theleadrouter-mcp 0.1.0 → 0.3.1

package/.claude/skills/admin-guide/SKILL.md

@@ -337,6 +337,48 @@ When a lead arrives:
 | `GET /api/v1/campaigns/{id}/posting` | Get posting spec |
 | `POST /api/v1/leads/submit` | Submit test lead |
 
+## People (CRM)
+
+The People section is a person-level CRM. Every lead creates or updates a person record (matched by email/phone). People aggregate all activity for a contact across leads, calls, and engagements.
+
+| Feature | Description |
+|---------|-------------|
+| Person timeline | Full activity history (leads, deliveries, calls, dispositions) |
+| Person leads | All leads associated with a person |
+| Person calls | All calls for a person |
+| Person notes | Internal notes attached to a contact |
+| Merge | Merge duplicate person records |
+
+## Sessions (Multi-Step Capture)
+
+Sessions enable multi-step lead capture funnels. Partners collect data across multiple form steps, then submit on the final step.
+
+**Flow:** Create session → PATCH data at each step → Submit on final step (triggers routing)
+
+Sessions expire after 24 hours. Each PATCH merges data (doesn't replace). The lead is only created on final submit.
+
+**Co-Registration (Coreg):** Submit the same contact through multiple campaigns in a single session. Primary lead submits first, then coreg leads are linked via `parentLeadId`.
+
+## Engagements
+
+Engagements track CPA-eligible events across leads. When a contract has CPA configured (cpaAmount + cpaWindowDays), the system monitors for conversion dispositions within the window.
+
+## Consent
+
+Consent verification accounts provide TCPA compliance tracking. Certificates document that consent was collected properly for each lead.
+
+## Posting Log
+
+The posting log records every lead submission and delivery attempt with full request/response payloads. Use it for:
+- Debugging submission failures
+- Verifying delivery payloads
+- Troubleshooting integration issues
+- Auditing partner submissions
+
+## Onboarding
+
+The `setup_partner_onboarding` tool provides a guided multi-step partner onboarding flow — creates the partner, campaign, and links to an offer in one workflow.
+
 ## Gotchas
 
 1. **Vertical mismatch** — Campaign, contract, and offer must all reference the SAME vertical

package/.claude/skills/buyer-guide/SKILL.md

@@ -331,6 +331,8 @@ GET /api/buyer/leads
 Authorization: Bearer lr_your_buyer_api_key
 ```
 
+To use this key with Claude Code (the MCP server), set `ISCALE_MCP_ROLE` to `buyer` in `.mcp.json`. You then get the buyer portal tools only.
+
 ## Ping-Post (Auction Model)
 
 If your contract uses ping-post pricing, here's how it works:
@@ -403,3 +405,41 @@ Or to decline:
 1. Make a payment to reduce your balance
 2. Ask your admin to increase your creditLimit
 3. Consider enabling autoRecharge to automatically fund your account
+
+## People & Contacts
+
+The People section shows contacts from leads you've received. You can search by name, email, or phone and view a contact's full timeline.
+
+### Contact Timeline
+
+Each contact has a timeline showing:
+- Lead submissions
+- Delivery events
+- Disposition updates
+- Call records
+
+Use `get_person_timeline` or browse People in the buyer portal to see the full history for any contact.
+
+## Engagements
+
+Engagements track CPA-eligible events on your leads. When configured, the system monitors whether leads convert within the CPA window and triggers payouts.
+
+View your engagements in the portal or via `list_buyer_engagements`.
+
+## Calls
+
+If your contracts include call tracking, you can view call records in the Calls section. Each call shows:
+- Duration and recording (if available)
+- Disposition status
+- Which contract/campaign it came through
+
+Use `set_call_disposition` to update call outcomes and `trigger_call_conversion` to trigger CPA payouts on calls.
+
+## Posting Log
+
+The posting log shows every delivery attempt to your endpoints. Use it to:
+- Debug delivery failures (see request/response payloads)
+- Verify leads were delivered correctly
+- Check timing of deliveries
+
+Access via `get_buyer_posting_log` or the Posting Log page in the buyer portal.

package/.claude/skills/partner-guide/SKILL.md

@@ -39,7 +39,7 @@ Your System → POST /api/v1/leads/submit → iSCALE Routing Engine → Buyer(s)
 
 ## Submitting Leads
 
-### Endpoint
+### Standard Submission
 
 ```
 POST /api/v1/leads/submit
@@ -153,6 +153,45 @@ Some campaigns have additional fields beyond the vertical. Check the posting spe
 | TCPA consent required | tcpaConsent must be `true` |
 | Missing TrustedForm certificate | trustedFormCertUrl is required |
 
+### Ping-Post (Real-Time Bidding)
+
+Some campaigns support ping-post, where buyers bid on leads before committing. As a partner, the flow is:
+
+1. **Ping** — submit lead attributes (no PII) to see which buyers match and at what price
+2. **Review bids** — see the best available price
+3. **Post** — commit the lead and deliver PII to the winning buyer(s)
+
+```
+POST /api/v1/leads/ping
+Authorization: Bearer lr_xxx
+
+{
+  "campaignId": "abc-123",
+  "state": "CA",
+  "zipCode": "90210",
+  "homeOwner": true,
+  "utilityBill": 150
+}
+```
+
+Response includes matched contracts and bid prices. Then convert to a sale:
+
+```
+POST /api/v1/leads/post
+Authorization: Bearer lr_xxx
+
+{
+  "pingId": "ping-uuid-from-response",
+  "firstName": "Jane",
+  "lastName": "Smith",
+  "email": "jane@example.com",
+  "phone": "5551234567",
+  ...
+}
+```
+
+Ping-post lets you check demand and price before submitting PII. Not all campaigns support it — check your campaign's posting spec.
+
 ## Getting Your Posting Spec
 
 The posting spec tells you exactly what fields to send for a specific campaign.
@@ -214,6 +253,30 @@ Go to **People > Leads tab** to see all submitted leads with:
 
 Click a lead to see full details including delivery status.
 
+## Offer Enrollment
+
+Offers define which campaigns feed leads to which buyers. As a partner, you can browse available offers and request enrollment.
+
+### Browsing Offers
+
+Go to **Offers** in the partner portal to see:
+- **Available Offers** — offers you can enroll in (public visibility)
+- **My Campaigns** — your active campaigns and which offers they're linked to
+
+### Requesting Enrollment
+
+1. Find an offer that matches your lead type and volume
+2. Click **Request Enrollment** (or use the API: `request_offer_enrollment`)
+3. Your admin reviews and approves the enrollment
+4. Once approved, a campaign is created and linked to the offer
+
+### Offer Stats
+
+For offers you're enrolled in, you can view performance stats:
+- Lead volume and acceptance rate
+- Revenue generated
+- Top-performing campaigns
+
 ## API Keys
 
 You can access the partner portal API programmatically using API keys.
@@ -233,6 +296,8 @@ GET /api/partner/leads
 Authorization: Bearer lr_your_partner_api_key
 ```
 
+To use this key with Claude Code (the MCP server), set `ISCALE_MCP_ROLE` to `partner` in `.mcp.json`. You then get the partner portal tools only.
+
 ### Partner API Endpoints
 
 | Endpoint | Method | Description |
@@ -248,6 +313,12 @@ Authorization: Bearer lr_your_partner_api_key
 | `/api/partner/settings` | GET/PUT | Your profile |
 | `/api/partner/api-keys` | GET/POST | List/create API keys |
 | `/api/partner/api-keys/{id}` | DELETE | Revoke an API key |
+| `/api/partner/consent/accounts` | GET | Consent verification accounts |
+| `/api/partner/calls` | GET | Calls from your campaigns |
+| `/api/partner/engagements` | GET | Your engagements |
+| `/api/partner/people` | GET | Search your lead contacts |
+| `/api/partner/people/{id}` | GET | Contact detail |
+| `/api/partner/people/{id}/timeline` | GET | 90-day activity timeline |
 
 ## Sessions — Multi-Step Lead Capture
 

package/.claude/skills/welcome/SKILL.md

@@ -47,20 +47,23 @@ After role selection, check if the MCP server is configured:
 To connect Claude Code to your iSCALE instance, I need two things:
 
 1. **Your iSCALE URL** — the URL where you access iSCALE
-   (e.g., https://leads.iscale.com or https://your-company.iscale.com)
+   (e.g., https://theleadrouter.com)
 
-2. **An API key** — you can get one from Settings > API Keys in the admin dashboard
-   (it starts with lr_)
+2. **An API key that matches your role.** It starts with lr_.
+   - Admins: a System key from System → API Keys in the admin dashboard.
+   - Partners: a partner key from Settings in the partner portal.
+   - Buyers: a buyer key from Settings in the buyer portal.
+   Do NOT use a campaign posting key (pk_…). See the README for screenshots.
 
 Do you have these ready?
 ```
 
-If they have the info, write the `.mcp.json` config and tell them to restart Claude Code.
+If they have the info, write the `.mcp.json` config (`ISCALE_API_URL` = `https://theleadrouter.com`, `ISCALE_API_KEY` = their `lr_` key) and tell them to restart Claude Code. Set `ISCALE_MCP_ROLE` to match the key: leave it out for a System key (it defaults to `admin`), `partner` for a partner key, `buyer` for a buyer key. The role decides which tools they get.
 
 If they don't have an API key yet:
-- **Admins:** "Go to Settings > API Keys in your admin dashboard and create one."
-- **Partners:** "Ask your admin to create a partner API key for you, or go to Settings in your partner portal."
-- **Buyers:** "Ask your admin to create a buyer API key for you, or go to Settings in your buyer portal."
+- **Admins:** Point them at the README screenshot (`docs/create-api-key.png`) and say: "Go to **System → API Keys** (not Settings). Click Create API Key. Key Type = **System**. Select **admin** plus the app scopes you need (`routing`, `messaging`, `calls`). Copy the `lr_` value — it is shown once. A posting key (`pk_`) will not work."
+- **Partners:** "Ask your admin to create a partner API key for you, or go to Settings in your partner portal. Do not use a campaign posting key. In `.mcp.json`, set `ISCALE_MCP_ROLE` to `partner`."
+- **Buyers:** "Ask your admin to create a buyer API key for you, or go to Settings in your buyer portal. In `.mcp.json`, set `ISCALE_MCP_ROLE` to `buyer`."
 
 ## Step 3: Role-Specific Walkthrough
 

package/CLAUDE.md

@@ -205,7 +205,7 @@ A buyer's CRM or backend system for lead delivery.
 ## Common Gotchas
 
 1. **Vertical mismatch** — Campaign, contract, and offer must reference the SAME vertical
-2. **Posting key vs API key** — postingKey (lr_xxx on campaign) is for lead submission, not the same as admin/partner API keys
+2. **Posting key vs API key** — a campaign posting key (`pk_…`, shown on Posting Specs) is for `POST /api/v1/leads/submit` only. Claude Code / MCP takes an `lr_…` key plus `ISCALE_MCP_ROLE` to match it. Admins: a **System** key minted at **System → API Keys** with Key Type = System and the `admin` scope; role `admin` is the default. Partners: a partner portal key with `ISCALE_MCP_ROLE=partner`. Buyers: a buyer portal key with `ISCALE_MCP_ROLE=buyer`. A posting key never works, and a partner or buyer key left on the default `admin` role fails on admin tools. Screenshot of the real dialog: `docs/create-api-key.png`.
 3. **Buyer balance** — if balance exceeds creditLimit, contracts are skipped during routing
 4. **Cap resets** — caps reset at midnight in the contract's scheduleTimezone, not UTC
 5. **Inactive cascades** — pausing a buyer pauses all their contracts; pausing an offer can cascade to campaigns
@@ -232,7 +232,7 @@ A buyer's CRM or backend system for lead delivery.
 ## Auth
 
 - **Admin dashboard:** Session-based (JWT in `lr_session` cookie)
-- **Partner lead submission:** `Authorization: Bearer lr_xxx` (campaign postingKey)
-- **Partner portal API:** Session cookie or partner API key
-- **Buyer portal API:** Session cookie or buyer API key
-- **Admin API:** `Authorization: Bearer lr_xxx` (admin API key)
+- **Partner lead submission:** `Authorization: Bearer pk_xxx` (campaign posting key)
+- **Partner portal API:** Session cookie or partner API key (`lr_xxx`)
+- **Buyer portal API:** Session cookie or buyer API key (`lr_xxx`)
+- **Admin API / Claude Code MCP:** `Authorization: Bearer lr_xxx` (System key with `admin` scope, minted at System → API Keys — not Settings). Partner and buyer portal keys also work with the MCP server when `ISCALE_MCP_ROLE` is `partner` or `buyer`.

package/README.md

@@ -78,11 +78,44 @@ The MCP server lets Claude Code interact with your theLeadRouter instance direct
 
 ### 1. Generate an API key
 
-Go to **Settings > API Keys** in your admin dashboard and create an API key. It will start with `lr_`.
+Pick the key that matches who you are. The key decides which tools you get, so set `ISCALE_MCP_ROLE` to match it.
+
+| You are | Key | `ISCALE_MCP_ROLE` |
+|---|---|---|
+| A tenant admin | **System** key from **System → API Keys** (steps below) | `admin` (the default) |
+| A partner | Partner portal key (`lr_…`, scope `routing`). Make it in **Partner portal → Settings**, or an admin makes it on the partner's **API Keys** tab. | `partner` |
+| A buyer | Buyer portal key (`lr_…`). Make it in **Buyer portal → Settings**. | `buyer` |
+
+A campaign posting key (`pk_…`) never works here. It only submits leads.
+
+#### System key (admins)
+
+1. In the admin dashboard go to **System → API Keys** (`/admin/api-keys`). This is **not** Settings, and it is **not** the API Keys tab on a partner or buyer.
+2. Click **Create API Key**.
+3. Fill the dialog like this — the screenshot below is the real form:
+
+   | Field | What to pick |
+   |---|---|
+   | **Key Name** | Anything you'll recognize (e.g. `Claude Code`) |
+   | **Key Type** | **System** — leave Buyer and Partner unselected |
+   | **Scopes** | **admin** plus every app this key needs (`routing`, `messaging`, `calls`, `calls_rtb`). There is no "all" shortcut; `admin` is never implied by the app scopes. |
+   | **Allow billing operations** | Leave **off** unless Claude must move money |
+   | **Read-only key** | Leave **off** if you want Claude to create or update things |
+   | **Allow PII access** | On if you want unmasked names, emails, and phones |
+
+<p align="left">
+  <img src="docs/create-api-key.png" alt="Create API Key dialog. Key Type is System. Scopes admin, routing, messaging, calls, and calls_rtb are selected. Allow billing operations is off. Read-only is off. Allow PII access is on." width="420" />
+</p>
+
+4. Click **Create Key** and copy the value immediately. It starts with `lr_` and is shown **once**.
+
+**Wrong keys people have used:** a campaign posting key (`pk_…`, from an offer's Posting Specs page), or a System key that only has `routing` and not `admin`. Those authenticate, then fail on admin tools. A Partner or Buyer key with the default role (`admin`) fails the same way; set `ISCALE_MCP_ROLE` to `partner` or `buyer`.
 
 ### 2. Add to your Claude Code config
 
-Add the following to your `.mcp.json` file. Replace `lr_your_key_here` with your actual key.
+Add the following to your `.mcp.json` file. Replace `lr_your_key_here` with the key you just copied.
+
+**Admin (System key).** No role needed; `admin` is the default.
 
 ```json
 {
@@ -91,7 +124,7 @@ Add the following to your `.mcp.json` file. Replace `lr_your_key_here` with your
       "command": "npx",
       "args": ["-y", "theleadrouter-mcp@latest"],
       "env": {
-        "ISCALE_API_URL": "https://leads.iscale.com",
+        "ISCALE_API_URL": "https://theleadrouter.com",
         "ISCALE_API_KEY": "lr_your_key_here"
       }
     }
@@ -99,6 +132,74 @@ Add the following to your `.mcp.json` file. Replace `lr_your_key_here` with your
 }
 ```
 
+**Partner (partner portal key).**
+
+```json
+{
+  "mcpServers": {
+    "theleadrouter": {
+      "command": "npx",
+      "args": ["-y", "theleadrouter-mcp@latest"],
+      "env": {
+        "ISCALE_API_URL": "https://theleadrouter.com",
+        "ISCALE_API_KEY": "lr_your_key_here",
+        "ISCALE_MCP_ROLE": "partner"
+      }
+    }
+  }
+}
+```
+
+**Buyer (buyer portal key).**
+
+```json
+{
+  "mcpServers": {
+    "theleadrouter": {
+      "command": "npx",
+      "args": ["-y", "theleadrouter-mcp@latest"],
+      "env": {
+        "ISCALE_API_URL": "https://theleadrouter.com",
+        "ISCALE_API_KEY": "lr_your_key_here",
+        "ISCALE_MCP_ROLE": "buyer"
+      }
+    }
+  }
+}
+```
+
+#### Role and scope filters
+
+The role picks your tool set: about 900 tools for `admin`, 93 for `buyer`, 84 for `partner` (reads and writes; [sensitive tools](#sensitive-tools) excluded). You can narrow it further to reduce context usage:
+
+| Env var | Values | Effect |
+|---|---|---|
+| `ISCALE_MCP_ROLE` | `admin` (default) \| `buyer` \| `partner` | Which key you are using. Only tools that role may call are registered. Any other value stops the server with an error. |
+| `ISCALE_MCP_SCOPE` | `read` \| `write` \| `all` (default) | Filter by write flag |
+| `ISCALE_MCP_DOMAINS` | comma list, e.g. `verticals,campaigns,buyers` | Restrict to specific domains |
+| `ISCALE_MCP_INCLUDE_UI` | `true` (default `false`) | Include admin-UI navigation tools (only useful inside the in-app agent) |
+| `ISCALE_MCP_ALLOW_SENSITIVE` | `true` (default: hidden) | Register the [sensitive tools](#sensitive-tools). Only the exact value `true` enables them. |
+
+#### Sensitive tools
+
+Tools that mint, reveal, rotate or redeem a credential, token or secret, or that impersonate another user, are **not registered by default**. An agent cannot call a tool it was never given, so a prompt-injected or confused agent cannot mint an API key, read a provider credential or start impersonation through this server.
+
+Hidden by default (full list in [`src/sensitive-tools.ts`](src/sensitive-tools.ts)):
+
+- API keys: admin, messaging, buyer and partner key create / list / get / update / revoke
+- Posting keys and spec / setup tokens: rotate, regenerate, create, list, revoke
+- Passwords, impersonation, sign-in codes, Stripe billing-portal sessions
+- Provider credentials and intake credential propagation, the Zoho OAuth callback
+- Signed recording URLs, softphone tokens, invitation bearer links
+
+To enable them set `ISCALE_MCP_ALLOW_SENSITIVE=true`. Any other value (`1`, `yes`, `TRUE`, unset) keeps them hidden. Enable it only for a session that needs it.
+
+Recommendations:
+
+- **Least privilege.** Use a key whose role and scopes cover only what you need. Combine `ISCALE_MCP_SCOPE=read` with a read-only key when you only need to look things up.
+- **https only.** Point `ISCALE_API_URL` at an `https://` URL. The server prints a warning to stderr at startup when the URL is not https and not `localhost` / `127.0.0.1` / `[::1]`. It does not refuse to start.
+- **Treat the key as a password.** Keep it in your MCP config's `env`, never in a prompt, and revoke it at System → API Keys if it leaks.
+
 ### 3. Restart Claude Code
 
 Close and reopen Claude Code so it picks up the new MCP server config.
@@ -109,7 +210,7 @@ Try asking: `"Use search_leads to show me recent leads"`
 
 ## MCP Server Tools
 
-Once connected, Claude Code can use 300+ tools across these categories:
+Once connected with a System key, Claude Code can use about 900 tools across these categories (partner and buyer keys get the tools for their own portal):
 
 | Category | Examples |
 |----------|----------|
@@ -153,6 +254,37 @@ Once connected, Claude Code can use 300+ tools across these categories:
 "How many leads am I getting per day this week?"
 ```
 
+## Regenerating the Tool Catalog (maintainers)
+
+Tools are generated from three spec snapshots committed in `spec/`. They are the same specs
+the platform serves for each API-key role:
+
+| File | Used for |
+|---|---|
+| `spec/openapi-customer.yaml` | Every tool definition (the tenant/admin surface; no superadmin ops) |
+| `spec/openapi-partner.yaml` | Which tools get the `partner` role |
+| `spec/openapi-buyer.yaml` | Which tools get the `buyer` role |
+
+A tool gets `admin` when it is in the customer spec and its path is not under `/api/buyer/`,
+`/api/partner/`, `/api/referrer/` or `/api/v1/buyer/me/`. An op under one of those portal paths that is missing from
+that portal's spec gets no role; the generator skips it and lists it in its warnings.
+The generator fails (exit 1) if any `/api/superadmin/` or `x-superadmin-only` op shows up.
+
+```bash
+# 1. Refresh the snapshots from the monorepo (regen there first if schema changed)
+cp /path/to/theLeadRouter/apps/routing/generated/docs/openapi-{customer,partner,buyer}.yaml spec/
+
+# 2. Regenerate src/tools/generated/*
+npm run generate
+
+# 3. Verify catalog ↔ spec parity + run the suite
+npm test
+```
+
+`SPEC_DIR=/path/to/dir npm run generate` reads the three files from another directory.
+The spec-parity test (`src/spec-parity.test.ts`) fails if the catalog drifts from the
+committed specs — regenerate rather than hand-editing anything under `src/tools/generated/`.
+
 ## About
 
 theLeadRouter is a B2B lead distribution platform that routes leads from partners to buyers through offer-based contracts. Learn more at [theleadrouter.com](https://theleadrouter.com).

package/dist/index.d.ts

@@ -1,12 +1,35 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ApiKeyAuthAdapter } from './auth-adapter.js';
+import type { ToolDefinition, ToolRegistry } from './registry.js';
 export { ToolRegistry, type ToolDefinition, type ToolMetadata } from './registry.js';
 export { SessionAuthAdapter, ApiKeyAuthAdapter, type AuthAdapter } from './auth-adapter.js';
 export { registerUiTools } from './tools/ui.js';
 export { registerCompositeTools } from './tools/composite.js';
 export { buildRegistry } from './build-registry.js';
+export { SENSITIVE_TOOL_NAMES } from './sensitive-tools.js';
+export declare const ROLES: readonly ["admin", "buyer", "partner"];
+export type Role = (typeof ROLES)[number];
+export type ScopeFilter = {
+    scope?: 'read' | 'write' | 'all';
+    domains?: string[];
+    includeUi?: boolean;
+    /** Which API key the server runs with. Defaults to admin (a System key). */
+    role?: Role;
+    /** Register SENSITIVE_TOOL_NAMES (credential/token/impersonation tools). Defaults to false. */
+    allowSensitive?: boolean;
+};
+export declare function filterTools(registry: ToolRegistry, filter?: ScopeFilter): ToolDefinition[];
+export declare function mountRegistryOnServer(server: McpServer, registry: ToolRegistry, auth: ApiKeyAuthAdapter, filter?: ScopeFilter): number;
+/** ISCALE_MCP_ROLE: unset → admin; anything other than the three roles is an error. */
+export declare function parseRole(value: string | undefined): Role;
+/** ISCALE_MCP_ALLOW_SENSITIVE: only the exact string 'true' enables; anything else keeps them hidden. */
+export declare function parseAllowSensitive(value: string | undefined): boolean;
+/** Warning text when ISCALE_API_URL is neither https nor a local host. Never includes the URL itself. */
+export declare function apiUrlWarning(value: string): string | null;
 export declare function createServer(config: {
     baseUrl: string;
     apiKey: string;
+    filter?: ScopeFilter;
 }): McpServer;
 export declare function startServer(): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAKnE,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,aAQvE;AAED,wBAAsB,WAAW,kBAgBhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAGjE,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,eAAO,MAAM,KAAK,wCAAyC,CAAA;AAC3D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzC,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB,CAAA;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,GAAE,WAAgB,GAAG,cAAc,EAAE,CAiB9F;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,iBAAiB,EACvB,MAAM,GAAE,WAAgB,GACvB,MAAM,CAuCR;AAOD,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIzD;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE;AAID,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1D;AAQD,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,aASA;AAED,wBAAsB,WAAW,kBAmChC"}

package/dist/index.js

@@ -1,19 +1,117 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { ApiClient } from './api-client.js';
-import { registerAllTools } from './register.js';
+import { z } from 'zod';
+import { ApiKeyAuthAdapter } from './auth-adapter.js';
+import { buildRegistry } from './build-registry.js';
+import { SENSITIVE_TOOL_NAMES } from './sensitive-tools.js';
 export { ToolRegistry } from './registry.js';
 export { SessionAuthAdapter, ApiKeyAuthAdapter } from './auth-adapter.js';
 export { registerUiTools } from './tools/ui.js';
 export { registerCompositeTools } from './tools/composite.js';
 export { buildRegistry } from './build-registry.js';
+export { SENSITIVE_TOOL_NAMES } from './sensitive-tools.js';
+export const ROLES = ['admin', 'buyer', 'partner'];
+export function filterTools(registry, filter = {}) {
+    const scope = filter.scope ?? 'all';
+    const includeUi = filter.includeUi ?? false;
+    const domains = filter.domains?.length ? new Set(filter.domains) : null;
+    const role = filter.role ?? 'admin';
+    const allowSensitive = filter.allowSensitive ?? false;
+    return registry.getAll().filter(tool => {
+        // A tool that declares no roles is admin-only, so it can never leak into a portal scope.
+        if (!(tool.metadata.allowedRoles ?? ['admin']).includes(role))
+            return false;
+        if (!allowSensitive && SENSITIVE_TOOL_NAMES.has(tool.name))
+            return false;
+        if (!includeUi && tool.metadata.domain === 'ui')
+            return false;
+        if (domains && !domains.has(tool.metadata.domain))
+            return false;
+        if (scope === 'read' && tool.metadata.isWrite)
+            return false;
+        if (scope === 'write' && !tool.metadata.isWrite)
+            return false;
+        return true;
+    });
+}
+export function mountRegistryOnServer(server, registry, auth, filter = {}) {
+    const tools = filterTools(registry, filter);
+    for (const tool of tools) {
+        const shape = tool.zodSchema instanceof z.ZodObject ? tool.zodSchema.shape : {};
+        const description = tool.metadata.confirmRequired && tool.metadata.isWrite
+            ? `${tool.description}\n\n⚠️ Write operation — this mutates live data.`
+            : tool.description;
+        const annotations = {
+            readOnlyHint: !tool.metadata.isWrite,
+            destructiveHint: tool.metadata.isWrite && (tool.metadata.method === 'DELETE' || tool.metadata.confirmRequired),
+            idempotentHint: tool.metadata.method === 'GET' || tool.metadata.method === 'PUT' || tool.metadata.method === 'DELETE',
+            openWorldHint: true,
+        };
+        server.registerTool(tool.name, { description, inputSchema: shape, annotations }, async (args) => {
+            try {
+                const result = await tool.handler(args, auth);
+                const text = typeof result === 'string' ? result : JSON.stringify(result, null, 2);
+                const isError = result !== null &&
+                    typeof result === 'object' &&
+                    'error' in result &&
+                    result.error === true;
+                return { content: [{ type: 'text', text }], isError: isError || undefined };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { content: [{ type: 'text', text: `Error: ${msg}` }], isError: true };
+            }
+        });
+    }
+    return tools.length;
+}
+function parseScope(value) {
+    if (value === 'read' || value === 'write' || value === 'all')
+        return value;
+    return 'all';
+}
+/** ISCALE_MCP_ROLE: unset → admin; anything other than the three roles is an error. */
+export function parseRole(value) {
+    if (value === undefined)
+        return 'admin';
+    if (ROLES.includes(value))
+        return value;
+    throw new Error(`Invalid ISCALE_MCP_ROLE ${JSON.stringify(value)}. Valid values: ${ROLES.join(', ')}.`);
+}
+/** ISCALE_MCP_ALLOW_SENSITIVE: only the exact string 'true' enables; anything else keeps them hidden. */
+export function parseAllowSensitive(value) {
+    return value === 'true';
+}
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** Warning text when ISCALE_API_URL is neither https nor a local host. Never includes the URL itself. */
+export function apiUrlWarning(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return 'Warning: ISCALE_API_URL is not a valid URL.';
+    }
+    if (url.protocol === 'https:')
+        return null;
+    if (url.protocol === 'http:' && LOCAL_HOSTS.has(url.hostname))
+        return null;
+    return 'Warning: ISCALE_API_URL is not https; the API key will be sent unencrypted. Use an https:// URL.';
+}
+function parseDomains(value) {
+    if (!value)
+        return undefined;
+    const list = value.split(',').map(s => s.trim()).filter(Boolean);
+    return list.length ? list : undefined;
+}
 export function createServer(config) {
     const server = new McpServer({
         name: 'iscale-lead-routing',
-        version: '0.1.0',
+        version: '0.3.1',
     });
-    const api = new ApiClient(config);
-    registerAllTools(server, api);
+    const auth = new ApiKeyAuthAdapter(config.apiKey, config.baseUrl);
+    const registry = buildRegistry();
+    mountRegistryOnServer(server, registry, auth, config.filter);
     return server;
 }
 export async function startServer() {
@@ -27,7 +125,25 @@ export async function startServer() {
         console.error('ISCALE_API_KEY environment variable is required');
         process.exit(1);
     }
-    const server = createServer({ baseUrl, apiKey });
+    const urlWarning = apiUrlWarning(baseUrl);
+    if (urlWarning)
+        console.error(urlWarning);
+    let role;
+    try {
+        role = parseRole(process.env.ISCALE_MCP_ROLE);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    const filter = {
+        role,
+        scope: parseScope(process.env.ISCALE_MCP_SCOPE),
+        domains: parseDomains(process.env.ISCALE_MCP_DOMAINS),
+        includeUi: process.env.ISCALE_MCP_INCLUDE_UI === 'true',
+        allowSensitive: parseAllowSensitive(process.env.ISCALE_MCP_ALLOW_SENSITIVE),
+    };
+    const server = createServer({ baseUrl, apiKey, filter });
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD,OAAO,EAAE,YAAY,EAA0C,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,MAAM,UAAU,YAAY,CAAC,MAA2C;IACtE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;IACjC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,OAAO,EAAE,YAAY,EAA0C,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAU,CAAA;AAa3D,MAAM,UAAU,WAAW,CAAC,QAAsB,EAAE,SAAsB,EAAE;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAA;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAA;IACnC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,KAAK,CAAA;IAErD,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACrC,yFAAyF;QACzF,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC7D,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/D,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC3D,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC7D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAiB,EACjB,QAAsB,EACtB,IAAuB,EACvB,SAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,MAAM,WAAW,GACf,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpD,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,kDAAkD;YACvE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAEtB,MAAM,WAAW,GAAG;YAClB,YAAY,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC9G,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACrH,aAAa,EAAE,IAAI;SACpB,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC7C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;gBAClF,MAAM,OAAO,GACX,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,OAAO,IAAI,MAAM;oBAChB,MAA6B,CAAC,KAAK,KAAK,IAAI,CAAA;gBAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAA;YACtF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACvF,CAAC;QACH,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACvC,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAa,CAAA;IACtE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzG,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,MAAM,CAAA;AACzB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAEhE,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,6CAA6C,CAAA;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,OAAO,kGAAkG,CAAA;AAC3G,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAI5B;IACC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAA;IAChC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAEzC,IAAI,IAAU,CAAA;IACd,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACrD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;QACvD,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;KAC5E,CAAA;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC"}