keycloak-model-context-protocol 0.0.2 → 1.0.1

package/dist/tools/roles.js

@@ -0,0 +1,270 @@
+import { z } from "zod";
+import { assertPathSegment, requireConfirmation } from "../guards.js";
+import { ToolError } from "../keycloak/errors.js";
+import { defineTool, pageOf, paginationShape, realmField, toPage } from "./shared.js";
+const roleSummary = z.object({
+    name: z.string().describe("Role name."),
+    description: z.string().optional().describe("Role description, if set."),
+    composite: z.boolean().optional().describe("Whether the role is composite."),
+    clientRole: z.boolean().optional().describe("Whether this is a client role."),
+});
+function toRoleSummary(role) {
+    return {
+        name: role.name ?? "",
+        ...(role.description !== undefined && { description: role.description }),
+        ...(role.composite !== undefined && { composite: role.composite }),
+        ...(role.clientRole !== undefined && { clientRole: role.clientRole }),
+    };
+}
+const clientIdField = z
+    .string()
+    .min(1)
+    .optional()
+    .describe("Client ID (the readable `clientId`, not the internal UUID). Omit for realm roles.");
+/** Resolves a readable clientId to the client's internal id. */
+async function lookupClientUuid(kc, realm, clientId) {
+    const clients = await kc.clients.find({ realm, clientId });
+    const match = clients.find((c) => c.clientId === clientId);
+    if (!match?.id)
+        throw new ToolError("not_found", `Client '${clientId}' does not exist in realm '${realm}'.`);
+    return match.id;
+}
+const roleList = defineTool({
+    name: "role_list",
+    title: "List roles",
+    description: "List realm roles, or the roles of one client when `clientId` is given, optionally filtered by a search string, with pagination.",
+    kind: "read",
+    input: z.object({
+        realm: realmField,
+        clientId: clientIdField,
+        search: z.string().optional().describe("Only roles whose name contains this text."),
+        ...paginationShape,
+    }),
+    output: pageOf(roleSummary).extend({
+        realm: z.string().describe("Realm that was queried."),
+        clientId: z.string().optional().describe("Client whose roles were listed, if any."),
+    }),
+    async handler({ realm, clientId, search, first, max }, { gateway }) {
+        const rows = await gateway.run(async (kc) => {
+            if (clientId === undefined) {
+                return kc.roles.find({
+                    realm,
+                    first,
+                    max: max + 1,
+                    briefRepresentation: true,
+                    ...(search !== undefined && { search }),
+                });
+            }
+            const id = await lookupClientUuid(kc, realm, clientId);
+            // The client-roles endpoint has no paging in the admin client; slice locally.
+            const all = await kc.clients.listRoles({ realm, id });
+            const needle = search?.toLowerCase();
+            return all
+                .filter((r) => needle === undefined || (r.name ?? "").toLowerCase().includes(needle))
+                .slice(first, first + max + 1);
+        });
+        const page = toPage(rows.map(toRoleSummary), first, max);
+        return {
+            data: { ...page, realm, ...(clientId !== undefined && { clientId }) },
+            summary: `Found ${page.items.length} role(s) in realm '${realm}' (first=${first}, max=${max}${page.hasMore ? ", more available" : ""}).`,
+        };
+    },
+});
+const userRolesList = defineTool({
+    name: "user_roles_list",
+    title: "List user role mappings",
+    description: "List the realm and client roles assigned to a user. With effective=true, composite roles are expanded; client roles are then resolved for `clientId` if given, otherwise for the clients the user has direct client-role mappings in. Optional `clientId` limits client roles to that client.",
+    kind: "read",
+    input: z.object({
+        realm: realmField,
+        userId: z.string().min(1).describe("ID (UUID) of the user."),
+        clientId: clientIdField,
+        effective: z
+            .boolean()
+            .default(false)
+            .describe("If true, include roles inherited via composite roles (default false)."),
+    }),
+    output: z.object({
+        realm: z.string().describe("Realm of the user."),
+        userId: z.string().describe("ID of the user."),
+        effective: z.boolean().describe("Whether composite roles were expanded."),
+        realmRoles: z.array(roleSummary).describe("Realm roles of the user."),
+        clientRoles: z
+            .array(z.object({
+            clientId: z.string().describe("Client the roles belong to."),
+            roles: z.array(roleSummary).describe("Roles of the user in that client."),
+        }))
+            .describe("Client roles of the user, grouped by client."),
+    }),
+    async handler({ realm, userId, clientId, effective }, { gateway }) {
+        const data = await gateway.run(async (kc) => {
+            const mappings = await kc.users.listRoleMappings({ realm, id: userId });
+            const realmRoles = effective
+                ? await kc.users.listCompositeRealmRoleMappings({ realm, id: userId })
+                : (mappings.realmMappings ?? []);
+            const direct = Object.entries((mappings.clientMappings ?? {}));
+            let clientRoles;
+            if (!effective) {
+                clientRoles = direct
+                    .filter(([key, v]) => clientId === undefined || (v.client ?? key) === clientId)
+                    .map(([key, v]) => ({
+                    clientId: v.client ?? key,
+                    roles: (v.mappings ?? []).map(toRoleSummary),
+                }));
+            }
+            else {
+                const targets = clientId === undefined
+                    ? direct.map(([key, v]) => ({ clientId: v.client ?? key, uuid: v.id }))
+                    : [{ clientId, uuid: undefined }];
+                clientRoles = [];
+                for (const t of targets) {
+                    const uuid = t.uuid ?? (await lookupClientUuid(kc, realm, t.clientId));
+                    const roles = await kc.users.listCompositeClientRoleMappings({
+                        realm,
+                        id: userId,
+                        clientUniqueId: uuid,
+                    });
+                    clientRoles.push({ clientId: t.clientId, roles: roles.map(toRoleSummary) });
+                }
+            }
+            return { realm, userId, effective, realmRoles: realmRoles.map(toRoleSummary), clientRoles };
+        });
+        const clientCount = data.clientRoles.reduce((n, c) => n + c.roles.length, 0);
+        return {
+            data,
+            summary: `User ${userId} has ${data.realmRoles.length} realm role(s) and ${clientCount} client role(s) in realm '${realm}'${effective ? " (effective)" : ""}.`,
+        };
+    },
+});
+async function resolveRoles(kc, realm, names, clientId) {
+    for (const name of names)
+        assertPathSegment(name, "role name");
+    const clientUuid = clientId === undefined ? undefined : await lookupClientUuid(kc, realm, clientId);
+    const roles = [];
+    const missing = [];
+    for (const name of new Set(names)) {
+        const rep = clientUuid === undefined
+            ? await kc.roles.findOneByName({ realm, name })
+            : await kc.clients.findRole({ realm, id: clientUuid, roleName: name });
+        if (rep?.id)
+            roles.push({ id: rep.id, name });
+        else
+            missing.push(name);
+    }
+    if (missing.length > 0) {
+        const where = clientId === undefined ? `realm '${realm}'` : `client '${clientId}' in realm '${realm}'`;
+        throw new ToolError("not_found", `Unknown role(s) in ${where}: ${missing.join(", ")}. Nothing was changed.`);
+    }
+    return clientUuid === undefined ? { roles } : { roles, clientUuid };
+}
+/** Roles that grant administrative power over the realm. */
+export function isPrivilegedRole(name, clientId) {
+    if (clientId === undefined)
+        return name === "admin" || name === "create-realm";
+    return clientId === "realm-management" || name === "realm-admin" || name.startsWith("manage-");
+}
+const rolesField = z
+    .array(z.string().min(1))
+    .min(1)
+    .max(50)
+    .describe("Role names (not IDs), e.g. ['editor']. Use role_list to see available roles.");
+const roleMutationOutput = z.object({
+    realm: z.string().describe("Realm of the user."),
+    userId: z.string().describe("ID of the user."),
+    clientId: z.string().optional().describe("Client of the roles; absent for realm roles."),
+    roles: z.array(z.string()).describe("Role names that were processed."),
+});
+const userRoleAssign = defineTool({
+    name: "user_role_assign",
+    title: "Assign roles to user",
+    description: "Assign realm roles (or roles of one client when `clientId` is given) to a user. Unknown roles abort the call without changes. Assigning administrative roles (realm role admin/create-realm, any role of client realm-management, realm-admin or manage-*) additionally requires confirm: true after the user approved.",
+    kind: "write",
+    idempotent: true,
+    input: z.object({
+        realm: realmField,
+        userId: z.string().min(1).describe("ID (UUID) of the user."),
+        roles: rolesField,
+        clientId: clientIdField,
+        confirm: z
+            .boolean()
+            .optional()
+            .describe("Must be true to assign administrative roles. Only set it after the user approved."),
+    }),
+    output: roleMutationOutput.extend({
+        assigned: z.boolean().describe("True once the roles are assigned."),
+    }),
+    async handler({ realm, userId, roles: names, clientId, confirm }, { gateway, config }) {
+        const resolved = await gateway.run(async (kc) => {
+            const found = await resolveRoles(kc, realm, names, clientId);
+            const privileged = found.roles.filter((r) => isPrivilegedRole(r.name, clientId));
+            if (privileged.length > 0) {
+                const list = privileged.map((r) => r.name).join(", ");
+                requireConfirmation(config, confirm, `grant the administrative role(s) ${list} to user ${userId} in realm '${realm}'.`);
+            }
+            if (found.clientUuid === undefined) {
+                await kc.users.addRealmRoleMappings({ realm, id: userId, roles: found.roles });
+            }
+            else {
+                await kc.users.addClientRoleMappings({
+                    realm,
+                    id: userId,
+                    clientUniqueId: found.clientUuid,
+                    roles: found.roles,
+                });
+            }
+            return found.roles;
+        });
+        const roles = resolved.map((r) => r.name);
+        return {
+            data: { realm, userId, ...(clientId !== undefined && { clientId }), roles, assigned: true },
+            summary: `Assigned ${roles.length} role(s) to user ${userId} in realm '${realm}'.`,
+        };
+    },
+});
+const userRoleRevoke = defineTool({
+    name: "user_role_revoke",
+    title: "Revoke roles from user",
+    description: "Remove realm roles (or roles of one client when `clientId` is given) from a user. Unknown roles abort the call without changes. Requires confirm: true (ask the user first).",
+    kind: "destructive",
+    idempotent: true,
+    input: z.object({
+        realm: realmField,
+        userId: z.string().min(1).describe("ID (UUID) of the user."),
+        roles: rolesField,
+        clientId: clientIdField,
+    }),
+    output: roleMutationOutput.extend({
+        revoked: z.boolean().describe("True once the roles are removed."),
+    }),
+    async preview({ realm, userId, roles, clientId }, { gateway }) {
+        const user = await gateway.run((kc) => kc.users.findOne({ realm, id: userId }));
+        if (!user)
+            throw new ToolError("not_found", `User ${userId} does not exist in realm '${realm}'.`);
+        const scope = clientId === undefined ? "realm" : `client '${clientId}'`;
+        return `remove ${scope} role(s) ${roles.join(", ")} from user '${user.username ?? userId}' in realm '${realm}'.`;
+    },
+    async handler({ realm, userId, roles: names, clientId }, { gateway }) {
+        const resolved = await gateway.run(async (kc) => {
+            const found = await resolveRoles(kc, realm, names, clientId);
+            if (found.clientUuid === undefined) {
+                await kc.users.delRealmRoleMappings({ realm, id: userId, roles: found.roles });
+            }
+            else {
+                await kc.users.delClientRoleMappings({
+                    realm,
+                    id: userId,
+                    clientUniqueId: found.clientUuid,
+                    roles: found.roles,
+                });
+            }
+            return found.roles;
+        });
+        const roles = resolved.map((r) => r.name);
+        return {
+            data: { realm, userId, ...(clientId !== undefined && { clientId }), roles, revoked: true },
+            summary: `Revoked ${roles.length} role(s) from user ${userId} in realm '${realm}'.`,
+        };
+    },
+});
+export const roleTools = [roleList, userRolesList, userRoleAssign, userRoleRevoke];
+//# sourceMappingURL=roles.js.map

package/dist/tools/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/tools/roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEtF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC5E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CAC9E,CAAC,CAAC;AAUH,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,QAAQ,EAAE;KACV,QAAQ,CAAC,mFAAmF,CAAC,CAAC;AAEjG,gEAAgE;AAChE,KAAK,UAAU,gBAAgB,CAAC,EAAiB,EAAE,KAAa,EAAE,QAAgB;IAChF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,EAAE;QACZ,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,QAAQ,8BAA8B,KAAK,IAAI,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,UAAU,CAAC;IAC1B,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,YAAY;IACnB,WAAW,EACT,iIAAiI;IACnI,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QACnF,GAAG,eAAe;KACnB,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;KACpF,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;oBACnB,KAAK;oBACL,KAAK;oBACL,GAAG,EAAE,GAAG,GAAG,CAAC;oBACZ,mBAAmB,EAAE,IAAI;oBACzB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvD,8EAA8E;YAC9E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;YACrC,OAAO,GAAG;iBACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACpF,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;YACrE,OAAO,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,sBAAsB,KAAK,YAAY,KAAK,SAAS,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,IAAI;SACzI,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,UAAU,CAAC;IAC/B,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,+RAA+R;IACjS,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC5D,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,CAAC;aACT,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,uEAAuE,CAAC;KACrF,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC9C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACzE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QACrE,WAAW,EAAE,CAAC;aACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAC5D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SAC1E,CAAC,CACH;aACA,QAAQ,CAAC,8CAA8C,CAAC;KAC5D,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,MAAM,UAAU,GAAG,SAAS;gBAC1B,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;gBACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAC3B,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAG7B,CACF,CAAC;YACF,IAAI,WAA8E,CAAC;YACnF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,WAAW,GAAG,MAAM;qBACjB,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,QAAQ,CAAC;qBAC9E,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,GAAG;oBACzB,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;iBAC7C,CAAC,CAAC,CAAC;YACR,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;oBACpB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACvE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAA+B,EAAE,CAAC,CAAC;gBAC5D,WAAW,GAAG,EAAE,CAAC;gBACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACvE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC;wBAC3D,KAAK;wBACL,EAAE,EAAE,MAAM;wBACV,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC;oBACH,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,QAAQ,MAAM,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,sBAAsB,WAAW,6BAA6B,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG;SAC/J,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAWH,KAAK,UAAU,YAAY,CACzB,EAAiB,EACjB,KAAa,EACb,KAAwB,EACxB,QAA4B;IAE5B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,UAAU,GACd,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnF,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,GACP,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,GAAG,EAAE,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;;YACzC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,QAAQ,eAAe,KAAK,GAAG,CAAC;QAC3F,MAAM,IAAI,SAAS,CACjB,WAAW,EACX,sBAAsB,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACtE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAA4B;IACzE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC;IAC/E,OAAO,QAAQ,KAAK,kBAAkB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,GAAG,CAAC;KACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KACxB,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,QAAQ,CAAC,8EAA8E,CAAC,CAAC;AAE5F,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACxF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,UAAU,CAAC;IAChC,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,yTAAyT;IAC3T,IAAI,EAAE,OAAO;IACb,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC5D,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,mFAAmF,CACpF;KACJ,CAAC;IACF,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;QAChC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KACpE,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QACnF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtD,mBAAmB,CACjB,MAAM,EACN,OAAO,EACP,oCAAoC,IAAI,YAAY,MAAM,cAAc,KAAK,IAAI,CAClF,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;oBACnC,KAAK;oBACL,EAAE,EAAE,MAAM;oBACV,cAAc,EAAE,KAAK,CAAC,UAAU;oBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC3F,OAAO,EAAE,YAAY,KAAK,CAAC,MAAM,oBAAoB,MAAM,cAAc,KAAK,IAAI;SACnF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,UAAU,CAAC;IAChC,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EACT,8KAA8K;IAChL,IAAI,EAAE,aAAa;IACnB,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC5D,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,aAAa;KACxB,CAAC;IACF,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAClE,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,QAAQ,MAAM,6BAA6B,KAAK,IAAI,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,QAAQ,GAAG,CAAC;QACxE,OAAO,UAAU,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,MAAM,eAAe,KAAK,IAAI,CAAC;IACnH,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;oBACnC,KAAK;oBACL,EAAE,EAAE,MAAM;oBACV,cAAc,EAAE,KAAK,CAAC,UAAU;oBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1F,OAAO,EAAE,WAAW,KAAK,CAAC,MAAM,sBAAsB,MAAM,cAAc,KAAK,IAAI;SACpF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC"}

package/dist/tools/security.js

@@ -0,0 +1,58 @@
+import { z } from "zod";
+import { defineTool, realmField } from "./shared.js";
+const userIdField = z.string().min(1).describe("ID (UUID) of the user, e.g. from user_search.");
+const userBruteForceStatus = defineTool({
+    name: "user_brute_force_status",
+    title: "Get brute-force status",
+    description: "Show the brute-force detection state of a user: whether the account is temporarily locked and recent failure counters.",
+    kind: "read",
+    input: z.object({ realm: realmField, userId: userIdField }),
+    output: z.object({
+        realm: z.string().describe("Realm that was queried."),
+        userId: z.string().describe("User ID that was queried."),
+        disabled: z
+            .boolean()
+            .describe("True if the user is currently locked by brute-force detection."),
+        numFailures: z.number().describe("Number of consecutive failed logins."),
+        lastFailure: z.number().optional().describe("Time of the last failure (epoch milliseconds)."),
+        lastIPFailure: z.string().optional().describe("IP address of the last failure."),
+    }),
+    async handler({ realm, userId }, { gateway }) {
+        const st = await gateway.run((kc) => kc.attackDetection.findOne({ realm, id: userId }));
+        const disabled = st?.disabled === true;
+        const numFailures = typeof st?.numFailures === "number" ? st.numFailures : 0;
+        return {
+            data: {
+                realm,
+                userId,
+                disabled,
+                numFailures,
+                ...(typeof st?.lastFailure === "number" && { lastFailure: st.lastFailure }),
+                ...(typeof st?.lastIPFailure === "string" && { lastIPFailure: st.lastIPFailure }),
+            },
+            summary: `User ${userId} in realm '${realm}': ${disabled ? "locked" : "not locked"}, ${numFailures} failed login(s).`,
+        };
+    },
+});
+const userBruteForceUnlock = defineTool({
+    name: "user_brute_force_unlock",
+    title: "Unlock user (brute-force)",
+    description: "Clear the brute-force detection state of a user so a temporarily locked account can log in again. Does not change the user's enabled flag.",
+    kind: "write",
+    idempotent: true,
+    input: z.object({ realm: realmField, userId: userIdField }),
+    output: z.object({
+        unlocked: z.boolean().describe("True if the brute-force state was cleared."),
+        userId: z.string().describe("User that was unlocked."),
+        realm: z.string().describe("Realm of the user."),
+    }),
+    async handler({ realm, userId }, { gateway }) {
+        await gateway.run((kc) => kc.attackDetection.del({ realm, id: userId }));
+        return {
+            data: { unlocked: true, userId, realm },
+            summary: `Cleared brute-force state of user ${userId} in realm '${realm}'.`,
+        };
+    },
+});
+export const securityTools = [userBruteForceStatus, userBruteForceUnlock];
+//# sourceMappingURL=security.js.map

package/dist/tools/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/tools/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAEhG,MAAM,oBAAoB,GAAG,UAAU,CAAC;IACtC,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EACT,wHAAwH;IAC1H,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACxD,QAAQ,EAAE,CAAC;aACR,OAAO,EAAE;aACT,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QACxE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAC7F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;KACjF,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE;QAC1C,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,EAAE,EAAE,QAAQ,KAAK,IAAI,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,EAAE,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE;gBACJ,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,WAAW;gBACX,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC3E,GAAG,CAAC,OAAO,EAAE,EAAE,aAAa,KAAK,QAAQ,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,aAAa,EAAE,CAAC;aAClF;YACD,OAAO,EAAE,QAAQ,MAAM,cAAc,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,mBAAmB;SACtH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,UAAU,CAAC;IACtC,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,4IAA4I;IAC9I,IAAI,EAAE,OAAO;IACb,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KACjD,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE;QAC1C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YACvC,OAAO,EAAE,qCAAqC,MAAM,cAAc,KAAK,IAAI;SAC5E,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC"}

package/dist/tools/sessions.js

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { ToolError } from "../keycloak/errors.js";
+import { defineTool, realmField } from "./shared.js";
+const userIdField = z.string().min(1).describe("ID (UUID) of the user, e.g. from user_search.");
+const sessionItem = z.object({
+    id: z.string().describe("Session ID."),
+    ipAddress: z.string().optional().describe("IP address the session was started from."),
+    start: z.number().optional().describe("Session start (epoch milliseconds)."),
+    lastAccess: z.number().optional().describe("Last access (epoch milliseconds)."),
+    clients: z.array(z.string()).describe("Client IDs (clientId) taking part in the session."),
+});
+const userSessionsList = defineTool({
+    name: "user_sessions_list",
+    title: "List user sessions",
+    description: "List the active sessions of a user (IP address, start, last access, clients).",
+    kind: "read",
+    input: z.object({ realm: realmField, userId: userIdField }),
+    output: z.object({
+        realm: z.string().describe("Realm that was queried."),
+        userId: z.string().describe("User ID that was queried."),
+        sessions: z.array(sessionItem).describe("Active sessions of the user."),
+    }),
+    async handler({ realm, userId }, { gateway }) {
+        const rows = await gateway.run((kc) => kc.users.listSessions({ realm, id: userId }));
+        const sessions = rows.map((s) => ({
+            id: s.id ?? "",
+            ...(s.ipAddress !== undefined && { ipAddress: s.ipAddress }),
+            ...(s.start !== undefined && { start: s.start }),
+            ...(s.lastAccess !== undefined && { lastAccess: s.lastAccess }),
+            clients: Object.values(s.clients ?? {}),
+        }));
+        return {
+            data: { realm, userId, sessions },
+            summary: `User ${userId} has ${sessions.length} active session(s) in realm '${realm}'.`,
+        };
+    },
+});
+const userLogout = defineTool({
+    name: "user_logout",
+    title: "Log out user",
+    description: "End all active sessions of a user (forced logout). Offline tokens are not affected. Requires confirm: true (ask the user first).",
+    kind: "destructive",
+    idempotent: true,
+    input: z.object({ realm: realmField, userId: userIdField }),
+    output: z.object({
+        loggedOut: z.boolean().describe("True if the logout request was accepted."),
+        userId: z.string().describe("User whose sessions were ended."),
+        realm: z.string().describe("Realm of the user."),
+    }),
+    async preview({ realm, userId }, { gateway }) {
+        const { user, sessions } = await gateway.run(async (kc) => ({
+            user: await kc.users.findOne({ realm, id: userId }),
+            sessions: await kc.users.listSessions({ realm, id: userId }),
+        }));
+        if (!user)
+            throw new ToolError("not_found", `User ${userId} does not exist in realm '${realm}'.`);
+        return `end all sessions (${sessions.length} active) of user '${user.username ?? userId}' (id ${userId}) in realm '${realm}'.`;
+    },
+    async handler({ realm, userId }, { gateway }) {
+        await gateway.run((kc) => kc.users.logout({ realm, id: userId }));
+        return {
+            data: { loggedOut: true, userId, realm },
+            summary: `Ended all sessions of user ${userId} in realm '${realm}'.`,
+        };
+    },
+});
+export const sessionTools = [userSessionsList, userLogout];
+//# sourceMappingURL=sessions.js.map

package/dist/tools/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/tools/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAEhG,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC/E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC;CAC3F,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,UAAU,CAAC;IAClC,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,+EAA+E;IAC5F,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KACxE,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;YACd,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAC5D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAChD,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC,CAAC;QACJ,OAAO;YACL,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjC,OAAO,EAAE,QAAQ,MAAM,QAAQ,QAAQ,CAAC,MAAM,gCAAgC,KAAK,IAAI;SACxF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,UAAU,CAAC;IAC5B,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,cAAc;IACrB,WAAW,EACT,kIAAkI;IACpI,IAAI,EAAE,aAAa;IACnB,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KACjD,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE;QAC1C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;YACnD,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SAC7D,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,QAAQ,MAAM,6BAA6B,KAAK,IAAI,CAAC,CAAC;QACzF,OAAO,qBAAqB,QAAQ,CAAC,MAAM,qBAAqB,IAAI,CAAC,QAAQ,IAAI,MAAM,SAAS,MAAM,eAAe,KAAK,IAAI,CAAC;IACjI,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE;QAC1C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,OAAO;YACL,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YACxC,OAAO,EAAE,8BAA8B,MAAM,cAAc,KAAK,IAAI;SACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC"}

package/dist/tools/shared.js

@@ -0,0 +1,144 @@
+import { z } from "zod";
+import { assertPathSegment, assertRealmAllowed, requireConfirmation } from "../guards.js";
+import { mapKeycloakError } from "../keycloak/errors.js";
+// ---------------------------------------------------------------------------
+// Shared schema building blocks
+// ---------------------------------------------------------------------------
+export const DEFAULT_PAGE_SIZE = 50;
+export const MAX_PAGE_SIZE = 200;
+export const realmField = z
+    .string()
+    .min(1)
+    .describe("Name of the target realm (the realm to operate on, not the login realm).");
+export const confirmField = z
+    .boolean()
+    .optional()
+    .describe("Must be true to execute this destructive operation. Only set it after the user approved.");
+export const paginationShape = {
+    first: z
+        .number()
+        .int()
+        .min(0)
+        .default(0)
+        .describe("Index of the first result to return (offset, default 0)."),
+    max: z
+        .number()
+        .int()
+        .min(1)
+        .max(MAX_PAGE_SIZE)
+        .default(DEFAULT_PAGE_SIZE)
+        .describe(`Maximum number of results (default ${DEFAULT_PAGE_SIZE}, at most ${MAX_PAGE_SIZE}).`),
+};
+/** Output schema wrapper for list tools: { items, first, max, hasMore }. */
+export function pageOf(item) {
+    return z.object({
+        items: z.array(item),
+        first: z.number().int().describe("Offset used for this page."),
+        max: z.number().int().describe("Page size used for this page."),
+        hasMore: z.boolean().describe("True if more results exist beyond this page."),
+    });
+}
+/**
+ * Turns a result list fetched with `max + 1` rows into a page.
+ * Query Keycloak with `max: max + 1` so hasMore can be detected without a count call.
+ */
+export function toPage(rows, first, max) {
+    return { items: rows.slice(0, max), first, max, hasMore: rows.length > max };
+}
+export function toResult(output) {
+    return {
+        content: [{ type: "text", text: output.summary }],
+        structuredContent: output.data,
+    };
+}
+export function errorResult(message) {
+    return { isError: true, content: [{ type: "text", text: message }] };
+}
+export function toToolError(error) {
+    return mapKeycloakError(error);
+}
+/**
+ * Input fields that end up as URL path segments. Query-only fields such as the
+ * public `clientId` (which may be a URL for SAML clients) are not listed.
+ */
+const PATH_SEGMENT_FIELDS = new Set(["realm", "id", "userId", "groupId"]);
+/**
+ * Builds a tool with all cross-cutting behaviour applied uniformly:
+ * annotations, realm guards (allowlist, master write protection), path segment
+ * validation, confirmation for destructive tools, error mapping to isError,
+ * and one audit log line per call (no arguments or PII logged).
+ */
+export function defineTool(spec) {
+    const destructive = spec.kind === "destructive";
+    if (destructive && !spec.preview) {
+        throw new Error(`Tool ${spec.name}: destructive tools must define preview()`);
+    }
+    if (destructive && "confirm" in spec.input.shape) {
+        throw new Error(`Tool ${spec.name}: 'confirm' is added automatically for destructive tools`);
+    }
+    const inputSchema = destructive ? spec.input.extend({ confirm: confirmField }) : spec.input;
+    const pathKeys = Object.keys(spec.input.shape).filter((key) => PATH_SEGMENT_FIELDS.has(key));
+    const write = spec.kind !== "read";
+    return {
+        name: spec.name,
+        kind: spec.kind,
+        register(server, ctx) {
+            server.registerTool(spec.name, {
+                title: spec.title,
+                description: spec.description,
+                inputSchema,
+                outputSchema: spec.output,
+                annotations: {
+                    title: spec.title,
+                    readOnlyHint: spec.kind === "read",
+                    destructiveHint: destructive,
+                    idempotentHint: spec.idempotent ?? spec.kind !== "write",
+                    openWorldHint: false,
+                },
+            }, async (rawArgs) => {
+                const started = Date.now();
+                const args = rawArgs;
+                const realm = typeof args.realm === "string" ? args.realm : undefined;
+                let outcome = "ok";
+                try {
+                    for (const key of pathKeys) {
+                        const value = args[key];
+                        if (typeof value === "string")
+                            assertPathSegment(value, key);
+                    }
+                    if (realm !== undefined)
+                        assertRealmAllowed(ctx.config, realm, { write });
+                    if (destructive && ctx.config.requireConfirmation && args.confirm !== true) {
+                        const preview = await spec.preview(args, ctx);
+                        requireConfirmation(ctx.config, args.confirm === true, preview);
+                    }
+                    return toResult(await spec.handler(args, ctx));
+                }
+                catch (error) {
+                    const toolError = mapKeycloakError(error, {
+                        baseUrl: ctx.config.url,
+                        authRealm: ctx.config.authRealm,
+                        timeoutMs: ctx.config.timeoutMs,
+                    });
+                    outcome = toolError.kind;
+                    if (toolError.kind === "unexpected") {
+                        ctx.logger.error("Unexpected tool failure", {
+                            tool: spec.name,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                    }
+                    return errorResult(toolError.message);
+                }
+                finally {
+                    ctx.logger.info("tool_call", {
+                        tool: spec.name,
+                        realm,
+                        outcome,
+                        durationMs: Date.now() - started,
+                    });
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=shared.js.map

package/dist/tools/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/tools/shared.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAkB,MAAM,uBAAuB,CAAC;AAyBzE,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,QAAQ,CAAC,0EAA0E,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,OAAO,EAAE;KACT,QAAQ,EAAE;KACV,QAAQ,CACP,0FAA0F,CAC3F,CAAC;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,aAAa,CAAC;SAClB,OAAO,CAAC,iBAAiB,CAAC;SAC1B,QAAQ,CACP,sCAAsC,iBAAiB,aAAa,aAAa,IAAI,CACtF;CACJ,CAAC;AAEF,4EAA4E;AAC5E,MAAM,UAAU,MAAM,CAAsB,IAAO;IACjD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC/D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAI,IAAkB,EAAE,KAAa,EAAE,GAAW;IACtE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC;AAaD,MAAM,UAAU,QAAQ,CAAoC,MAAqB;IAC/E,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACjD,iBAAiB,EAAE,MAAM,CAAC,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAwBD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,IAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC;IAChD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,2CAA2C,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,WAAW,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,0DAA0D,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;IAEnC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,CAAC,MAAM,EAAE,GAAG;YAClB,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM;gBACzB,WAAW,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,YAAY,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM;oBAClC,eAAe,EAAE,WAAW;oBAC5B,cAAc,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;oBACxD,aAAa,EAAE,KAAK;iBACrB;aACF,EACD,KAAK,EAAE,OAAO,EAA2B,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,OAAiC,CAAC;gBAC/C,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC;oBACH,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;wBAC3B,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAC;wBACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;4BAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC/D,CAAC;oBACD,IAAI,KAAK,KAAK,SAAS;wBAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1E,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;wBAC3E,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,OAA4C,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;wBACpF,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;oBAClE,CAAC;oBACD,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE;wBACxC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;wBACvB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS;wBAC/B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS;qBAChC,CAAC,CAAC;oBACH,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC;oBACzB,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACpC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;4BAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;yBAC9D,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxC,CAAC;wBAAS,CAAC;oBACT,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;wBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,KAAK;wBACL,OAAO;wBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}