salesforce-metadata-mcp 2.12.0 → 3.2.0

package/CHANGELOG.md

@@ -1,5 +1,258 @@
 # Changelog
 
+## [3.2.0] - 2026-09-23
+
+A full-surface QA release. Every one of the 233 tools was called individually over real MCP traffic
+(`tools/call` → schema → service → org) against a Developer Edition org and a scratch org with
+Communities, Service Cloud, Knowledge and Omni-Channel enabled, and each result was checked in the
+org with the sf CLI — never by the server under test. **3.1.0 and 3.1.1 were never published to npm,
+so this release also carries them** (lazy-toolset fallback, `sf_query_records` limit, `sf_find_tool`
+search — see below).
+
+Result on the scratch org: **170 PASS / 41 feature-unavailable / 4 org-limit / 17 open**, up from a
+baseline of 100 PASS / 114 failing on the first sweep. None of the 17 open items is a tool sending a
+wrong payload for a feature the org has: they are cascades (OmniStudio not installed, an org cap
+reached earlier in the run), unlicensed features (Agentforce, Einstein, Digital Engagement) and
+fixture gaps. **No tool claims success without doing the work.**
+
+### Fixed: tools that silently replaced a whole component
+`upsertMetadata` replaces what it names. Eight tools sent only the part they were changing, so they
+either failed or would have wiped the rest: compact layouts / list views / search layouts, queue
+routing config, connected-app OAuth policy, the five Workflow children (a `Workflow` upsert replaces
+an object's entire workflow — the old 500s were the only reason nothing was lost), business hours,
+holidays, LWC Jest tests, and forecasting settings. Each now addresses its component directly or
+reads, modifies and writes it back.
+
+### Fixed: tools that could not succeed at all
+Around 50 tools, including: custom tabs, custom notification types, roles (access-level enum and
+forecast-manager default), FlexiPages, SAML SSO, change data capture, quick/global actions, auth
+providers with custom endpoints, sharing rules, dashboards, path assistants, scheduled flows,
+duplicate rules (a bare Allow is rejected — Allow now carries Report), data category groups
+(`KnowledgeArticleVersion`), service territories (operating hours), Experience sites (now created
+through the Connect API from a real template), and package versions (`--installation-key-bypass`).
+The full create → version → install → uninstall packaging chain is verified end to end.
+
+### Fixed: errors nobody could act on
+Bare 404s and 500s now name the cause: sandboxes and change sets on editions without them, DevOps
+Center not installed, a connected app on an org that only allows External Client Apps, an Experience
+page (Salesforce has no REST endpoint for creating one — the tool now says so), scheduled-job compile
+errors, and upserts whose external-ID field is invisible to the running user.
+
+### Changed
+- `sf_create_forecast_hierarchy`: `forecastingType` is now a string checked against the org (the old
+  enum offered names that do not exist). Unknown names return the org's list.
+- `sf_create_experience_site` returns the site URL, Builder link and the Site API names Salesforce
+  chose (it derives them from the label).
+
+### Added
+- `qa-full-sweep.mjs` and friends: the full-surface sweep, with a four-way verdict
+  (PASS / UNAVAIL / LIMIT / BUG). `QA_DEVHUB=<alias>` enables the real packaging chain.
+- `qa-workflow-children.mjs`, `qa-translation-merge.mjs`, `qa-scratch-fixes.mjs`: pins for the
+  fixes above.
+
+## [3.1.1] - 2026-09-09
+
+Three bugs reported against a Claude Desktop session. **None were introduced by 3.1.0.** Two date to
+the first public release (`f808b50`, v2.6.5) and one to the lazy-toolsets change in 3.0.0
+(`479a40d`) — traced with `git log -S`/`-L`, not assumed.
+
+### Fixed: `sf_query_records` ignored its own `limit` (since v2.6.5)
+
+`limit` was only interpolated into the SOQL `queryRecords` *builds* from `objectApiName`/`fields`.
+Every call through `sf_query_records` passes a `query` string, which takes the other branch, so the
+parameter — and its documented default of 200 — did nothing. A caller setting `limit: 100` to stay
+small got 1,323 rows and no warning; the failure was silent and failed open.
+
+The cap is now applied by rewriting the outgoing SOQL, so it reduces what Salesforce sends rather
+than only what the tool returns. **Precedence is `min(parameter, LIMIT in the query)`**: the
+parameter is a guardrail, so a `LIMIT` in the query string may tighten it but never raise it, while
+a caller who explicitly wrote `LIMIT 5` still gets 5.
+
+A cap that is applied but not reported would just be a silent truncation — the same bug wearing a
+different hat — so the response now carries `appliedLimit`, `limitSource` and `truncated`, and the
+message says when rows were cut off. `truncated` is a fact, not a guess: one row beyond the cap is
+fetched to distinguish "exactly N matched" from "more than N matched", then discarded. Aggregate
+(`COUNT()`), `OFFSET` and `FOR UPDATE` queries are handled without being rewritten into invalid SOQL.
+
+### Fixed: `sf_find_tool` returned nothing for multi-word queries (since v3.0.0)
+
+The search required *every* token to appear in a tool name, so any natural-language phrase returned
+`matches: []` — including two of the tool's own documented examples. That is the worst moment to
+return an empty list: this tool is reached precisely when someone cannot find a capability and is
+describing it in words, and an empty result reads as "no such tool exists" rather than "rephrase".
+
+Matching is now scored rather than filtered — any token can match, ranked by how many hit, with an
+exact tool name always first. Tool **titles and descriptions are searched too**, at a lower weight
+than names, because a phrase like *"run some apex code in the org"* cannot be resolved from names
+alone (`sf_run_apex_tests` wins on tokens while the caller means `sf_execute_anonymous_apex`).
+Common filler words are dropped.
+
+Two guards came with it, since a looser match could otherwise undo the point of lazy toolsets:
+results are capped at the 25 best matches, and a single search auto-loads at most 3 toolsets — those
+from the top-scoring band only. Lower-ranked matches are named in the response instead of loaded.
+
+### Fixed: Salesforce error messages truncated mid-sentence (since v2.6.5)
+
+API error bodies were cut with a flat `slice(0, 300)`, and Salesforce puts the actionable part at
+the end — *"…be sure to append the '__c' after the entity name. Please refer to…"* arrived as
+*"…Please ref"*. A cap is still wanted, since an error body can be a whole HTML page, so oversized
+errors now keep a generous head **and** the tail, with a count of what was dropped.
+
+### Notes
+
+- `sf_find_tool` now attaches input schemas to the top 3 **ranked** matches rather than only when
+  the whole result set was ≤3. Broader matching pushed even exact-name queries past that threshold,
+  which cost them the schema `sf_call_tool` needs.
+- **Inlined schemas are now bounded by size, not just count** — found by measuring the release
+  rather than from a report. A count is not a bound: `sf_create_flow` serialises to ~28KB, so
+  `sf_find_tool("create flow")` was returning ~8,500 tokens, most of what a whole default startup
+  costs. v3.0.0 had moved that tool out of the default toolset for exactly this reason, and inlining
+  it on search quietly put it back. Oversized schemas are now named with a pointer to
+  `sf_tool_schema` instead of being sent. Measured after: 8,532 → 1,721 tokens for the same call,
+  and every `sf_find_tool` response now lands between ~1.4k and ~2.5k tokens.
+- New `qa-query-limit.mjs` (17 checks) covers the cap, its precedence, truncation reporting, the
+  aggregate/OFFSET edge cases and the error-text length. `qa-toolsets.mjs` gains natural-language
+  search coverage and the auto-load bounds (26 → 38 checks).
+- Verified against `demo-org` before and after: `limit: 3` returned 1,764 rows before the fix and 3
+  after.
+
+## [3.1.0] - 2026-09-09
+
+### Fixed: loaded toolsets could be unreachable on clients that ignore `list_changed`
+
+Reported against Claude Desktop: `sf_load_toolset(["apex","data"])` returned `success: true` with
+`residentTools` moving 18 → 47, `sf_find_tool` confirmed the tools existed in a loaded toolset, and
+not one of them was ever callable. The entire write surface of the server — anonymous Apex, record
+creation, bulk insert — was unreachable for a whole session while every status payload reported
+healthy. Reads kept working, because the initially-resident set was never affected.
+
+The server was not violating the protocol. It declares `tools.listChanged`, emits exactly one
+`notifications/tools/list_changed` per load, and `tools/list` genuinely changes — all now asserted
+end-to-end in `qa-client-refetch.mjs`. The client never re-fetched.
+
+Being protocol-correct was not enough. Lazy toolsets put 210 of 228 tools behind an *optional*
+client behaviour with no fallback when it is absent, so v3.1.0 adds one that needs no re-fetch:
+
+- **`sf_call_tool({ tool, arguments })`** — invokes any tool by name whether or not its toolset is
+  loaded and whether or not it appears in the client's tool list. Arguments are validated against
+  the same zod schema, and the handler it calls is the guard-wrapped one, so the production guard
+  applies exactly as on a direct call. It cannot invoke itself or the other meta-tools.
+- **`sf_tool_schema({ tool })`** — returns any tool's input schema, loaded or not, so a model can
+  construct that call for a tool it cannot see.
+- **`sf_find_tool`** now returns input schemas inline when a query matches three tools or fewer,
+  collapsing find → call into a single round trip. Wider searches still return names only, so this
+  does not reintroduce the context cost lazy toolsets exist to avoid.
+- **`sf_load_toolset`** now checks whether the client re-fetched `tools/list` after the notification
+  and reports `clientDidNotRefresh: true` with instructions to use `sf_call_tool`, rather than
+  claiming an unqualified success for tools that have silently become unreachable.
+
+With this, the full 228-tool surface is reachable from the handshake tool list alone, even under
+`SF_TOOLSETS=none`.
+
+The regression this adds is deliberately end-to-end. Every internal signal — `loadedToolsets`,
+`residentTools`, `sf_find_tool` matches — was correct throughout the reported session, so asserting
+on any of them would have passed cleanly while the server was unusable. `qa-client-refetch.mjs`
+instead drives two simulated clients, one that honours `list_changed` and one that never re-fetches,
+and asserts what the model can actually call.
+
+Also fixed along the way: `sf_call_tool`'s first implementation assumed `inputSchema` was always a
+`ZodRawShape`, but the shared schemas in `src/schemas` are built `ZodObject`s. Both forms are now
+normalised, matching what the SDK itself does.
+
+### Notes
+
+- Meta-tool count goes from 3 to 5, so the default startup listing is 20 tools rather than 18 and
+  `SF_TOOLSETS=all` lists 233 rather than 231. No Salesforce tool was added, removed or renamed.
+- `zod-to-json-schema` is now a direct dependency. It was already present transitively — the MCP SDK
+  uses it to serialise Zod v3 schemas — and this server now uses it for the same purpose.
+
+## [3.0.0] - 2026-09-02
+
+### Production write guard
+
+This server hands an LLM a Salesforce credential and lets the LLM decide what to do with it. Any
+text the model reads along the way — a case comment, a field description, a retrieved `.flow` file,
+an email body — can carry an instruction, and nothing downstream can distinguish it from one the
+user typed. Salesforce's own hosted MCP servers ship a blunt version of the same defence: they
+create and update records but refuse to delete, with deletes behind a separate opt-in server.
+
+Nine tools are now refused against a **production** org: `sf_delete_metadata`, `sf_delete_record`,
+`sf_bulk_delete_records`, `sf_execute_anonymous_apex`, `sf_uninstall_package`, `sf_create_user`,
+`sf_update_user`, `sf_reset_user_password`, `sf_freeze_user`. Set `SF_PRODUCTION_GUARD=strict` to
+refuse every write instead, or `=off` to disable the guard.
+
+**Metadata creation is deliberately untouched.** All 137 `sf_create_*` tools, `sf_deploy_metadata`
+and `sf_retrieve_metadata` still work against production. `sf_deploy_metadata` was reviewed and
+left open because it has no `destructiveChanges` path — it builds a package.xml from the components
+passed to it and can only add or upsert. A guard that taxed metadata authoring would be turned off
+on day one, which is worse than no guard because it would then be off for everything too.
+
+Apex authoring (`sf_create_apex_class`, `sf_create_apex_trigger`) is also left open, even though a
+trigger is arbitrary code running on every DML. The line drawn is auditability: created Apex is
+metadata with a name, an author and a deploy record, and can be found and removed afterwards.
+`sf_execute_anonymous_apex` leaves no artifact at all, which is why it is the Apex path that is
+blocked. This is a real residual risk and is documented rather than papered over.
+
+An org counts as production only when it is not a sandbox, not a Developer Edition org, and has no
+trial expiry. **`IsSandbox = false` alone is not sufficient** — Developer Edition and scratch orgs
+both report `false`, and gating those would have made the feature unusable for everyone developing
+against a dev org. Org identity is resolved once per process and cached; if it cannot be determined,
+the org is treated as production (fail closed).
+
+The guard is a hard refusal rather than a confirmation prompt, because a prompt the calling agent
+can satisfy by itself is not a control — and this server is routinely run under clients with
+permissions bypassed. Only an environment variable set outside the conversation lifts it.
+
+Implemented in `src/services/guard.ts` and wired through the single `ToolsetRegistry.capture()`
+proxy, so every current and future tool passes through it without the 33 tool modules changing.
+Covered by `qa-guard.mjs` (26 checks), including assertions that each metadata-creation tool stays
+allowed and that Developer Edition / scratch / sandbox orgs are never treated as production.
+
+### Security: sf_deploy_metadata could be turned into a metadata deletion primitive
+
+Found by attacking the guard above rather than in review, and it was live in every published version
+that shipped `sf_deploy_metadata` with the `componentsXml` parameter.
+
+`inferMetadataPath`'s `default` branch (unrecognised metadata types) returned `` `${lower}s/${name}` ``
+with no extension appended, so the caller-supplied `name` controlled the tail of the zip path
+outright. A component of `{ type: "X", name: "../destructiveChanges.xml" }` produced the zip path
+`xs/../destructiveChanges.xml`, which JSZip normalises to a **root-level `destructiveChanges.xml`** —
+the manifest the Metadata API uses to *delete* every component listed in it. Confirmed by reading the
+generated archive's entry list, not by inspection.
+
+Impact: `sf_deploy_metadata` was documented and treated as additive-only (it is not in the production
+guard's blocked set for exactly that reason), while in fact being able to delete arbitrary metadata
+from any org the server could reach — bypassing the block on `sf_delete_metadata` completely.
+
+Fixed by validating component names before they reach the zip: path separators and `..` are rejected,
+as are the reserved manifest names `package.xml`, `destructiveChanges.xml`,
+`destructiveChangesPre.xml` and `destructiveChangesPost.xml` (case-insensitively). The assembled path
+is re-checked afterwards so a future branch that builds a path some other way cannot reintroduce this.
+Salesforce component names cannot contain path separators in any metadata type, so nothing legitimate
+is rejected. `sf_deploy_metadata` therefore stays available against production, as intended.
+
+### Security: production guard evaluated the wrong org for tools taking an org override
+
+`uninstallPackage()` ignores its `auth` argument entirely and shells out to
+`sf package uninstall --target-org <params.targetOrg>`. The guard resolved production-ness from
+`getAuth()` — a different org — so pointing `SF_INSTANCE_URL` at a dev org and passing
+`targetOrg: "<prod-alias>"` walked a gated tool straight past a guard that believed it was protecting
+production.
+
+Gated tools called with an explicit `targetOrg`, `targetAlias`, `targetOrgAlias` or `orgAlias` are now
+refused outright, since the named org cannot be verified from here without a second CLI round-trip.
+Fail closed rather than guess.
+
+### Security: package.xml manifest injection
+
+`buildPackageXml` interpolated component names and types into XML unescaped, so a name containing `<`
+closed the element early and appended attacker-chosen manifest entries. Lower severity than the two
+above (a manifest cannot express deletion, and listed components must also be present in the zip), but
+fixed with proper escaping. The `*` wildcard is unaffected.
+
+Attack coverage for all three lives in `qa-guard.mjs` (43 checks) so they cannot regress silently.
+
+
 ## [2.12.0] - 2026-08-11
 
 ### Five new tools (223 → 228), and a dangerous pair of functions removed

package/README.md

@@ -45,6 +45,92 @@ Add to your MCP configuration (`claude_desktop_config.json` or `.claude/settings
 
 See [SETUP.md](SETUP.md) for all authentication methods and detailed setup instructions.
 
+### One-click install (Claude Desktop)
+
+Download `salesforce-metadata-mcp-<version>.mcpb` from the [latest release](https://github.com/semwalajay83-sem/salesforce-metadata-mcp/releases/latest), then drag it into **Claude Desktop → Settings → Extensions**. It prompts for your org URL and credentials — no JSON editing.
+
+The bundle resolves the server from npm at launch rather than embedding a copy, so it always runs the current published version and never needs re-downloading after an upgrade.
+
+### Docker
+
+```bash
+docker build -t salesforce-metadata-mcp .
+docker run -i --rm \
+  -e SF_INSTANCE_URL="https://your-org.my.salesforce.com" \
+  -e SF_ACCESS_TOKEN="your_access_token" \
+  salesforce-metadata-mcp
+```
+
+The image builds from source, runs as a non-root user, and ships production dependencies only. Because this server speaks MCP over stdio, `-i` is required — the container is driven by its client, not run as a background service. `SF_ALIAS` will not work in a container: the Salesforce CLI's login flow needs a browser, so use token, JWT, refresh-token, or client-credentials variables instead.
+
+---
+
+## Toolsets — loading 228 tools without burning your context
+
+All 228 tools are always available. Most are not loaded into the model's context until something asks for them.
+
+Listing every tool up front costs roughly **98,000 tokens** — about half a 200k context window, spent
+before you type anything, whether or not the session ever touches OmniStudio or DevOps Center. A
+228-candidate tool list also makes the model measurably worse at picking the right tool. So the server
+starts with a small core loaded and pulls in the rest on demand:
+
+| Startup | Tools listed | Approx. tokens |
+|---------|-------------:|---------------:|
+| Default (`core,metadata`) | 20 | **~9,900** |
+| After loading two more toolsets | 43 | ~20,800 |
+| `SF_TOOLSETS=all` | 233 | ~99,100 |
+
+The default covers what nearly every session needs: describe/list objects, SOQL query,
+deploy/retrieve/delete metadata, deploy status, and core schema creation (objects, fields, formula
+fields, picklist values, validation rules, approval processes).
+
+Five tools are always present and make everything else reachable:
+
+- **`sf_find_tool`** — search all 228 tools by name and load whatever contains the matches, in one
+  call. Ask for *"create an omniscript"* and it finds the tools, loads `omnistudio`, and they are
+  callable immediately. This is usually all you or the model needs.
+- **`sf_load_toolset`** — load named toolsets explicitly.
+- **`sf_list_toolsets`** — browse all toolsets, their tool counts, and what is loaded.
+- **`sf_call_tool`** — invoke any tool by name, loaded or not, without it having to appear in the
+  tool list first. Arguments are validated and the production guard applies exactly as on a direct
+  call.
+- **`sf_tool_schema`** — return any tool's input schema, so `sf_call_tool` can be constructed for a
+  tool the client cannot see.
+
+In practice you don't manage this by hand: ask for what you want, and the model loads what it needs.
+
+### If loaded tools don't show up
+
+Loading a toolset enables it on the server and emits `notifications/tools/list_changed`. A client is
+supposed to re-fetch `tools/list` when it sees that. Some clients don't — and when that happens, the
+load reports success, the tools really are enabled, and the model still cannot call any of them
+because they never entered its tool list.
+
+Two things handle this, so no client can lose access to a tool:
+
+- `sf_load_toolset` checks whether the client re-fetched and says so in its response, instead of
+  reporting an unqualified success for tools that have become unreachable.
+- `sf_call_tool` reaches every tool without needing a re-fetch at all. Combined with `sf_tool_schema`,
+  the full 228-tool surface is usable from the handshake tool list alone — even under
+  `SF_TOOLSETS=none`.
+
+To restore the previous behaviour of loading everything at startup, set `SF_TOOLSETS=all`. To start
+with only the five meta-tools, set `SF_TOOLSETS=none`. To pick your own core, pass a list:
+
+```json
+{ "env": { "SF_TOOLSETS": "metadata,objects,automation,security" } }
+```
+
+Available toolsets: `core`, `metadata`, `objects`, `data`, `flows`, `automation`, `security`, `apex`,
+`lwc`, `ui`, `pages`, `actions`, `agentforce`, `omnistudio`, `omnichannel`, `devops`, `deployment`,
+`integrations`, `identity`, `reports`, `experience`, `admin`, `monitoring`, `audit`, `einstein`,
+`knowledge`, `cpq`, `sandbox`, `streaming`, `visualforce`, `aura`, `comms`, `mcp`, `i18n`.
+
+Flow tools live in their own `flows` toolset because `sf_create_flow` carries the full Flow element
+schema — 15,266 bytes (~4,126 tokens) on its own, the largest tool definition in the server. Keeping
+it out of the default means sessions that never build a Flow never pay for it, while sessions that do
+still get the complete validated schema.
+
 ---
 
 ## Tools — 228 total
@@ -210,6 +296,49 @@ Highlights below; see [TOOLS.md](TOOLS.md) for the complete reference with param
 | `SF_ACCESS_TOKEN` | Static access token (expires ~1hr) | For static |
 | `PORT` | HTTP server port (default: 3000) | For HTTP mode |
 | `TRANSPORT` | `stdio` or `http` (default: stdio) | Optional |
+| `SF_TOOLSETS` | Toolsets to load at startup: `all`, `none`, or a comma-separated list (default: `core,metadata`) | Optional |
+| `SF_TOOLSETS_VERBOSE` | Set to `1` to print the full toolset list to stderr on startup | Optional |
+| `SF_PRODUCTION_GUARD` | `destructive` (default), `strict`, or `off` — see below | Optional |
+
+---
+
+## Production write guard
+
+This server hands an LLM a Salesforce credential, and the LLM decides what to do with it. Any text
+the model reads on the way — a case comment, a field description, a retrieved `.flow` file, an
+email body — can carry an instruction, and nothing downstream can tell it apart from one you typed.
+
+So against a **production org**, nine tools are refused by default:
+
+| Blocked on production | Why |
+|---|---|
+| `sf_delete_metadata` | Destroys metadata and every record in it |
+| `sf_delete_record`, `sf_bulk_delete_records` | Destroy data |
+| `sf_execute_anonymous_apex` | Arbitrary code that leaves no artifact behind |
+| `sf_uninstall_package` | Removes a managed package and its data |
+| `sf_create_user`, `sf_update_user` | Privilege escalation |
+| `sf_reset_user_password`, `sf_freeze_user` | Account takeover / lockout |
+
+**Metadata creation is not affected.** All 137 `sf_create_*` tools, `sf_deploy_metadata` and
+`sf_retrieve_metadata` work against production exactly as before — authoring metadata by natural
+language is the point of this package, and a guard that taxed it would just get switched off.
+
+Apex authoring (`sf_create_apex_class`, `sf_create_apex_trigger`) is also **not** blocked, even
+though a trigger runs on every DML. The line drawn is auditability: created Apex is metadata — it
+has a name, an author and a deploy record, and can be found and removed. `sf_execute_anonymous_apex`
+leaves nothing to find, which is why that one is blocked.
+
+An org counts as production only when it is **not** a sandbox, **not** a Developer Edition org, and
+**not** on a trial/scratch expiry. Sandboxes, dev orgs and scratch orgs are never gated.
+
+```jsonc
+{ "env": { "SF_PRODUCTION_GUARD": "strict" } }   // refuse ALL writes on production
+{ "env": { "SF_PRODUCTION_GUARD": "off" } }      // no guard at all
+```
+
+The guard is a hard refusal, not a confirmation prompt: a prompt the calling agent can approve by
+itself is not a control, and this server is often run with client permissions bypassed. Only the
+environment variable lifts it.
 
 ---
 

package/SECURITY.md

@@ -68,11 +68,31 @@ All tool inputs are validated by Zod schemas before being used:
 
 ## Supported Versions
 
-| Version | Supported |
-|---------|-----------|
-| 2.1.x   | ✅ Current |
-| 2.0.x   | ⚠️ Upgrade recommended |
-| 1.x     | ❌ No longer supported |
+| Version | Status |
+|---------|--------|
+| 2.12.x | ✅ Supported — current npm `latest` |
+| 2.11.2 | ✅ Contains all security fixes |
+| 2.11.1 | ⚠️ Has the code fixes, but ships 5 production-dependency advisories resolved in 2.11.2 — upgrade |
+| **≤ 2.8.7** | ❌ **Deprecated on npm (2026-08-26) — command injection (RCE), SOQL injection, credential leak** |
+| 1.x | ❌ No longer supported |
+
+### Deprecated versions — 2026-08-26
+
+Every version **2.0.0 through 2.8.7** was deprecated on npm and now emits a warning on install.
+
+The security audit in **v2.8.8** fixed a confirmed command injection (RCE), a SOQL injection, a
+credential leak and a generated-code injection. **v2.8.8, v2.8.9, v2.9.0, v2.10.0 and v2.11.0 were
+never published to npm**, so the first npm release carrying those fixes is **v2.11.1**. Anyone on
+`2.8.7` or below — including the version that was npm `latest` at the time — is running unfixed code.
+
+If you are pinned to any version at or below 2.8.7, upgrade:
+
+```
+npm install salesforce-metadata-mcp@latest
+```
+
+Note that pinning to an exact old version bypasses `latest` entirely; check your lockfile, Dockerfile
+or MCP client config for a hardcoded version string.
 
 ---
 

package/dist/index.js

@@ -5,6 +5,8 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { createServer } from "http";
 import { createRequire } from "module";
 import { registerTools } from "./tools/index.js";
+import { attachRefetchDetection, registerToolsetTools, toolsetSummary } from "./toolsets.js";
+import { guardMode, DESTRUCTIVE_TOOLS } from "./services/guard.js";
 // Single source of truth for the version. Hardcoding it here drifted from package.json across
 // v2.11.0/v2.11.1 (the server advertised 2.10.0 to clients while the package said 2.11.1), so read
 // it at runtime instead. dist/index.js → ../package.json resolves correctly both in the repo and
@@ -15,12 +17,47 @@ const server = new McpServer({
     name: "salesforce-metadata-mcp",
     version: VERSION,
 });
-registerTools(server);
+const registry = registerTools(server);
+registerToolsetTools(server, registry);
+// Lets sf_load_toolset tell the user when their client ignored notifications/tools/list_changed —
+// the 2026-09-09 failure mode, where loading a toolset succeeds but its tools never reach the model.
+const refetchDetection = attachRefetchDetection(server, registry);
+// Lazy toolsets: a full tools/list is ~362KB (~98k tokens) with everything loaded, which is about
+// half a 200k context window spent before the user types anything — and a 228-candidate list also
+// hurts tool-selection accuracy. Every tool stays registered and callable; tools outside the active
+// set are simply hidden from tools/list until sf_load_toolset or sf_find_tool switches them on.
+// Set SF_TOOLSETS=all to restore the pre-3.0 behaviour of loading everything up front.
+const initialToolsets = registry.resolveInitial(process.env["SF_TOOLSETS"]);
+registry.setActive(initialToolsets);
+// ─── Startup banner ───────────────────────────────────────────────────────────
+function logStartup(kind) {
+    console.error(`Salesforce Metadata MCP server v${VERSION} running on ${kind}`);
+    console.error(`Toolsets: ${registry.activeGroups().join(", ") || "none"} — ` +
+        `${registry.residentTools()} of ${registry.totalTools()} tools loaded. ` +
+        `Use sf_find_tool or sf_load_toolset to load more; SF_TOOLSETS=all loads everything. ` +
+        `Any tool is also callable directly via sf_call_tool, loaded or not.`);
+    if (!refetchDetection) {
+        console.error("Note: could not observe tools/list on this SDK build, so a client that ignores " +
+            "tools/list_changed cannot be detected. sf_call_tool still reaches every tool.");
+    }
+    // Announced at startup rather than only on refusal: a guard nobody knows is on reads as a bug
+    // the first time it fires, and the org lookup that decides production-ness is lazy, so this is
+    // the only point where the configured intent can be stated without an extra API call.
+    const mode = guardMode();
+    console.error(mode === "off"
+        ? "Production guard: OFF — all tools permitted against production orgs."
+        : mode === "strict"
+            ? "Production guard: strict — ALL write tools, including metadata creation, refused on production orgs. Set SF_PRODUCTION_GUARD=destructive or =off to change."
+            : `Production guard: destructive — ${DESTRUCTIVE_TOOLS.size} tools that delete data, run untraceable code or change org access are refused on production orgs. Metadata creation is unaffected. Set SF_PRODUCTION_GUARD to change.`);
+    if (process.env["SF_TOOLSETS_VERBOSE"] === "1") {
+        console.error(toolsetSummary(registry));
+    }
+}
 // ─── Transport: stdio ─────────────────────────────────────────────────────────
 async function runStdio() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error(`Salesforce Metadata MCP server v${VERSION} running on stdio`);
+    logStartup("stdio");
 }
 // ─── Transport: HTTP ──────────────────────────────────────────────────────────
 function readBody(req) {
@@ -78,7 +115,7 @@ async function runHTTP() {
         res.end(JSON.stringify({ error: "Not found" }));
     });
     httpServer.listen(port, host, () => {
-        console.error(`Salesforce Metadata MCP server v${VERSION} running on http://${host}:${port}/mcp`);
+        logStartup(`http://${host}:${port}/mcp`);
     });
 }
 // ─── Entry point ──────────────────────────────────────────────────────────────

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,8FAA8F;AAC9F,mGAAmG;AACnG,iGAAiG;AACjG,wEAAwE;AACxE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE/E,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,aAAa,CAAC,MAAM,CAAC,CAAC;AAEtB,iFAAiF;AAEjF,KAAK,UAAU,QAAQ;IACrB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,mCAAmC,OAAO,mBAAmB,CAAC,CAAC;AAC/E,CAAC;AAED,iFAAiF;AAEjF,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,kGAAkG;IAClG,+BAA+B;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAEhD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAClF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,SAAS;gBAC7B,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,mCAAmC,OAAO,sBAAsB,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC;AACtD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,CAAC;IACN,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAChC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEnE,8FAA8F;AAC9F,mGAAmG;AACnG,iGAAiG;AACjG,wEAAwE;AACxE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE/E,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;AACvC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEvC,kGAAkG;AAClG,qGAAqG;AACrG,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAElE,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,gGAAgG;AAChG,uFAAuF;AACvF,MAAM,eAAe,GAAG,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;AAC5E,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAEpC,iFAAiF;AAEjF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,KAAK,CAAC,mCAAmC,OAAO,eAAe,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,KAAK,CACX,aAAa,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK;QAC5D,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,QAAQ,CAAC,UAAU,EAAE,iBAAiB;QACxE,sFAAsF;QACtF,qEAAqE,CACxE,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,iFAAiF;YAC/E,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,OAAO,CAAC,KAAK,CACX,IAAI,KAAK,KAAK;QACZ,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC,6JAA6J;YAC/J,CAAC,CAAC,mCAAmC,iBAAiB,CAAC,IAAI,wKAAwK,CACxO,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,QAAQ;IACrB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,UAAU,CAAC,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,iFAAiF;AAEjF,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,kGAAkG;IAClG,+BAA+B;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAEhD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAClF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,SAAS;gBAC7B,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACjC,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC;AACtD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,CAAC;IACN,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAChC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}