW;QACX,UAAU;QACV,SAAS;QACT,UAAU;QACV,QAAQ;QACR,UAAU;QACV,WAAW;QACX,WAAW;QACX,aAAa;QACb,WAAW;KACZ;IACD,2EAA2E;IAC3E,OAAO,EAAE;QACP,UAAU;QACV,UAAU;QACV,QAAQ;QACR,WAAW;QACX,mBAAmB;QACnB,UAAU;QACV,UAAU;QACV,WAAW;QACX,WAAW;QACX,aAAa;QACb,WAAW;KACZ;IACD,kEAAkE;IAClE,QAAQ,EAAE;QACR,UAAU;QACV,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,UAAU;QACV,mBAAmB;QACnB,aAAa;QACb,aAAa;QACb,WAAW;KACZ;IACD,2EAA2E;IAC3E,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;CACvD,CAAC;AAK3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAoD,aAAa,CAAC;AAEvF,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAkB,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,aAAa,GAAG;IACpB,2EAA2E;IAC3E,UAAU,EAAE;QACV,YAAY;QACZ,cAAc;QACd,eAAe;QACf,UAAU;QACV,WAAW;QACX,WAAW;QACX,SAAS;QACT,WAAW;QACX,8EAA8E;QAC9E,OAAO;QACP,QAAQ;QACR,aAAa;QACb,WAAW;KACZ;IACD;;;;;;OAMG;IACH,KAAK,EAAE;QACL,eAAe;QACf,WAAW;QACX,UAAU;QACV,SAAS;QACT,UAAU;QACV,QAAQ;QACR,UAAU;QACV,WAAW;QACX,WAAW;QACX,UAAU;QACV,YAAY;QACZ,4EAA4E;QAC5E,kDAAkD;QAClD,UAAU;QACV,QAAQ;QACR,aAAa;QACb,WAAW;KACZ;IACD;;;;OAIG;IACH,OAAO,EAAE;QACP,UAAU;QACV,UAAU;QACV,QAAQ;QACR,WAAW;QACX,mBAAmB;QACnB,UAAU;QACV,UAAU;QACV,WAAW;QACX,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,aAAa;QACb,WAAW;KACZ;IACD;;;;OAIG;IACH,QAAQ,EAAE;QACR,UAAU;QACV,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,UAAU;QACV,mBAAmB;QACnB,aAAa;QACb,WAAW;QACX,8EAA8E;QAC9E,iCAAiC;QACjC,cAAc;QACd,YAAY;QACZ,OAAO;QACP,QAAQ;QACR,aAAa;QACb,WAAW;KACZ;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,UAAU;QACV,UAAU;QACV,gBAAgB;QAChB,OAAO;QACP,OAAO;QACP,MAAM;QACN,UAAU;QACV,OAAO;QACP,QAAQ;QACR,aAAa;KACd;CACuD,CAAC;AAK3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAoD,aAAa,CAAC;AAEvF,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAkB,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}