qyl-mcp-server 7.1.0 → 7.2.0

package/README.md

@@ -9,7 +9,7 @@ npx qyl-mcp-server --stdio    # stdio MCP server
 npx qyl-mcp-server            # Streamable HTTP on 127.0.0.1:3001
 ```
 
-Works with any MCP client. Point it at a collector:
+Use a modern or 2025-era MCP client. Point it at a collector:
 
 ```bash
 export QYL_COLLECTOR_URL=http://127.0.0.1:5100
@@ -24,17 +24,53 @@ It is an OAuth 2.1 resource server, so an unauthenticated request answers `401`
 with an RFC 9728 protected-resource document that a stock MCP client follows on
 its own.
 
-Both accept only protocol revision `2026-07-28`, on MCP TypeScript SDK 2.0.0 —
-Streamable HTTP through `createMcpHandler` and stdio through `serveStdio`, each
-with `legacy: "reject"`.
+Both use MCP TypeScript SDK v2: Streamable HTTP through `createMcpHandler`
+and stdio through `serveStdio`, with their documented compatibility defaults.
+One factory serves revision `2026-07-28` and supported 2025-era requests.
+Events require `2026-07-28`.
 The HTTP server serves a product page at `/`; `/mcp` is the only protocol
 endpoint.
 
+## Hosted authentication
+
+The hosted Auth0 profile requires CIMD and DCR discovery, Authorization Code
+with PKCE S256, both `private_key_jwt` and `none` for ChatGPT CIMD compatibility,
+`none` for Claude CIMD, and issuer identification. Auth0 owns registration and token
+issuance; this server validates resource-bound RFC 9068 access tokens on every
+MCP request. It rejects malformed/query credentials, invalid tokens and
+insufficient scopes with distinct 400/401/403 responses.
+
+Optional resource-server integrations are selected explicitly:
+
+```sh
+MCP_AUTH_EXTENSIONS=enterprise-managed-authorization@1.0.0,oauth-client-credentials@1.0.0
+```
+
+Enterprise-managed authorization is stable upstream; client credentials is a
+draft extension. Both preserve the core token verifier and require matching
+Auth0 capabilities and separately provisioned client grants. Integration versions
+are independent of the MCP wire version. Embedders can use the exported
+`qyl-mcp-server/auth` composition API for additional declarative modules and
+explicit scope hierarchies.
+
+See the [deployment and authentication guide](https://github.com/ANcpLua/qyl.mcp#authentication)
+for Auth0 configuration, extension responsibilities, and verification. Auth0
+requires Enterprise for `private_key_jwt`. Neither a provider capability flag nor
+an enabled module proves a client has been provisioned.
+
 ## Tools
 
 **Telemetry** — `list_traces`, `get_trace`, `list_sessions`, `search_logs`,
 `ci_log`, `display_traces`, `display_mcp_dashboard`.
 
+`get_trace` returns every span by default. `errors_only` selects error spans;
+`max_spans` (1–1000) caps the result after filtering in Collector order.
+`include_attributes=false` omits span, resource, event, link and instrumentation
+scope attribute collections, including any returned root-span copy. Trace
+totals remain the Collector's totals; the text reports matching and returned
+counts. `ci_log.service_prefix` is case-sensitive, defaults to `qyl-ci`, and
+filters both recent runs and individual phase spans.
+
 **Metrics** — `list_metrics`, `get_metric_series`, `query_metric`. Read in that
 order: the catalog gives you an exact instrument name and how many attribute
 streams it has, series discovery tells you which attribute keys are worth
@@ -58,18 +94,20 @@ in-flight collector fetch instead of waiting out its timeout. Progress: a
 request that carries a `progressToken` gets `notifications/progress` per
 completed step, one per collector round trip plus a final "Result ready"
 (`ci_log` with a `run_id` reports the flatten into legs as a step of its own).
-Logging: the server declares the `logging` capability and sends one
-`notifications/message` per call, `info` on success and `warning` on failure,
-under the logger `qyl.mcp`. On revision `2026-07-28` the client's level travels
-per request in `_meta["io.modelcontextprotocol/logLevel"]`; a request without
-it gets no log line, and `logging/setLevel` does not exist in that revision.
-MCP logging is deprecated as of that revision (SEP-2577) and kept here through
-the deprecation window beside stderr and OpenTelemetry.
+Logging: the server declares no `logging` capability and sends no
+`notifications/message`, including when a client supplies a log level.
+Operational error diagnostics go to stderr; native tool timing/status telemetry
+uses OpenTelemetry. Requested progress and cancellation remain available.
+[Source and test commands/output, 2026-10-08](https://github.com/ANcpLua/qyl.mcp/blob/main/docs/evidence/2026-10-08-followup-01.md).
+
 
 Every inbound `tools/call` on a local server — `--stdio`, or HTTP without
-`MCP_PUBLIC_URL` — is recorded natively: validated result, lifecycle, duration,
-redacted JSON-RPC timeline, and trace/span correlation, persisted atomically to
-`~/.qyl/mcp-native-executions.json`. A public deployment (`MCP_PUBLIC_URL` set)
+`MCP_PUBLIC_URL` — records only its tool name, timing, status and error type,
+plus a server-generated execution ID, atomically in
+`~/.qyl/mcp-native-executions.json`. Arguments, request metadata, result bodies
+and error messages are not retained. Known version-1/2 files are reduced to
+this format on load; unreadable files still use the existing archive recovery
+path, and pre-existing archives are not purged. A public deployment (`MCP_PUBLIC_URL` set)
 records nothing to disk; that evidence file is a local developer artifact, not a
 multi-tenant audit log.
 
@@ -80,11 +118,15 @@ multi-tenant audit log.
 | `QYL_COLLECTOR_URL` | Collector read API base; default `http://127.0.0.1:5100`. Also the OTLP base when set. |
 | `QYL_API_KEY` | Collector read and OTLP credential. Outgoing only. |
 | `QYL_PROJECT` | Server-owned collector project scope; defaults to `default`. Never accepted as tool input. |
+| `MCP_COLLECTOR_PROJECTS` | Optional secret JSON mapping validated Auth0 subjects to project-bound Collector keys; see account isolation below. |
 | `QYL_OTLP_ENDPOINT` | Optional OTLP base for self-telemetry. |
 | `QYL_DEMO=1` | Explicit, visibly labelled demo telemetry. A collector failure never silently substitutes demo data. |
 | `QYL_MCP_TELEMETRY=0` | Disable MCP spans, metrics, and operation logs. |
-| `QYL_MCP_CAPTURE_CONTENT=1` | Include redacted, size-bounded request and response bodies in operation logs. Off by default. |
+| `QYL_MCP_CAPTURE_CONTENT=1` | Workbench content capture; native incoming tool-call telemetry never supplies request or response bodies. |
 | `QYL_MCP_NATIVE_STATE_PATH` | Override the native execution-evidence path. |
+| `MCP_EVENTS_STORE` | Persistent Events subscription file; requires Auth0 and the access-check credentials below. |
+| `MCP_EVENTS_AUTH0_CLIENT_ID` / `MCP_EVENTS_AUTH0_CLIENT_SECRET` | Dedicated Management API application with `read:users`, `read:clients`, `read:client_grants`, `read:grants`; resolves CIMD identities and keeps access checks current without storing subscriber tokens. |
+| `MCP_EVENTS_POLL_MS` | Collector polling interval, at least 5000 ms; default 30000 ms. |
 | `PORT` | HTTP listener port; default `3001`. |
 
 Secrets are redacted before results reach the model, structured content, or
@@ -94,8 +136,69 @@ durable evidence.
 The HTTP entry is a web-standard fetch handler served by its default export,
 so serving it requires Bun.
 
+### Account isolation for hosted Auth0
+
+To give a reviewer access to sample data, provision a separate Collector
+project/key through the Collector's `QYL_OTLP_PROJECT_KEYS` configuration and
+assign that key to the reviewer's validated Auth0 subject. Configure the MCP
+service's secret `MCP_COLLECTOR_PROJECTS` with this shape (placeholder values):
+
+```json
+[
+  { "project": "default", "apiKey": "OWNER_COLLECTOR_KEY", "subjects": ["auth0|owner-example"] },
+  { "project": "review", "apiKey": "REVIEW_COLLECTOR_KEY", "subjects": ["auth0|reviewer-example"] }
+]
+```
+
+Include every account that should retain access, including the owner. An
+enabled map rejects unmapped callers and never falls back to `QYL_API_KEY`.
+Missing, malformed, duplicate or conflicting entries fail validation. The
+feature requires the hosted Auth0 configuration; local stdio and Cloudflare
+Access deployments cannot enable this map. When the variable is absent, the
+existing deployment-wide credential behavior is retained.
+
+Only the verified SDK `AuthInfo.extra.subject` selects the project. Tool inputs
+and request metadata cannot override it. All telemetry tools, viewer refreshes
+and Events queries use that account's project credential. Removing the account
+assignment revokes its Events subscription on the next access check. Project
+keys are redacted from text and structured results, including keys nested in
+this JSON configuration. Keep the map in host secrets and out of the plugin ZIP.
+
+`bun run smoke:projects` from the repository root checks all eleven tools,
+viewer query paths, both protocol eras and Events against a real local
+Collector with two temporary projects. Set `QYL_COLLECTOR_PROJECT` to its
+`.csproj` when using a different checkout. The script uses local test identities
+and an in-process signed webhook receiver; the hosted reviewer OAuth login and
+real ChatGPT demonstration are separate checks before upload.
+
 ## Release notes
 
+### 7.2.0
+
+- Removed deprecated MCP logging capability and per-call log notifications;
+  retained requested progress, cancellation and native operation telemetry.
+  [Dated verification, 2026-10-08](https://github.com/ANcpLua/qyl.mcp/blob/main/docs/evidence/2026-10-08-followup-01.md).
+
+- Optional Auth0-account-to-Collector project isolation, also applied to Events.
+- Events share polling for accounts assigned to the same project; independent
+  projects are polled concurrently. Invalid stdio project configuration fails
+  before accepting a connection.
+- Workbench telemetry recognizes the SDK's per-request server factory so native
+  tool spans are not duplicated by the surrounding protocol journal, while
+  failed server construction still produces a correlated failure span.
+
+### 7.1.1
+
+- SDK v2.3.1 serving defaults accept modern and 2025-era tool clients over HTTP
+  and stdio. The workbench negotiates automatically. The strict policy described
+  under 6.0.0 below has been removed.
+- Events recheck account status, explicit client access, user permissions and
+  consent through Auth0. Unsubscribe aborts outstanding deliveries; restart
+  cleanup removes expired subscriptions and obsolete signing keys.
+- Public viewers declare their deployment origin and keep the requested trace
+  limit on refresh. Release verification exercises a fresh npm consumer with
+  modern and 2025-era discovery and a real demo-tool call.
+
 ### 7.1.0
 
 - The hosted server can sit behind Cloudflare Access Managed OAuth:

package/dist/auth-extensions.d.ts

@@ -0,0 +1,20 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/server";
+/** Resource-server integrations, versioned separately from the MCP wire revision.
+ * Extensions declare provider requirements; they cannot replace token verification,
+ * mint tokens, rewrite discovery, or grant scopes to a caller.
+ */
+export interface AuthorizationExtension {
+    readonly id: string;
+    readonly version: string;
+    readonly stability: "stable" | "draft";
+    readonly specification: string;
+    readonly requirements: Readonly<Record<string, true | readonly string[]>>;
+}
+export declare const enterpriseManagedAuthorization: AuthorizationExtension;
+export declare const clientCredentialsAuthorization: AuthorizationExtension;
+export declare const authorizationExtensions: readonly AuthorizationExtension[];
+/** Explicit version pins are mandatory, including for draft integrations. */
+export declare function resolveAuthorizationExtensions(selections: readonly string[], available?: readonly AuthorizationExtension[]): readonly AuthorizationExtension[];
+export declare function readAuthorizationExtensions(environment: Readonly<Record<string, string | undefined>>): readonly AuthorizationExtension[];
+/** Union requirements deterministically; a composition can only add requirements. */
+export declare function validateAuthorizationExtensions(metadata: OAuthMetadata, extensions: readonly AuthorizationExtension[]): void;

package/dist/auth-extensions.js

@@ -0,0 +1,81 @@
+export const enterpriseManagedAuthorization = {
+    id: "enterprise-managed-authorization",
+    version: "1.0.0",
+    stability: "stable",
+    specification: "https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/stable/enterprise-managed-authorization.mdx",
+    requirements: {
+        grant_types_supported: ["urn:ietf:params:oauth:grant-type:jwt-bearer"],
+        authorization_grant_profiles_supported: ["urn:ietf:params:oauth:grant-profile:id-jag"],
+    },
+};
+export const clientCredentialsAuthorization = {
+    id: "oauth-client-credentials",
+    version: "1.0.0",
+    stability: "draft",
+    specification: "https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx",
+    requirements: {
+        grant_types_supported: ["client_credentials"],
+        token_endpoint_auth_methods_supported: ["private_key_jwt"],
+    },
+};
+export const authorizationExtensions = [
+    enterpriseManagedAuthorization,
+    clientCredentialsAuthorization,
+];
+/** Explicit version pins are mandatory, including for draft integrations. */
+export function resolveAuthorizationExtensions(selections, available = authorizationExtensions) {
+    const resolved = selections.map((selection) => {
+        const matches = available.filter((entry) => `${entry.id}@${entry.version}` === selection);
+        if (matches.length > 1)
+            throw new Error(`Ambiguous authorization extension registration: ${selection}`);
+        const extension = matches[0];
+        if (!extension)
+            throw new Error(`Unknown authorization extension/version: ${selection}`);
+        return extension;
+    });
+    assertUniqueExtensions(resolved);
+    return resolved;
+}
+export function readAuthorizationExtensions(environment) {
+    const configured = environment.MCP_AUTH_EXTENSIONS?.trim();
+    if (!configured)
+        return [];
+    return resolveAuthorizationExtensions(configured.split(",").map((value) => value.trim()));
+}
+function assertUniqueExtensions(extensions) {
+    const ids = new Set();
+    for (const extension of extensions) {
+        if (!/^[a-z][a-z0-9-]+$/u.test(extension.id)
+            || !/^\d+\.\d+\.\d+$/u.test(extension.version)) {
+            throw new Error("Authorization extensions require an ID and an exact integration version");
+        }
+        if (ids.has(extension.id))
+            throw new Error(`Duplicate authorization extension: ${extension.id}`);
+        ids.add(extension.id);
+    }
+}
+/** Union requirements deterministically; a composition can only add requirements. */
+export function validateAuthorizationExtensions(metadata, extensions) {
+    assertUniqueExtensions(extensions);
+    const requirements = new Map();
+    for (const extension of extensions) {
+        for (const [field, expected] of Object.entries(extension.requirements)) {
+            const existing = requirements.get(field);
+            if (existing !== undefined && (existing === true) !== (expected === true)) {
+                throw new Error(`Conflicting authorization extension requirements for ${field}`);
+            }
+            if (expected === true)
+                requirements.set(field, true);
+            else
+                requirements.set(field, new Set([...(existing instanceof Set ? existing : []), ...expected]));
+        }
+    }
+    for (const [field, expected] of [...requirements].sort(([a], [b]) => a.localeCompare(b))) {
+        const actual = metadata[field];
+        if (expected === true ? actual !== true
+            : !Array.isArray(actual) || ![...expected].every((value) => actual.includes(value))) {
+            throw new Error(`Authorization Server does not satisfy enabled extension requirement: ${field}`);
+        }
+    }
+}
+//# sourceMappingURL=auth-extensions.js.map

package/dist/auth-extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-extensions.js","sourceRoot":"","sources":["../src/auth-extensions.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,8BAA8B,GAA2B;IACpE,EAAE,EAAE,kCAAkC;IACtC,OAAO,EAAE,OAAO;IAChB,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,sHAAsH;IACrI,YAAY,EAAE;QACZ,qBAAqB,EAAE,CAAC,6CAA6C,CAAC;QACtE,sCAAsC,EAAE,CAAC,4CAA4C,CAAC;KACvF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAA2B;IACpE,EAAE,EAAE,0BAA0B;IAC9B,OAAO,EAAE,OAAO;IAChB,SAAS,EAAE,OAAO;IAClB,aAAa,EAAE,6GAA6G;IAC5H,YAAY,EAAE;QACZ,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,qCAAqC,EAAE,CAAC,iBAAiB,CAAC;KAC3D;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAsC;IACxE,8BAA8B;IAC9B,8BAA8B;CAC/B,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC5C,UAA6B,EAC7B,SAAS,GAAsC,uBAAuB;IAEtE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,WAAyD;IAEzD,MAAM,UAAU,GAAG,WAAW,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,8BAA8B,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA6C;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;eACvC,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,+BAA+B,CAC7C,QAAuB,EACvB,UAA6C;IAE7C,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI;gBAAE,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;;gBAChD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;YACrC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,wEAAwE,KAAK,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,4 @@
+/** Public composition surface for hosted resource authorization. */
+export { createResourceAuthorization, type ResourceAuthorizationOptions } from "./authorization.js";
+export { authorizationExtensions, clientCredentialsAuthorization, enterpriseManagedAuthorization, readAuthorizationExtensions, resolveAuthorizationExtensions, validateAuthorizationExtensions, type AuthorizationExtension, } from "./auth-extensions.js";
+export { createJwtTokenVerifier, loadHostedOAuth, type HostedOAuth } from "./oauth.js";

package/dist/auth.js

@@ -0,0 +1,5 @@
+/** Public composition surface for hosted resource authorization. */
+export { createResourceAuthorization } from "./authorization.js";
+export { authorizationExtensions, clientCredentialsAuthorization, enterpriseManagedAuthorization, readAuthorizationExtensions, resolveAuthorizationExtensions, validateAuthorizationExtensions, } from "./auth-extensions.js";
+export { createJwtTokenVerifier, loadHostedOAuth } from "./oauth.js";
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,OAAO,EAAE,2BAA2B,EAAqC,MAAM,oBAAoB,CAAC;AACpG,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,+BAA+B,GAEhC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAoB,MAAM,YAAY,CAAC"}

package/dist/authorization.d.ts

@@ -0,0 +1,14 @@
+import { type AuthInfo, type OAuthTokenVerifier } from "@modelcontextprotocol/server";
+export interface ResourceAuthorizationOptions {
+    readonly verifier: OAuthTokenVerifier;
+    readonly resourceMetadataUrl: string;
+    readonly requiredScopes: readonly string[];
+    /** Explicit implications only; a wildcard-looking string grants nothing by itself. */
+    readonly scopeImplications?: Readonly<Record<string, readonly string[]>>;
+}
+/** A hierarchy is an explicit, transitive relation. Cycles terminate and never
+ * grant a scope without a verified scope as their starting point.
+ */
+export declare function scopeClosure(granted: readonly string[], implications: ReadonlyMap<string, readonly string[]>): ReadonlySet<string>;
+/** All grants converge on this gate. Extensions never see an unverified token. */
+export declare function createResourceAuthorization(options: ResourceAuthorizationOptions): (request: Request) => Promise<AuthInfo | Response>;

package/dist/authorization.js

@@ -0,0 +1,82 @@
+import { requireBearerAuth, } from "@modelcontextprotocol/server";
+function validateScopes(scopes) {
+    for (const scope of scopes) {
+        // RFC 6749 scope-token excludes quotes, backslashes and whitespace.
+        if (!/^[\x21\x23-\x5B\x5D-\x7E]+$/u.test(scope) || scope === "offline_access") {
+            throw new Error("Resource scopes must be valid OAuth scope tokens and cannot include offline_access");
+        }
+    }
+}
+/** A hierarchy is an explicit, transitive relation. Cycles terminate and never
+ * grant a scope without a verified scope as their starting point.
+ */
+export function scopeClosure(granted, implications) {
+    const result = new Set(granted);
+    const pending = [...granted];
+    for (let i = 0; i < pending.length; i++) {
+        for (const implied of implications.get(pending[i]) ?? []) {
+            if (!result.has(implied)) {
+                result.add(implied);
+                pending.push(implied);
+            }
+        }
+    }
+    return result;
+}
+/** All grants converge on this gate. Extensions never see an unverified token. */
+export function createResourceAuthorization(options) {
+    const requiredScopes = [...new Set(options.requiredScopes)].sort();
+    validateScopes(requiredScopes);
+    const implications = new Map(Object.entries(options.scopeImplications ?? {})
+        .map(([scope, implied]) => {
+        validateScopes([scope, ...implied]);
+        return [scope, [...implied]];
+    }));
+    const metadataUrl = new URL(options.resourceMetadataUrl);
+    if (metadataUrl.protocol !== "https:" || metadataUrl.username || metadataUrl.password
+        || metadataUrl.search || metadataUrl.hash || /["\\]/u.test(options.resourceMetadataUrl)
+        || Array.from(options.resourceMetadataUrl).some((character) => character.charCodeAt(0) <= 0x20)) {
+        throw new Error("Resource metadata must use a safe HTTPS URL");
+    }
+    const coreGate = requireBearerAuth({
+        verifier: options.verifier,
+        resourceMetadataUrl: metadataUrl.href,
+    });
+    const challenge = (status, error) => {
+        const parameters = [
+            ...(error === undefined ? [] : [`error="${error}"`]),
+            ...(requiredScopes.length === 0 ? [] : [`scope="${requiredScopes.join(" ")}"`]),
+            `resource_metadata="${metadataUrl.href}"`,
+        ];
+        return Response.json({ error: error ?? "unauthorized" }, {
+            status,
+            headers: { "WWW-Authenticate": `Bearer ${parameters.join(", ")}`, "Cache-Control": "no-store" },
+        });
+    };
+    return async (request) => {
+        const authorization = request.headers.get("authorization");
+        const bearer = authorization === null ? null : /^Bearer +([A-Za-z0-9._~+/-]+=*)$/iu.exec(authorization);
+        if (new URL(request.url).searchParams.has("access_token")
+            || (authorization !== null && bearer === null)) {
+            return challenge(400, "invalid_request");
+        }
+        // RFC 6750 permits multiple spaces. The SDK splits on one space; normalize
+        // the validated header on a bodyless request so the MCP body remains unread.
+        const auth = await coreGate(bearer === null ? request : new Request(request.url, {
+            headers: { authorization: `Bearer ${bearer[1]}` },
+        }));
+        if (auth instanceof Response) {
+            // Keep authentication failures distinct from authorization failures and
+            // include the complete operation scope set on every challenge.
+            if (auth.status === 401)
+                return challenge(401, authorization === null ? undefined : "invalid_token");
+            return auth;
+        }
+        const effectiveScopes = scopeClosure(auth.scopes, implications);
+        if (!requiredScopes.every((scope) => effectiveScopes.has(scope))) {
+            return challenge(403, "insufficient_scope");
+        }
+        return auth;
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAGlB,MAAM,8BAA8B,CAAC;AAUtC,SAAS,cAAc,CAAC,MAAyB;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,oEAAoE;QACpE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA0B,EAC1B,YAAoD;IAEpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,cAAc,CAAC,cAAc,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACzE,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE;QACxB,cAAc,CAAC,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAU,CAAC;IACxC,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ;WAChF,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;WACpF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,WAAW,CAAC,IAAI;KACtC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,KAAc,EAAY,EAAE;QAC7D,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;YACpD,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/E,sBAAsB,WAAW,CAAC,IAAI,GAAG;SAC1C,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,cAAc,EAAE,EAAE;YACvD,MAAM;YACN,OAAO,EAAE,EAAE,kBAAkB,EAAE,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SAChG,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;eACpD,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,IAAI,YAAY,QAAQ,EAAE,CAAC;YAC7B,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/ci.d.ts

@@ -15,11 +15,11 @@ import type { McpServer } from "@modelcontextprotocol/server";
 import type { Mode, QylSession, QylTrace } from "./wire.js";
 /** Resource service-name prefix that marks telemetry as CI-emitted. */
 export declare const CI_SERVICE_PREFIX = "qyl-ci";
-/** CI sessions are the ones that carry at least one qyl-ci service. */
-export declare function filterCiSessions(sessions: QylSession[]): QylSession[];
+/** CI sessions carry at least one service matching the requested prefix. */
+export declare function filterCiSessions(sessions: QylSession[], servicePrefix?: string): QylSession[];
 /** Flatten a run's traces into per-leg phases, failures first. */
-export declare function collectCiPhases(traces: QylTrace[]): CiPhase[];
-export declare function summarizeCiRuns(runs: CiRunSummary[], mode: Mode): string;
-export declare function summarizeCiRun(runId: string, phases: CiPhase[], mode: Mode): string;
+export declare function collectCiPhases(traces: QylTrace[], servicePrefix?: string): CiPhase[];
+export declare function summarizeCiRuns(runs: CiRunSummary[], mode: Mode, servicePrefix?: string): string;
+export declare function summarizeCiRun(runId: string, phases: CiPhase[], mode: Mode, servicePrefix?: string): string;
 /** Register the CI dogfooding block. */
 export declare function registerCiTools(server: McpServer): void;

package/dist/ci.js

@@ -2,12 +2,12 @@ import { CiLogInputSchema, CiLogOutputSchema, compactOutputSchema, } from "./con
 import { fetchSessions, fetchSessionTraces } from "./data.js";
 import { runTool } from "./request-scope.js";
 import { telemetryToolResult } from "./telemetry-redaction.js";
-import { READ_ONLY_TELEMETRY_TOOL_ANNOTATIONS } from "./tools.js";
+import { READ_ONLY_TELEMETRY_TOOL_ANNOTATIONS, TELEMETRY_TOOL_AUTH_META } from "./tools.js";
 /** Resource service-name prefix that marks telemetry as CI-emitted. */
 export const CI_SERVICE_PREFIX = "qyl-ci";
-/** CI sessions are the ones that carry at least one qyl-ci service. */
-export function filterCiSessions(sessions) {
-    return sessions.filter((session) => session.services.some((service) => service.startsWith(CI_SERVICE_PREFIX)));
+/** CI sessions carry at least one service matching the requested prefix. */
+export function filterCiSessions(sessions, servicePrefix = CI_SERVICE_PREFIX) {
+    return sessions.filter((session) => session.services.some((service) => service.startsWith(servicePrefix)));
 }
 function spanLeg(span) {
     const attribute = span.attributes?.find((entry) => entry.key === "ci.leg");
@@ -16,8 +16,8 @@ function spanLeg(span) {
         : span.resource.service_name;
 }
 /** Flatten a run's traces into per-leg phases, failures first. */
-export function collectCiPhases(traces) {
-    const phases = traces.flatMap((trace) => trace.spans.map((span) => ({
+export function collectCiPhases(traces, servicePrefix = CI_SERVICE_PREFIX) {
+    const phases = traces.flatMap((trace) => trace.spans.filter((span) => span.resource.service_name.startsWith(servicePrefix)).map((span) => ({
         leg: spanLeg(span),
         phase: span.name,
         status: span.status.code === 2 ? "error" : span.status.code === 1 ? "ok" : "unset",
@@ -32,10 +32,10 @@ export function collectCiPhases(traces) {
                 ? 1
                 : 0);
 }
-export function summarizeCiRuns(runs, mode) {
+export function summarizeCiRuns(runs, mode, servicePrefix = CI_SERVICE_PREFIX) {
     if (runs.length === 0) {
         return `No CI runs found (${mode} mode). CI telemetry appears once runs emit ` +
-            `spans with a '${CI_SERVICE_PREFIX}*' service.name.`;
+            `spans with a '${servicePrefix}*' service.name.`;
     }
     const lines = runs.map((run) => {
         const failure = run.error_count > 0 ? `${run.error_count} error(s)` : "clean";
@@ -44,9 +44,9 @@ export function summarizeCiRuns(runs, mode) {
     });
     return `${runs.length} CI run(s) (${mode} mode), pass a run_id for the per-leg breakdown:\n${lines.join("\n")}`;
 }
-export function summarizeCiRun(runId, phases, mode) {
+export function summarizeCiRun(runId, phases, mode, servicePrefix = CI_SERVICE_PREFIX) {
     if (phases.length === 0) {
-        return `CI run ${runId} has no phase spans (${mode} mode).`;
+        return `CI run ${runId} has no phase spans matching '${servicePrefix}*' (${mode} mode).`;
     }
     const legs = new Map();
     for (const phase of phases) {
@@ -71,29 +71,35 @@ export function summarizeCiRun(runId, phases, mode) {
 export function registerCiTools(server) {
     server.registerTool("ci_log", {
         title: "CI Log",
-        description: "Read qyl's own CI runs from its telemetry (dogfooding — no GitHub API). " +
-            "Without arguments: recent CI runs (sessions whose service.name starts with " +
-            `'${CI_SERVICE_PREFIX}'). With run_id: per-leg phase breakdown, failures first, ` +
-            "so 'which leg hung on what' is answerable even when GitHub's log API is down.",
+        description: "Read CI telemetry from qyl when the user wants recent runs or a per-leg " +
+            "phase breakdown with failures first. Any CI can emit this convention: " +
+            `resource service.name starts with service_prefix (default '${CI_SERVICE_PREFIX}'), session.id identifies ` +
+            "the run, and one span per phase carries a ci.leg attribute; failed phases " +
+            "set span status to error. Without run_id, filters the 50 most recent " +
+            "sessions and returns up to limit matching runs (default 10). With run_id, " +
+            "reads up to 100 traces for that session and returns only phases matching " +
+            "the same case-sensitive service prefix; phase output can be large.",
         inputSchema: CiLogInputSchema,
         outputSchema: compactOutputSchema(CiLogOutputSchema),
         annotations: READ_ONLY_TELEMETRY_TOOL_ANNOTATIONS,
+        _meta: TELEMETRY_TOOL_AUTH_META,
     }, (args, ctx) => 
     // A run breakdown is two units a client can watch: the collector round
     // trip for the run's traces, then the flatten into per-leg phases. The
     // run list is one round trip.
-    runTool(ctx, "ci_log", args.run_id ? 2 : 1, async (scope) => {
+    runTool(ctx, args.run_id ? 2 : 1, async (scope) => {
+        const servicePrefix = args.service_prefix ?? CI_SERVICE_PREFIX;
         if (args.run_id) {
             const { traces, mode } = await fetchSessionTraces(args.run_id, 100, scope.collector);
             await scope.step(`Fetched ${traces.length} trace(s) of CI run ${args.run_id}`);
-            const phases = collectCiPhases(traces);
+            const phases = collectCiPhases(traces, servicePrefix);
             const legs = new Set(phases.map((phase) => phase.leg)).size;
             await scope.step(`Collected ${phases.length} phase(s) across ${legs} leg(s)`);
             const output = { run_id: args.run_id, phases, mode };
-            return telemetryToolResult(summarizeCiRun(args.run_id, phases, mode), output);
+            return telemetryToolResult(summarizeCiRun(args.run_id, phases, mode, servicePrefix), output);
         }
         const { sessions, mode } = await fetchSessions(50, undefined, scope.collector);
-        const runs = filterCiSessions(sessions)
+        const runs = filterCiSessions(sessions, servicePrefix)
             .slice(0, args.limit ?? 10)
             .map((session) => ({
             run_id: session["session_id"],
@@ -105,7 +111,7 @@ export function registerCiTools(server) {
         }));
         await scope.step(`Found ${runs.length} CI run(s) among ${sessions.length} session(s)`);
         const output = { runs, mode };
-        return telemetryToolResult(summarizeCiRuns(runs, mode), output);
+        return telemetryToolResult(summarizeCiRuns(runs, mode, servicePrefix), output);
     }));
 }
 //# sourceMappingURL=ci.js.map

package/dist/ci.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAGlE,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,QAAsB;IACrD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IAC3E,OAAO,OAAO,SAAS,EAAE,KAAK,KAAK,QAAQ;QACzC,CAAC,CAAC,SAAS,CAAC,KAAK;QACjB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACtC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAW,EAAE,CAAC,CAAC;QAClC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;QAClB,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAClF,WAAW,EAAE,IAAI,CAAC,GAAG,CACnB,CAAC,EACD,IAAI,CAAC,KAAK,CACR,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,SAAS,CACxF,CACF;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACnB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO;YACpB,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO;gBACpB,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC,CACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAoB,EAAE,IAAU;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,qBAAqB,IAAI,8CAA8C;YAC5E,iBAAiB,iBAAiB,kBAAkB,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,UAAU,IAAI,QAAQ,MAAM,OAAO,EAAE,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,CAAC,MAAM,eAAe,IAAI,qDAAqD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAiB,EAAE,IAAU;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,UAAU,KAAK,wBAAwB,IAAI,SAAS,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,UAAU,KAAK,KAAK,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;QACE,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,0EAA0E;YAC1E,6EAA6E;YAC7E,IAAI,iBAAiB,4DAA4D;YACjF,+EAA+E;QACjF,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;QACpD,WAAW,EAAE,oCAAoC;KAClD,EACD,CAAC,IAAgB,EAAE,GAAkB,EAA2B,EAAE;IAChE,uEAAuE;IACvE,uEAAuE;IACvE,8BAA8B;IAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,oBAAoB,IAAI,SAAS,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,mBAAmB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC;aACpC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;aAC1B,GAAG,CAAC,CAAC,OAAO,EAAgB,EAAE,CAAC,CAAC;YAC/B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;YAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAClF,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAC;QACN,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,oBAAoB,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;QACvF,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG5F,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAC9B,QAAsB,EACtB,aAAa,GAAG,iBAAiB;IAEjC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IAC3E,OAAO,OAAO,SAAS,EAAE,KAAK,KAAK,QAAQ;QACzC,CAAC,CAAC,SAAS,CAAC,KAAK;QACjB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,aAAa,GAAG,iBAAiB;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACtC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAW,EAAE,CAAC,CAAC;QACzG,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;QAClB,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAClF,WAAW,EAAE,IAAI,CAAC,GAAG,CACnB,CAAC,EACD,IAAI,CAAC,KAAK,CACR,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,SAAS,CACxF,CACF;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACnB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO;YACpB,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO;gBACpB,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC,CACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAoB,EAAE,IAAU,EAAE,aAAa,GAAG,iBAAiB;IACjG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,qBAAqB,IAAI,8CAA8C;YAC5E,iBAAiB,aAAa,kBAAkB,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,UAAU,IAAI,QAAQ,MAAM,OAAO,EAAE,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,CAAC,MAAM,eAAe,IAAI,qDAAqD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAAiB,EACjB,IAAU,EACV,aAAa,GAAG,iBAAiB;IAEjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,UAAU,KAAK,iCAAiC,aAAa,OAAO,IAAI,SAAS,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,UAAU,KAAK,KAAK,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;QACE,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,0EAA0E;YAC1E,wEAAwE;YACxE,8DAA8D,iBAAiB,4BAA4B;YAC3G,4EAA4E;YAC5E,uEAAuE;YACvE,4EAA4E;YAC5E,2EAA2E;YAC3E,oEAAoE;QACtE,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;QACpD,WAAW,EAAE,oCAAoC;QACjD,KAAK,EAAE,wBAAwB;KAChC,EACD,CAAC,IAAgB,EAAE,GAAkB,EAA2B,EAAE;IAChE,uEAAuE;IACvE,uEAAuE;IACvE,8BAA8B;IAC9B,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,oBAAoB,IAAI,SAAS,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,mBAAmB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC;aACnD,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;aAC1B,GAAG,CAAC,CAAC,OAAO,EAAgB,EAAE,CAAC,CAAC;YAC/B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;YAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAClF,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAC;QACN,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,oBAAoB,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;QACvF,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IACjF,CAAC,CAAC,CACL,CAAC;AACJ,CAAC"}

package/dist/collector-access.d.ts

@@ -0,0 +1,17 @@
+/** A project-bound Collector credential, supplied only by host configuration. */
+export interface CollectorAccess {
+    readonly project: string;
+    readonly apiKey: string;
+}
+/** Safe to return to a caller; never includes subjects, projects or credentials. */
+export declare class CollectorAccessError extends Error {
+    constructor();
+}
+/**
+ * Opt-in subject-to-project access. Absence retains the single-project setup;
+ * present-but-invalid configuration and unassigned callers never fall back.
+ * Values stay in the host's secret configuration, not in tool arguments.
+ */
+export declare function readCollectorProjects(environment?: Readonly<Record<string, string | undefined>>): ReadonlyMap<string, CollectorAccess> | undefined;
+/** Pass only the subject from verified SDK AuthInfo, never request metadata. */
+export declare function collectorAccessForSubject(subject: unknown, environment?: Readonly<Record<string, string | undefined>>): CollectorAccess | undefined;