teletype-mcp-server 0.1.0 → 0.1.1

package/dist/oauth.js

@@ -0,0 +1,382 @@
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import express from "express";
+import { z } from "zod";
+import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { InvalidClientMetadataError, InvalidGrantError, InvalidScopeError, InvalidTargetError, InvalidTokenError, TooManyRequestsError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { requestContext } from "./request-context.js";
+import { teletypeRequest } from "./teletype-api.js";
+import { decodeProjectDetails } from "./api-contract.js";
+import { RequestLimiter } from "./request-limiter.js";
+import { OAuthStore } from "./oauth-store.js";
+import { consentPage } from "./oauth-page.js";
+const ACCESS_SECONDS = 3600;
+const CLIENT_SECONDS = 30 * 24 * 3600;
+const MAX_ENTRIES = 1000;
+const MAX_ACCESS_TOKENS = 8000;
+const SCOPES = ["read", "write", "offline_access"];
+const now = () => Math.floor(Date.now() / 1000);
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const secret = () => randomBytes(32).toString("base64url");
+const consentFields = z.object({
+    request_id: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    action: z.enum(["connect", "cancel"]),
+    api_token: z.string().max(2048).optional(),
+    allow_write: z.enum(["yes", ""]).optional(),
+});
+class ProjectOAuthProvider {
+    cfg;
+    store;
+    refreshKey;
+    resource;
+    issuer;
+    clientsStore;
+    constructor(cfg) {
+        this.cfg = cfg;
+        if (!cfg.oauth)
+            throw new Error("OAuth configuration is missing.");
+        this.issuer = new URL(cfg.publicBaseUrl);
+        this.resource = new URL("/mcp", this.issuer);
+        this.store = new OAuthStore(cfg.oauth.databasePath, cfg.oauth.encryptionKey, this.resource.href);
+        this.refreshKey = createHmac("sha256", Buffer.from(cfg.oauth.encryptionKey, "hex"))
+            .update("teletype-oauth-refresh-v1:" + this.resource.href)
+            .digest();
+        this.clientsStore = {
+            getClient: (id) => this.store.get("client", id),
+            registerClient: (metadata) => this.store.transaction(() => {
+                if (this.store.count("client") >= MAX_ENTRIES)
+                    throw new TooManyRequestsError("OAuth client capacity reached.");
+                if (metadata.redirect_uris.length > 10 ||
+                    metadata.redirect_uris.some((value) => !validRedirect(value))) {
+                    throw new InvalidClientMetadataError("Redirects require HTTPS or loopback HTTP without fragments or credentials.");
+                }
+                if (JSON.stringify(metadata).length > 4096)
+                    throw new InvalidClientMetadataError("Client metadata is too large.");
+                if (metadata.scope?.split(" ").some((scope) => !SCOPES.includes(scope)))
+                    throw new InvalidClientMetadataError("Unsupported scope.");
+                const client = { ...metadata, client_id: randomUUID(), client_id_issued_at: now() };
+                this.store.put("client", client.client_id, client, now() + CLIENT_SECONDS);
+                return client;
+            }),
+        };
+    }
+    close() {
+        this.store.close();
+    }
+    checkResource(resource) {
+        if (resource && resource.href !== this.resource.href)
+            throw new InvalidTargetError("The token is restricted to the Teletype MCP endpoint.");
+    }
+    authorize(client, params, res) {
+        this.checkResource(params.resource);
+        if ((params.state?.length ?? 0) > 2048 || params.redirectUri.length > 2048)
+            throw new InvalidGrantError("Authorization parameters are too large.");
+        const scopes = params.scopes?.length ? [...new Set(params.scopes)] : ["read"];
+        if (!scopes.includes("read") ||
+            scopes.some((scope) => !SCOPES.includes(scope)) ||
+            (this.cfg.readOnly && scopes.includes("write"))) {
+            throw new InvalidScopeError("Request read, optionally write and offline_access. A read-only deployment cannot grant write.");
+        }
+        if (!/^[A-Za-z0-9_-]{43}$/.test(params.codeChallenge))
+            throw new InvalidGrantError("A valid S256 PKCE challenge is required.");
+        const id = secret();
+        const cookie = secret();
+        this.store.transaction(() => {
+            if (this.store.count("consent") >= MAX_ENTRIES)
+                throw new TooManyRequestsError("OAuth consent capacity reached.");
+            this.store.put("consent", hash(id), {
+                clientId: client.client_id,
+                redirectUri: params.redirectUri,
+                challenge: params.codeChallenge,
+                state: params.state,
+                scopes,
+                cookieHash: hash(cookie),
+                expiresAt: now() + 600,
+            }, now() + 600);
+        });
+        res.cookie(cookieName(id), cookie, {
+            httpOnly: true,
+            secure: this.issuer.protocol === "https:",
+            sameSite: "strict",
+            path: "/oauth/consent",
+            maxAge: 600_000,
+        });
+        res.set({
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "same-origin",
+            "X-Content-Type-Options": "nosniff",
+            "Content-Security-Policy": `default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; img-src 'self'; font-src 'self'; form-action 'self' ${new URL(params.redirectUri).origin}; frame-ancestors 'none'; base-uri 'none'`,
+        });
+        const savedLocale = res.req.headers.cookie
+            ?.split(";")
+            .map((part) => part.trim())
+            .find((part) => part.startsWith("teletype_oauth_locale="))
+            ?.slice("teletype_oauth_locale=".length);
+        const locale = savedLocale === "ru" || savedLocale === "en"
+            ? savedLocale
+            : res.req.acceptsLanguages("en", "ru") === "ru"
+                ? "ru"
+                : "en";
+        res
+            .type("html")
+            .send(consentPage(client.client_name || "", new URL(params.redirectUri).origin, id, scopes, locale));
+        return Promise.resolve();
+    }
+    async completeConsent(req, res) {
+        if (req.headers.origin !== this.issuer.origin) {
+            res.status(403).json({ error: "consent_origin_invalid" });
+            return;
+        }
+        const input = req.body;
+        const fields = consentFields.safeParse(input);
+        if (!fields.success) {
+            res.status(400).json({ error: "invalid_consent_request" });
+            return;
+        }
+        const id = fields.data.request_id;
+        const cookie = (req.headers.cookie || "")
+            .split(";")
+            .map((part) => part.trim())
+            .find((part) => part.startsWith(cookieName(id) + "="))
+            ?.slice(cookieName(id).length + 1);
+        const consent = this.store.transaction(() => {
+            const item = this.store.get("consent", hash(id));
+            if (!item || !cookie || hash(cookie) !== item.cookieHash)
+                return undefined;
+            this.store.remove("consent", hash(id));
+            return item;
+        });
+        if (!consent) {
+            res.status(400).json({
+                error: "consent_expired_or_invalid",
+                message: "Restart the connection from your MCP client.",
+            });
+            return;
+        }
+        res.clearCookie(cookieName(id), { path: "/oauth/consent" });
+        res.set({ "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+        const redirect = new URL(consent.redirectUri);
+        if (consent.state !== undefined)
+            redirect.searchParams.set("state", consent.state);
+        if (fields.data.action !== "connect") {
+            redirect.searchParams.set("error", "access_denied");
+            res.redirect(303, redirect.href);
+            return;
+        }
+        const apiToken = fields.data.api_token?.trim() ?? "";
+        if (!apiToken || apiToken.length > 2048) {
+            res.status(400).json({ error: "project_token_required" });
+            return;
+        }
+        try {
+            await requestContext.run({
+                authToken: apiToken,
+                allowLocalFiles: false,
+                allowedFileRoots: [],
+                apiBase: this.cfg.apiBase,
+                projectUrl: this.cfg.projectUrl,
+                requestTimeoutMs: this.cfg.requestTimeoutMs,
+                maxResponseBytes: this.cfg.maxResponseBytes,
+                maxUploadBytes: this.cfg.maxUploadBytes,
+                requestId: randomUUID(),
+                logLevel: this.cfg.logLevel,
+            }, () => teletypeRequest("/project/details", { decode: decodeProjectDetails }));
+        }
+        catch {
+            res.status(401).json({
+                error: "project_token_not_verified",
+                message: "Check the project token and Public API access, then restart the connection.",
+            });
+            return;
+        }
+        if (fields.data.allow_write !== "yes")
+            consent.scopes = consent.scopes.filter((scope) => scope !== "write");
+        const grantId = randomUUID();
+        const code = secret();
+        this.store.transaction(() => {
+            if (!this.store.get("client", consent.clientId))
+                throw new InvalidGrantError("OAuth client expired.");
+            if (this.store.count("grant") >= MAX_ENTRIES)
+                throw new TooManyRequestsError("OAuth connection capacity reached.");
+            const expiresAt = now() + 60;
+            this.store.put("grant", grantId, { clientId: consent.clientId, apiToken, scopes: consent.scopes, expiresAt }, expiresAt);
+            this.store.put("code", hash(code), { consent, grantId, expiresAt: now() + 60 }, now() + 60, grantId);
+        });
+        redirect.searchParams.set("code", code);
+        res.redirect(303, redirect.href);
+    }
+    code(client, code) {
+        const item = this.store.get("code", hash(code));
+        if (item?.consent.clientId !== client.client_id)
+            throw new InvalidGrantError("Authorization code is invalid or expired.");
+        return item;
+    }
+    challengeForAuthorizationCode(client, code) {
+        return Promise.resolve(this.code(client, code).consent.challenge);
+    }
+    exchangeAuthorizationCode(client, code, _verifier, redirectUri, resource) {
+        this.checkResource(resource);
+        return Promise.resolve(this.store.transaction(() => {
+            const item = this.code(client, code);
+            if (redirectUri !== undefined && redirectUri !== item.consent.redirectUri)
+                throw new InvalidGrantError("Redirect URI differs from the authorized redirect.");
+            this.store.remove("code", hash(code));
+            return this.issueTokens(item.grantId);
+        }));
+    }
+    issueTokens(grantId) {
+        const grant = this.store.get("grant", grantId);
+        if (!grant)
+            throw new InvalidGrantError("OAuth connection is expired.");
+        if (this.store.count("access") >= MAX_ACCESS_TOKENS)
+            throw new TooManyRequestsError("OAuth refresh capacity reached.");
+        const access = secret();
+        const expiresIn = ACCESS_SECONDS;
+        // Zero expiry keeps approved renewable grants until they are revoked.
+        grant.expiresAt = grant.scopes.includes("offline_access") ? 0 : now() + expiresIn;
+        this.store.put("access", hash(access), { grantId, expiresAt: now() + expiresIn }, now() + expiresIn, grantId);
+        let refresh;
+        grant.currentRefresh = undefined;
+        if (grant.scopes.includes("offline_access")) {
+            const value = grantId + "." + secret();
+            refresh = value + "." + this.refreshSignature(value);
+            grant.currentRefresh = hash(refresh);
+        }
+        this.store.put("grant", grantId, grant, grant.expiresAt);
+        this.syncClientLifetime(grant.clientId, grant.expiresAt === 0);
+        return {
+            access_token: access,
+            token_type: "Bearer",
+            expires_in: expiresIn,
+            refresh_token: refresh,
+            scope: grant.scopes.join(" "),
+        };
+    }
+    refreshSignature(value) {
+        return createHmac("sha256", this.refreshKey).update(value).digest("base64url");
+    }
+    refreshGrantId(token) {
+        const match = /^([a-f0-9-]{36}\.[A-Za-z0-9_-]{43})\.([A-Za-z0-9_-]{43})$/.exec(token);
+        if (!match?.[1] || !match[2])
+            return undefined;
+        if (!timingSafeEqual(Buffer.from(match[2]), Buffer.from(this.refreshSignature(match[1]))))
+            return undefined;
+        return match[1].slice(0, 36);
+    }
+    syncClientLifetime(clientId, persistent = false) {
+        const client = this.store.get("client", clientId);
+        if (!client)
+            throw new InvalidGrantError("OAuth client expired.");
+        this.store.put("client", clientId, client, persistent || this.store.hasPersistentGrant(clientId) ? 0 : now() + CLIENT_SECONDS);
+    }
+    revokeGrant(grantId) {
+        const grant = this.store.get("grant", grantId);
+        this.store.revokeGrant(grantId);
+        if (grant && this.store.get("client", grant.clientId))
+            this.syncClientLifetime(grant.clientId);
+    }
+    exchangeRefreshToken(client, refresh, scopes, resource) {
+        this.checkResource(resource);
+        const digest = hash(refresh);
+        const result = this.store.transaction(() => {
+            const grantId = this.refreshGrantId(refresh);
+            const grant = grantId && this.store.get("grant", grantId);
+            if (!grantId || !grant || grant.clientId !== client.client_id)
+                throw new InvalidGrantError("Refresh token is invalid or expired.");
+            if (grant.currentRefresh !== digest) {
+                this.revokeGrant(grantId);
+                return undefined;
+            }
+            if (scopes?.some((scope) => !grant.scopes.includes(scope)) ||
+                (scopes && !scopes.includes("read")))
+                throw new InvalidScopeError("Refresh cannot expand access or remove read.");
+            if (scopes)
+                grant.scopes = [...new Set(scopes)];
+            this.store.put("grant", grantId, grant, grant.expiresAt);
+            return this.issueTokens(grantId);
+        });
+        if (!result)
+            throw new InvalidGrantError("Refresh token was reused. Restart the connection.");
+        return Promise.resolve(result);
+    }
+    verifyAccessToken(token) {
+        const access = this.store.get("access", hash(token));
+        const grant = access && this.store.get("grant", access.grantId);
+        if (!access || !grant || !this.store.get("client", grant.clientId))
+            throw new InvalidTokenError("Access token is invalid or expired.");
+        return Promise.resolve({
+            token,
+            clientId: grant.clientId,
+            scopes: grant.scopes,
+            expiresAt: access.expiresAt,
+            resource: this.resource,
+            extra: { apiToken: grant.apiToken },
+        });
+    }
+    revokeToken(client, request) {
+        const digest = hash(request.token);
+        this.store.transaction(() => {
+            const grantId = this.store.get("access", digest)?.grantId ?? this.refreshGrantId(request.token);
+            if (grantId && this.store.get("grant", grantId)?.clientId === client.client_id)
+                this.revokeGrant(grantId);
+        });
+        return Promise.resolve();
+    }
+}
+function validRedirect(value) {
+    try {
+        const url = new URL(value);
+        return (!url.username &&
+            !url.password &&
+            !url.hash &&
+            (url.protocol === "https:" ||
+                (url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))));
+    }
+    catch {
+        return false;
+    }
+}
+const cookieName = (id) => "teletype_oauth_" + hash(id).slice(0, 16);
+export function mountProjectOAuth(app, cfg) {
+    if (!cfg.oauth)
+        return undefined;
+    const provider = new ProjectOAuthProvider(cfg);
+    app.use("/oauth/assets", express.static(fileURLToPath(new URL("../plugin/assets/", import.meta.url)), {
+        dotfiles: "deny",
+        index: false,
+        redirect: false,
+        maxAge: "1d",
+        setHeaders: (res) => {
+            res.setHeader("X-Content-Type-Options", "nosniff");
+        },
+    }));
+    app.once("close", () => {
+        provider.close();
+    });
+    const limiter = new RequestLimiter(cfg.maxConcurrentRequests, cfg.maxConcurrentPerToken);
+    app.use(mcpAuthRouter({
+        provider,
+        issuerUrl: provider.issuer,
+        resourceServerUrl: provider.resource,
+        resourceName: "Teletype",
+        clientRegistrationOptions: { clientSecretExpirySeconds: 0 },
+        scopesSupported: cfg.readOnly ? ["read", "offline_access"] : SCOPES,
+        serviceDocumentationUrl: new URL("https://github.com/Teletype-App/teletype-mcp-server"),
+    }));
+    app.post("/oauth/consent", express.urlencoded({ extended: false, limit: "8kb" }), (req, res) => {
+        const release = limiter.acquire(hash(req.ip || "unknown"));
+        if (!release) {
+            res.set("Retry-After", "1").status(429).json({ error: "oauth_busy" });
+            return;
+        }
+        void provider
+            .completeConsent(req, res)
+            .catch(() => {
+            if (!res.headersSent)
+                res.status(500).json({ error: "oauth_consent_failed" });
+        })
+            .finally(release);
+    });
+    return provider;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAsD,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAYhF,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACnD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,oBAAoB;IAOK;IANZ,KAAK,CAAa;IAClB,UAAU,CAAS;IAC3B,QAAQ,CAAM;IACd,MAAM,CAAM;IACZ,YAAY,CAA8B;IAEnD,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QACtC,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CACzB,GAAG,CAAC,KAAK,CAAC,YAAY,EACtB,GAAG,CAAC,KAAK,CAAC,aAAa,EACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CACnB,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;aAChF,MAAM,CAAC,4BAA4B,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;aACzD,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,GAAG;YAClB,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/C,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC3B,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,WAAW;oBAC3C,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;gBACnE,IACE,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;oBAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAC7D,CAAC;oBACD,MAAM,IAAI,0BAA0B,CAClC,4EAA4E,CAC7E,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,IAAI;oBACxC,MAAM,IAAI,0BAA0B,CAAC,+BAA+B,CAAC,CAAC;gBACxE,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACrE,MAAM,IAAI,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,CAAC;gBACpF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;gBAC3E,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;SACL,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,aAAa,CAAC,QAAc;QAClC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI;YAClD,MAAM,IAAI,kBAAkB,CAAC,uDAAuD,CAAC,CAAC;IAC1F,CAAC;IAED,SAAS,CACP,MAAkC,EAClC,MAA2B,EAC3B,GAAoD;QAEpD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI;YACxE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9E,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACnD,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,WAAW;gBAC5C,MAAM,IAAI,oBAAoB,CAAC,iCAAiC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,SAAS,EACT,IAAI,CAAC,EAAE,CAAC,EACR;gBACE,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,aAAa;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG;aACvB,EACD,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE;YACjC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACzC,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC;YACN,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;YAChC,wBAAwB,EAAE,SAAS;YACnC,yBAAyB,EAAE,yHAAyH,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,2CAA2C;SAClO,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YACxC,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;YAC1D,EAAE,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GACV,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI;YAC1C,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI;gBAC7C,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC;QACb,GAAG;aACA,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CACH,WAAW,CACT,MAAM,CAAC,WAAW,IAAI,EAAE,EACxB,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAClC,EAAE,EACF,MAAM,EACN,MAAM,CACP,CACF,CAAC;QACJ,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAY,GAAG,CAAC,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;aACtC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;YACtD,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,GAAG,CACtB;gBACE,SAAS,EAAE,QAAQ;gBACnB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;gBACzB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU;gBAC/B,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB;gBAC3C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB;gBAC3C,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;gBACvC,SAAS,EAAE,UAAU,EAAE;gBACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;aAC5B,EACD,GAAG,EAAE,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAC5E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK;YACnC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;gBAC7C,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,WAAW;gBAC1C,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,OAAO,EACP,OAAO,EACP,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAC3E,SAAS,CACV,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,EACV,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAC3C,GAAG,EAAE,GAAG,EAAE,EACV,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,IAAI,CAAC,MAAkC,EAAE,IAAY;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAC7C,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6BAA6B,CAAC,MAAkC,EAAE,IAAY;QAC5E,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,yBAAyB,CACvB,MAAkC,EAClC,IAAY,EACZ,SAAkB,EAClB,WAAoB,EACpB,QAAc;QAEd,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW;gBACvE,MAAM,IAAI,iBAAiB,CAAC,oDAAoD,CAAC,CAAC;YACpF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,iBAAiB;YACjD,MAAM,IAAI,oBAAoB,CAAC,iCAAiC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,cAAc,CAAC;QACjC,sEAAsE;QACtE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,EACZ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,EACzC,GAAG,EAAE,GAAG,SAAS,EACjB,OAAO,CACR,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;YACvC,OAAO,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrD,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC;QAC/D,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,MAAM,KAAK,GAAG,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEO,kBAAkB,CAAC,QAAgB,EAAE,UAAU,GAAG,KAAK;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,cAAc,CACnF,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjG,CAAC;IAED,oBAAoB,CAClB,MAAkC,EAClC,OAAe,EACf,MAAiB,EACjB,QAAc;QAEd,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAC3D,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IACE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtD,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,CAAC,CAAC;YAC9E,IAAI,MAAM;gBAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;QAC9F,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;YAChE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,KAAK;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CACT,MAAkC,EAClC,OAAoC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1B,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClF,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAC5E,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE7E,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAW;IACzD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC/C,GAAG,CAAC,GAAG,CACL,eAAe,EACf,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;QAC3E,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzF,GAAG,CAAC,GAAG,CACL,aAAa,CAAC;QACZ,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,iBAAiB,EAAE,QAAQ,CAAC,QAAQ;QACpC,YAAY,EAAE,UAAU;QACxB,yBAAyB,EAAE,EAAE,yBAAyB,EAAE,CAAC,EAAE;QAC3D,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM;QACnE,uBAAuB,EAAE,IAAI,GAAG,CAAC,qDAAqD,CAAC;KACxF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,KAAK,QAAQ;aACV,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC;aACzB,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChF,CAAC,CAAC;aACD,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/request-context.d.ts

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import type { ToolPolicy } from "./tool-policy.js";
 export interface RequestContext {
     authToken: string;
     allowLocalFiles: boolean;
@@ -11,6 +12,7 @@ export interface RequestContext {
     requestId: string;
     logLevel: "debug" | "info" | "warn" | "error";
     signal?: AbortSignal;
+    toolPolicy?: ToolPolicy;
 }
 export declare function resolveLogContext(): Pick<RequestContext, "requestId" | "logLevel">;
 export declare const requestContext: AsyncLocalStorage<RequestContext>;

package/dist/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAgBrD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAC9C,OAAO;QACL,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,SAAS;QAC1C,QAAQ,EACN,OAAO,EAAE,QAAQ;YACjB,CAAC,eAAe,KAAK,OAAO,IAAI,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO;gBACvF,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,MAAM,CAAC;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,MAAM,UAAU,oBAAoB;IAClC,OAAO,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACrF,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC,QAAQ,EAAE,EAAE,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,EAAE,gBAAgB;QAC3C,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC;aAC5C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO;QAClC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,wCAAwC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,EAAE,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,cAAc,CAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IAKlC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO;QACL,SAAS,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC;QAC1F,gBAAgB,EACd,OAAO,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACpF,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC;KAChG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAkBrD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAC9C,OAAO;QACL,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,SAAS;QAC1C,QAAQ,EACN,OAAO,EAAE,QAAQ;YACjB,CAAC,eAAe,KAAK,OAAO,IAAI,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO;gBACvF,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,MAAM,CAAC;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,MAAM,UAAU,oBAAoB;IAClC,OAAO,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACrF,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC,QAAQ,EAAE,EAAE,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,EAAE,gBAAgB;QAC3C,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC;aAC5C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO;QAClC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,wCAAwC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,EAAE,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,cAAc,CAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IAKlC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO;QACL,SAAS,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC;QAC1F,gBAAgB,EACd,OAAO,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACpF,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC;KAChG,CAAC;AACJ,CAAC"}

package/dist/tool-policy.js

@@ -1,4 +1,5 @@
 import { TOOL_CATALOG, TOOLSET_NAMES, toolsetOf, } from "./tool-catalog.js";
+import { requestContext } from "./request-context.js";
 export const TOOLSETS = TOOLSET_NAMES;
 // Derived from the catalog so writesData stays the single source of truth.
 const WRITE_TOOL_NAMES = new Set(TOOL_CATALOG.filter((contract) => contract.writesData).map((contract) => contract.name));
@@ -19,6 +20,9 @@ export function parseToolsetList(value) {
     return [...new Set(requested)];
 }
 export function loadToolPolicy(env = process.env) {
+    const scopedPolicy = requestContext.getStore()?.toolPolicy;
+    if (scopedPolicy)
+        return scopedPolicy;
     return {
         readOnly: env.TELETYPE_MCP_READ_ONLY === "true",
         toolsets: parseToolsetList(env.TELETYPE_MCP_TOOLSETS),
@@ -27,6 +31,9 @@ export function loadToolPolicy(env = process.env) {
 // Lenient variant for in-band reporting: bad env values surface as notes
 // instead of failing the get_capabilities call.
 export function inspectToolPolicy(env = process.env) {
+    const scopedPolicy = requestContext.getStore()?.toolPolicy;
+    if (scopedPolicy)
+        return { policy: scopedPolicy, notes: [] };
     const notes = [];
     let toolsets = null;
     try {

package/dist/tool-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-policy.js","sourceRoot":"","sources":["../src/tool-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAWtC,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAmB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAA0B,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,sBAAsB,KAAK,MAAM;QAC/C,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,gDAAgD;AAChD,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAIpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAAE,QAAQ,EAAE;QACrE,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,IAAc;IAC7D,IAAI,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"tool-policy.js","sourceRoot":"","sources":["../src/tool-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAWtC,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAmB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAA0B,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC;IAC3D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,sBAAsB,KAAK,MAAM;QAC/C,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,gDAAgD;AAChD,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAIpE,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC;IAC3D,IAAI,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAAE,QAAQ,EAAE;QACrE,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,IAAc;IAC7D,IAAI,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}