uol-mcp 0.0.0-stage → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jakub Begera
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.cs.md

@@ -0,0 +1,118 @@
+# uol-mcp — návod
+
+Napojení [UOL Účetnictví](https://www.uol.cz) na AI asistenty (Claude, Cursor a další klienty
+s podporou [MCP](https://modelcontextprotocol.io)). Asistent pak umí odpovídat nad vaším účetnictvím:
+vydané a přijaté faktury, kdo vám dluží, nahrané doklady, kontakty.
+
+> **Neoficiální projekt.** Není spojený s UOL a.s. Komunikuje s veřejným
+> [UOL REST API](https://api.uol.cz/) pomocí vašeho vlastního API tokenu.
+
+[English](README.md)
+
+**Stav:** verze 0.4, ve výchozím stavu pouze čtení, zápis lze zapnout. Zatím není na npm; do prvního
+vydání se spouští [ze zdrojového kódu](README.md#from-source).
+
+## Co umí
+
+- **Přehled firmy jedním dotazem:** tento a minulý měsíc, DPH, pohledávky, doklady ke zpracování
+  a zůstatky na účtech.
+- **Tržby, náklady a zisk:** po měsících z hlavní knihy, stejně jako dashboard UOL, včetně
+  největších nákladových a výnosových účtů.
+- **DPH:** za zdaňovací období, k zaplacení nebo nadměrný odpočet, termín podání; u neuzavřeného
+  období jako odhad z faktur.
+- **Zůstatky na účtech:** podle účtů a měn (UOL eviduje měsíční počáteční stavy, ne aktuální zůstatek).
+- **Faktury:** hledání vydaných i přijatých faktur, detail s položkami a DPH, stav úhrady
+  u vydaných faktur.
+- **Pohledávky:** kdo vám dluží, kolik a jak dlouho po splatnosti, součty podle měn.
+- **Export:** PDF nebo ISDOC vydané faktury uložené na disk.
+- **Kontakty:** odběratelé a dodavatelé podle názvu, IČO nebo DIČ, s adresami a bankovními účty.
+- **Nahrané doklady:** co čeká na zpracování, stažení původního souboru.
+- **Číselníky:** měny, střediska, zakázky, ceníky, vlastní bankovní účty a další.
+
+Připravené postupy (v klientech jako příkazy s lomítkem): `monthly_review` (měsíční přehled),
+`vat_check` (kontrola DPH), `overdue_followup` (návrhy upomínek, nic neodesílá) a `process_inbox`
+(projde nahrané doklady).
+
+Příklady otázek:
+
+- „Jak si letos stojíme?“
+- „Kolik zaplatím DPH za tento kvartál?“
+- „Na čem nejvíc utrácíme?“
+- „Kdo mi dluží víc než 30 dní?“
+- „Je faktura 2026000123 zaplacená?“
+- „Kolik jsme letos fakturovali firmě Alza?“
+- „Stáhni mi PDF poslední vydané faktury.“
+- „Které nahrané doklady ještě účetní nezpracovala?“
+
+## Jak získat API token
+
+1. Otevřete v UOL stránku API tokenů (adresa `/api_tokens` na vaší instanci, např.
+   `https://firma.ucetnictvi.uol.cz/api_tokens`) a vytvořte token.
+2. Uživatel musí mít oprávnění **REST API**. Doporučujeme samostatného uživatele jen s právy,
+   která má asistent mít.
+
+Název instance (tenant) je první část vaší adresy UOL: `https://firma.ucetnictvi.uol.cz` → `firma`.
+
+Chcete si to nejdřív vyzkoušet? S `UOL_TENANT=demo` se použije veřejná DEMO firma od UOL,
+token není potřeba.
+
+## Nastavení v Claude Desktop
+
+Nastavení → Developer → Edit Config a doplňte:
+
+```json
+{
+  "mcpServers": {
+    "uol": {
+      "command": "npx",
+      "args": ["-y", "uol-mcp"],
+      "env": {
+        "UOL_TENANT": "firma",
+        "UOL_EMAIL": "vas@email.cz",
+        "UOL_TOKEN": "vas-token"
+      }
+    }
+  }
+}
+```
+
+Po restartu Claude Desktop zkuste: „Jaké jsou údaje naší firmy v UOL?“
+
+Ostatní klienty (Claude Code, Cursor, VS Code), Docker, HTTP server a všechny proměnné prostředí
+popisuje [anglické README](README.md#configuration).
+
+## Zápis (volitelný)
+
+S `UOL_ACCESS=write` (v Claude Desktop rozšíření pole „Access“ = `write`) asistent umí navíc:
+
+- **nahrát doklad** (PDF) účetní do UOL, a to jen ze složek Stažené soubory, Plocha a Dokumenty;
+- **vystavit fakturu** existujícímu kontaktu, standardně jako koncept;
+- **upravit nebo vystavit koncept faktury**; už vystavenou fakturu UOL měnit nedovolí;
+- **zaevidovat přijatou fakturu**, **založit nebo upravit kontakt** (s kontrolou duplicitního IČO);
+- **vytvořit upomínku** k neuhrazeným fakturám jednoho odběratele (nic se neodesílá);
+- **zpracovat nahrané doklady**: označit jako zpracované, spárovat s fakturou, přidat štítek.
+
+S `UOL_ACCESS=full` navíc smazání konceptu faktury, storno nebo vrácení vystavené faktury do konceptu
+a obecný zápis do libovolného endpointu.
+
+Před každým zápisem si asistent nechá vše ukázat nanečisto a klient vás požádá o souhlas.
+Opakované vytvoření stejné faktury nevznikne dvakrát.
+
+## Více firem (pro účetní)
+
+Jeden server obslouží víc klientských firem: v souboru `UOL_PROFILES_FILE` je seznam účtů (tenant,
+e-mail, token nebo název proměnné s tokenem). Asistent pak u každého dotazu ví, které firmy se týká,
+třeba „Kdo dluží firmě Novák?“. Formát souboru popisuje [anglické README](README.md#several-companies).
+
+## Soukromí a bezpečnost
+
+- Bez `UOL_ACCESS=write` server data jen čte. Text uvnitř faktur, poznámek a dokladů je pro
+  asistenta jen data: před schválením zápisu si zkontrolujte, co navrhuje.
+- Vše, co nástroje vrátí, dostane AI model, který váš klient používá. Účetnictví obsahuje osobní
+  údaje kontaktů a zaměstnanců; zvolte si takový tarif, s jehož podmínkami souhlasíte.
+- Přihlašovací údaje se posílají jen na `https://*.uol.cz` a nikdy se nezapisují do logů.
+- Stažené soubory se ukládají jen do složky `UOL_DOWNLOAD_DIR` (výchozí `~/Downloads/uol-mcp`).
+
+## Licence
+
+[MIT](LICENSE)

package/README.md

@@ -1,3 +1,259 @@
-# Temporary Holding Version
+# uol-mcp
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[Model Context Protocol](https://modelcontextprotocol.io) server for
+[UOL Účetnictví](https://www.uol.cz) — ask Claude, Cursor or any other MCP client about your
+bookkeeping: issued and received invoices, who owes you money, uploaded documents, contacts.
+
+> **Unofficial.** Not affiliated with or endorsed by UOL a.s. It talks to the public
+> [UOL REST API](https://api.uol.cz/) with your own API token.
+
+[Česky](README.cs.md)
+
+**Status:** v0.4 — read-only by default, opt-in writes. Not on npm yet; run it [from source](#from-source) until the first release.
+
+## What it can do
+
+| Tool | Answers |
+|---|---|
+| `get_business_snapshot` | How the company is doing, in one call: this month vs last, VAT, receivables, documents to process, bank |
+| `get_financial_overview` | Revenue, expenses and profit per month from the general ledger, largest accounts |
+| `get_vat_overview` | VAT per filing period: to pay or excess deduction, due date, final or estimate |
+| `get_bank_balances` | Bank balances per account and currency (UOL keeps monthly snapshots) |
+| `get_company` | Company name, IČO, DIČ, address, VAT filing period; doubles as a connection check |
+| `search_sales_invoices`, `get_sales_invoice` | Issued invoices with line items, VAT and payment status |
+| `search_purchase_invoices`, `get_purchase_invoice` | Received invoices |
+| `list_receivables` | Who owes you, how much, how long overdue — totals per currency |
+| `export_sales_invoice` | PDF or ISDOC of an issued invoice, saved to disk (ISDOC is also returned as XML) |
+| `search_contacts`, `get_contact` | Customers and suppliers by name, IČO or DIČ, with addresses and bank accounts |
+| `list_uploaded_documents`, `get_uploaded_document`, `download_uploaded_document` | Documents uploaded for the accountant, their state and files |
+| `list_codebook` | Currencies, departments, contracts, price lists, own bank accounts, … |
+| `api_get` | Read-only GET of any other `/v1/…` endpoint |
+
+Example questions: *"Jak si letos stojíme?"*, *"Kolik zaplatím DPH za tento kvartál?"*,
+*"Kdo mi dluží víc než 30 dní?"*, *"Je faktura 2026000123 zaplacená?"*,
+*"Na čem nejvíc utrácíme?"*, *"Stáhni mi PDF poslední vydané faktury."*
+
+More read tools are available as opt-in toolsets (`UOL_TOOLSETS`): `ledger` (general-ledger postings, internal
+documents), `banking` (bank movements, petty-cash documents) and `warehouse` (products, stock levels, orders).
+
+Ready-made prompts (slash commands in most clients): `monthly_review`, `vat_check`,
+`overdue_followup` (drafts reminders, sends nothing), `process_inbox`. The `uol://guide` resource
+explains the domain to the model.
+
+The server knows the API's quirks: invoice status `valid` means *draft*, payment status exists only
+for issued invoices, credit notes come with positive amounts, revenue and expenses have to be read
+from the ledger (excluding year-end closing entries), purchase invoices ignore issue-date filters,
+files have three different download shapes, and the rate limit (30 requests / 10 s) is respected
+client-side. See [docs/DESIGN.md](docs/DESIGN.md).
+
+## Getting an API token
+
+1. Open the API tokens page of your UOL tenant (path `/api_tokens`, e.g.
+   `https://firma.ucetnictvi.uol.cz/api_tokens`) and create a token.
+2. The UOL user needs the **REST API** permission. A dedicated user with only the rights you want
+   the assistant to have is a good idea.
+
+Your tenant is the first part of your UOL address: `https://firma.ucetnictvi.uol.cz` → `firma`.
+
+Want to try it first? `UOL_TENANT=demo` uses UOL's public DEMO company, no token needed.
+
+## Configuration
+
+| Variable | Meaning |
+|---|---|
+| `UOL_TENANT` | `demo`, your tenant name (`firma`), a host prefix (`firma.sandbox`) or the full `https://….uol.cz` URL |
+| `UOL_EMAIL` | E-mail you log into UOL with |
+| `UOL_TOKEN` | API token |
+| `UOL_DOWNLOAD_DIR` | Where exported and downloaded files go (default `~/Downloads/uol-mcp`) |
+| `UOL_TOOLSETS` | Comma-separated: `core`, `insights` (these two are the default), `ledger`, `banking`, `warehouse`, or `all` |
+| `UOL_ACCESS` | `read` (default), `write` or `full` — see [Writing](#writing-opt-in) |
+| `UOL_PROFILES_FILE` | Several companies in one server — see [Several companies](#several-companies) |
+| `UOL_UPLOAD_DIRS` | Folders `upload_document` may read from (default `~/Downloads`, `~/Desktop`, `~/Documents`; `:`-separated, `;` on Windows) |
+| `UOL_AUDIT_LOG` | File that records every write as a JSON line |
+| `UOL_DEBUG` | `1` logs requests to stderr (never credentials) |
+
+### Claude Desktop
+
+Settings → Developer → Edit Config, then add:
+
+```json
+{
+  "mcpServers": {
+    "uol": {
+      "command": "npx",
+      "args": ["-y", "uol-mcp"],
+      "env": {
+        "UOL_TENANT": "firma",
+        "UOL_EMAIL": "you@example.com",
+        "UOL_TOKEN": "your-token"
+      }
+    }
+  }
+}
+```
+
+### Claude Code
+
+```bash
+claude mcp add uol -e UOL_TENANT=firma -e UOL_EMAIL=you@example.com -e UOL_TOKEN=your-token -- npx -y uol-mcp
+```
+
+### Cursor / VS Code
+
+Cursor (`.cursor/mcp.json`) uses the same `mcpServers` block as Claude Desktop. VS Code
+(`.vscode/mcp.json`):
+
+```json
+{
+  "servers": {
+    "uol": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "uol-mcp"],
+      "env": { "UOL_TENANT": "firma", "UOL_EMAIL": "you@example.com", "UOL_TOKEN": "your-token" }
+    }
+  }
+}
+```
+
+### Docker
+
+```bash
+docker run -i --rm -e UOL_TENANT=firma -e UOL_EMAIL=you@example.com -e UOL_TOKEN=your-token -v "$HOME/Downloads/uol-mcp:/data" ghcr.io/jakubbegera/uol-mcp
+```
+
+Exported and downloaded files are written to `/data` inside the container; the `-v` mount keeps them.
+In an MCP client config, use `docker` as the command and the rest as `args`.
+
+### Claude Desktop extension
+
+Each release ships `uol-mcp.mcpb`. Open it to install, then fill in tenant, e-mail and token in the
+form; the token is stored as a secret. `bash scripts/build-mcpb.sh` builds the bundle from source.
+
+### HTTP server (self-hosting)
+
+```bash
+MCP_TRANSPORT=http MCP_AUTH_TOKEN=change-me UOL_TENANT=firma UOL_EMAIL=you@example.com UOL_TOKEN=your-token npx -y uol-mcp
+```
+
+The endpoint is `http://127.0.0.1:3000/mcp` (`HOST`, `PORT` to change; `/health` for probes).
+Two modes:
+
+- **One tenant**: UOL credentials in the server's env. Clients must send `Authorization: Bearer
+  <MCP_AUTH_TOKEN>`; the server refuses to start without the token.
+- **Pass-through**: no UOL credentials in the env. Each client sends its own `X-UOL-Tenant`,
+  `X-UOL-Email` and `X-UOL-Token` headers with every request; the server stores nothing.
+  `MCP_AUTH_TOKEN` is optional.
+
+Over HTTP, exported invoices and downloaded documents come back inside the tool result instead of
+being saved on the server. In Docker, bind to all interfaces and publish the port:
+`docker run -p 3000:3000 -e MCP_TRANSPORT=http -e HOST=0.0.0.0 -e MCP_ALLOWED_HOSTS=mcp.example.com …`.
+
+### Check the setup
+
+```bash
+UOL_TENANT=firma UOL_EMAIL=you@example.com UOL_TOKEN=your-token npx -y uol-mcp doctor
+```
+
+## Writing (opt-in)
+
+With `UOL_ACCESS=write` these tools appear:
+
+| Tool | Does |
+|---|---|
+| `upload_document` | Uploads a PDF to UOL's document inbox for the accountant (only from `UOL_UPLOAD_DIRS`) |
+| `create_sales_invoice` | Creates an issued invoice for an existing contact — a draft unless `issue: true` |
+| `update_sales_invoice` | Changes or issues a draft invoice (UOL doesn't allow editing issued ones) |
+| `create_purchase_invoice` | Books a received invoice from an existing supplier |
+| `create_contact`, `update_contact` | Adds or changes a customer / supplier (refuses a duplicate IČO) |
+| `create_payment_demand` | Creates a payment demand (upomínka) for unpaid invoices of one customer — never sends it |
+| `mark_document_processed`, `pair_uploaded_document`, `tag_uploaded_document`, `untag_uploaded_document` | The accountant's inbox: state, link to the booked record, tags |
+
+`UOL_ACCESS=full` adds `delete_sales_invoice` (drafts only), `repair_sales_invoice` (storno or back to
+draft for issued invoices) and `api_request` (a raw write to any endpoint).
+
+Invoice lines need a UOL product (`list_codebook` with `kind: products` lists them). Every write
+supports `dry_run` (shows exactly what would be sent), creates are safe to retry
+(idempotency key), and the tools are marked so clients ask you before running them. Set
+`UOL_AUDIT_LOG` to keep a record of every write.
+
+## Several companies
+
+Accountants with several clients on UOL can serve them all from one server. List the accounts in
+`UOL_ACCOUNTS` and give each one its own variables (name upper-cased, `-` becomes `_`):
+
+```json
+"env": {
+  "UOL_ACCOUNTS": "firma,novak",
+  "UOL_ACCOUNT_FIRMA_TENANT": "firma",
+  "UOL_ACCOUNT_FIRMA_EMAIL": "ja@firma.cz",
+  "UOL_ACCOUNT_FIRMA_TOKEN": "op://Private/UOL firma/credential",
+  "UOL_ACCOUNT_NOVAK_TENANT": "novak",
+  "UOL_ACCOUNT_NOVAK_EMAIL": "ja@firma.cz",
+  "UOL_ACCOUNT_NOVAK_TOKEN": "op://Private/UOL novak/credential",
+  "UOL_ACCOUNT_NOVAK_LABEL": "Novák s.r.o."
+}
+```
+
+The first account is the default (or set `UOL_DEFAULT_ACCOUNT`). With the 1Password CLI, start the
+server as `op run -- node …/dist/index.js` and the `op://` references are replaced by the tokens at
+startup — nothing secret sits in the config. `uol-mcp doctor` checks every account.
+
+Alternatively, point `UOL_PROFILES_FILE` at a JSON file:
+
+```json
+{
+  "default": "firma",
+  "accounts": {
+    "firma": { "tenant": "firma", "email": "ja@firma.cz", "token_env": "UOL_TOKEN_FIRMA" },
+    "novak": { "tenant": "novak", "email": "ja@firma.cz", "token_env": "UOL_TOKEN_NOVAK", "label": "Novák s.r.o." }
+  }
+}
+```
+
+`token_env` names an environment variable holding the token, so the file needs no secrets (an inline
+`token` works too; keep such a file `chmod 600`). The server then offers `list_accounts`, and every tool
+takes an `account` argument — *"Kdo dluží firmě Novák?"* goes to the right tenant. Each account keeps
+its own rate limit.
+
+## Privacy and safety
+
+- Read-only unless you set `UOL_ACCESS=write`. Text inside invoices, notes and documents is treated
+  as data: review what the assistant proposes to write before you approve it.
+- Whatever the tools return goes to the AI model your client uses. Accounting data contains personal
+  data of your contacts and employees — use a plan whose terms you are comfortable with.
+- Credentials are used only for `https://*.uol.cz` and are never written to logs or tool output.
+- Downloaded files are saved under `UOL_DOWNLOAD_DIR` only.
+
+## From source
+
+Requires Node.js 22+.
+
+```bash
+git clone https://github.com/jakubbegera/uol-mcp.git
+cd uol-mcp
+npm install
+npm run build
+```
+
+Then point your client at `node /path/to/uol-mcp/dist/index.js` instead of `npx -y uol-mcp`.
+
+## Development
+
+```bash
+npm test                 # unit + MCP-level tests against recorded DEMO responses
+npm run typecheck
+npm run smoke            # calls every tool against the live DEMO tenant
+npm run record-fixtures  # refreshes test/fixtures/demo from the DEMO tenant
+bash scripts/build-mcpb.sh  # builds build/uol-mcp.mcpb
+docker build -t uol-mcp .
+```
+
+Releases are cut by pushing a `v*` tag; `.github/workflows/release.yml` publishes to npm, GHCR,
+the GitHub release (MCPB bundle) and the MCP Registry.
+
+Design notes, API facts and the roadmap are in [docs/DESIGN.md](docs/DESIGN.md).
+
+## License
+
+[MIT](LICENSE)

package/dist/config.js

@@ -0,0 +1,241 @@
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { delimiter, join } from 'node:path';
+/** Public DEMO tenant published in the UOL OpenAPI spec. */
+export const DEMO = {
+    baseUrl: 'https://test.demo.uol.cz/api',
+    email: 'demo@ucetnictvi-on-line.cz',
+    token: '3R1Cc_wzcSuq02Wsh1-uww',
+};
+export const TOOLSETS = ['core', 'insights', 'ledger', 'banking', 'warehouse'];
+/** What most users need; the rest is opt-in to keep the tool list short for the model. */
+export const DEFAULT_TOOLSETS = ['core', 'insights'];
+/** `read` — no writes; `write` — create / update / upload; `full` — adds destructive tools. */
+export const ACCESS_LEVELS = ['read', 'write', 'full'];
+export function defaultUploadDirs() {
+    return ['Downloads', 'Desktop', 'Documents'].map((d) => join(homedir(), d));
+}
+/** `UOL_TOOLSETS=core,ledger` / `all`; unset means [DEFAULT_TOOLSETS]; unknown names are reported, not fatal. */
+export function parseToolsets(raw) {
+    const names = (raw ?? '')
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    if (names.length === 0)
+        return { toolsets: new Set(DEFAULT_TOOLSETS), unknown: [] };
+    if (names.includes('all'))
+        return { toolsets: new Set(TOOLSETS), unknown: [] };
+    const known = names.filter((n) => TOOLSETS.includes(n));
+    return { toolsets: new Set(known), unknown: names.filter((n) => !known.includes(n)) };
+}
+export class ConfigError extends Error {
+}
+/**
+ * Turns whatever the user typed as a tenant into the API root.
+ *
+ * Accepted forms:
+ *  - `demo` → the public DEMO tenant
+ *  - `firma` → `https://firma.ucetnictvi.uol.cz/api` (production is the common case)
+ *  - `firma.ucetnictvi`, `firma.sandbox` → `https://<prefix>.uol.cz/api`
+ *  - a full URL with or without `/api` or `/api/v1`
+ *
+ * Only `https://*.uol.cz` hosts are allowed, so a typo or a hostile config can't
+ * make the server send the user's Basic-auth credentials somewhere else.
+ */
+export function resolveTenant(input, name = 'UOL_TENANT') {
+    const raw = input.trim();
+    if (raw === '')
+        throw new ConfigError(`${name} is empty`);
+    if (raw.toLowerCase() === 'demo')
+        return { baseUrl: DEMO.baseUrl, isDemo: true };
+    let host;
+    if (/^[a-z]+:\/\//i.test(raw)) {
+        let url;
+        try {
+            url = new URL(raw);
+        }
+        catch {
+            throw new ConfigError(`${name} is not a valid URL: ${raw}`);
+        }
+        if (url.protocol !== 'https:')
+            throw new ConfigError(`${name} must use https: ${raw}`);
+        host = url.hostname.toLowerCase();
+    }
+    else {
+        const prefix = raw.toLowerCase().replace(/\.uol\.cz$/, '');
+        if (!/^[a-z0-9-]+(\.[a-z0-9-]+)*$/.test(prefix)) {
+            throw new ConfigError(`${name} has unexpected characters: ${raw}`);
+        }
+        host = prefix.includes('.') ? `${prefix}.uol.cz` : `${prefix}.ucetnictvi.uol.cz`;
+    }
+    if (!host.endsWith('.uol.cz')) {
+        throw new ConfigError(`${name} must point to a *.uol.cz host, got ${host}`);
+    }
+    const baseUrl = `https://${host}/api`;
+    return { baseUrl, isDemo: baseUrl === DEMO.baseUrl };
+}
+function defaultDownloadDir() {
+    const downloads = join(homedir(), 'Downloads');
+    return existsSync(downloads) ? join(downloads, 'uol-mcp') : join(tmpdir(), 'uol-mcp');
+}
+/**
+ * Trimmed value, or undefined when blank. Hosts that template the env (MCPB's
+ * `${user_config.email}`) may pass the placeholder through when the user
+ * leaves an optional field empty, so an unexpanded placeholder counts as blank.
+ */
+function value(raw) {
+    const v = raw?.trim();
+    return v && !/^\$\{[^}]*\}$/.test(v) ? v : undefined;
+}
+export function loadConfig(env = process.env) {
+    const { toolsets, unknown } = parseToolsets(value(env.UOL_TOOLSETS));
+    const warnings = unknown.length > 0 ? [`ignoring unknown UOL_TOOLSETS entries: ${unknown.join(', ')} (known: ${TOOLSETS.join(', ')}, all)`] : [];
+    const rawAccess = value(env.UOL_ACCESS)?.toLowerCase() ?? 'read';
+    const access = ACCESS_LEVELS.includes(rawAccess) ? rawAccess : 'read';
+    if (access !== rawAccess)
+        warnings.push(`unknown UOL_ACCESS "${rawAccess}", using read (known: ${ACCESS_LEVELS.join(', ')})`);
+    const uploadDirs = value(env.UOL_UPLOAD_DIRS)
+        ?.split(delimiter)
+        .map((d) => d.trim())
+        .filter(Boolean);
+    const config = {
+        toolsets,
+        access,
+        uploadDirs: uploadDirs && uploadDirs.length > 0 ? uploadDirs : defaultUploadDirs(),
+        auditLog: value(env.UOL_AUDIT_LOG),
+        warnings,
+        downloadDir: value(env.UOL_DOWNLOAD_DIR) ?? defaultDownloadDir(),
+        requestTimeoutMs: Number(env.UOL_TIMEOUT_MS) > 0 ? Number(env.UOL_TIMEOUT_MS) : 30_000,
+        debug: env.UOL_DEBUG === '1' || env.UOL_DEBUG === 'true',
+    };
+    const tenant = value(env.UOL_TENANT);
+    const email = value(env.UOL_EMAIL);
+    const token = value(env.UOL_TOKEN);
+    const profilesFile = value(env.UOL_PROFILES_FILE);
+    const accountList = value(env.UOL_ACCOUNTS);
+    try {
+        if (profilesFile || accountList) {
+            if (profilesFile && accountList)
+                throw new ConfigError('Set either UOL_ACCOUNTS or UOL_PROFILES_FILE, not both');
+            const source = accountList ? 'UOL_ACCOUNTS' : 'UOL_PROFILES_FILE';
+            if (tenant || email || token)
+                warnings.push(`${source} is set; ignoring UOL_TENANT / UOL_EMAIL / UOL_TOKEN`);
+            const profiles = accountList ? accountsFromEnv(accountList, env) : loadProfiles(profilesFile, env, warnings);
+            config.accounts = profiles.accounts;
+            config.defaultAccount = profiles.defaultAccount;
+            config.credentials = profiles.accounts.find((a) => a.name === profiles.defaultAccount).credentials;
+            return config;
+        }
+        if (!tenant && !email && !token)
+            return config;
+        config.credentials = credentialsFor(tenant, email, token, 'UOL_TENANT', 'UOL_EMAIL and UOL_TOKEN');
+    }
+    catch (error) {
+        if (!(error instanceof ConfigError))
+            throw error;
+        config.configError = error.message;
+    }
+    return config;
+}
+function credentialsFor(tenant, email, token, tenantName, pairName) {
+    if (!tenant)
+        throw new ConfigError(`${tenantName} is missing`);
+    const { baseUrl, isDemo } = resolveTenant(tenant, tenantName);
+    if (isDemo && !email && !token)
+        return { baseUrl, email: DEMO.email, token: DEMO.token, isDemo };
+    if (!email || !token)
+        throw new ConfigError(`${pairName} must both be set`);
+    return { baseUrl, email, token, isDemo };
+}
+const ACCOUNT_NAME = /^[a-z0-9][a-z0-9_-]{0,39}$/;
+/**
+ * Several tenants straight from the environment — for hosts whose config is
+ * an env block (Claude Desktop), and so `op run` can resolve each token from
+ * an `op://` reference:
+ *
+ * ```
+ * UOL_ACCOUNTS=firma,novak          (first one is the default, or UOL_DEFAULT_ACCOUNT)
+ * UOL_ACCOUNT_FIRMA_TENANT=firma
+ * UOL_ACCOUNT_FIRMA_EMAIL=ja@firma.cz
+ * UOL_ACCOUNT_FIRMA_TOKEN=op://…
+ * UOL_ACCOUNT_FIRMA_LABEL=Firma s.r.o.   (optional)
+ * ```
+ *
+ * The variable prefix is the account name upper-cased, with `-` as `_`.
+ */
+export function accountsFromEnv(list, env) {
+    const names = list
+        .split(',')
+        .map((n) => n.trim().toLowerCase())
+        .filter(Boolean);
+    if (names.length === 0)
+        throw new ConfigError('UOL_ACCOUNTS lists no account');
+    const accounts = names.map((name) => {
+        if (!ACCOUNT_NAME.test(name)) {
+            throw new ConfigError(`UOL_ACCOUNTS: account name "${name}" must be lowercase letters, digits, - or _`);
+        }
+        const prefix = `UOL_ACCOUNT_${name.toUpperCase().replace(/-/g, '_')}_`;
+        const credentials = credentialsFor(value(env[`${prefix}TENANT`]), value(env[`${prefix}EMAIL`]), value(env[`${prefix}TOKEN`]), `${prefix}TENANT`, `${prefix}EMAIL and ${prefix}TOKEN`);
+        return { name, label: value(env[`${prefix}LABEL`]), credentials };
+    });
+    const defaultAccount = value(env.UOL_DEFAULT_ACCOUNT)?.toLowerCase() ?? names[0];
+    if (!names.includes(defaultAccount)) {
+        throw new ConfigError(`UOL_DEFAULT_ACCOUNT "${defaultAccount}" is not listed in UOL_ACCOUNTS`);
+    }
+    return { accounts, defaultAccount };
+}
+/**
+ * Reads UOL_PROFILES_FILE — several tenants for accountants:
+ *
+ * ```json
+ * { "default": "firma",
+ *   "accounts": {
+ *     "firma":  { "tenant": "firma", "email": "ja@firma.cz", "token_env": "UOL_TOKEN_FIRMA" },
+ *     "novak":  { "tenant": "novak", "email": "ja@firma.cz", "token": "…", "label": "Novák s.r.o." },
+ *     "demo":   { "tenant": "demo" } } }
+ * ```
+ *
+ * `token_env` names an environment variable, so tokens don't have to live in
+ * the file. A file with inline tokens that others can read is reported.
+ */
+export function loadProfiles(path, env, warnings) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new ConfigError(`UOL_PROFILES_FILE ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const root = (parsed ?? {});
+    const entries = Object.entries(root.accounts ?? {});
+    if (entries.length === 0)
+        throw new ConfigError(`UOL_PROFILES_FILE ${path} has no "accounts"`);
+    let inlineTokens = false;
+    const accounts = entries.map(([name, raw]) => {
+        if (!ACCOUNT_NAME.test(name)) {
+            throw new ConfigError(`UOL_PROFILES_FILE: account name "${name}" must be lowercase letters, digits, - or _`);
+        }
+        const text = (key) => (typeof raw[key] === 'string' ? value(raw[key]) : undefined);
+        const tokenEnv = text('token_env');
+        if (text('token'))
+            inlineTokens = true;
+        const token = text('token') ?? (tokenEnv ? value(env[tokenEnv]) : undefined);
+        if (tokenEnv && !token)
+            throw new ConfigError(`UOL_PROFILES_FILE: account "${name}" reads its token from ${tokenEnv}, which is not set`);
+        const credentials = credentialsFor(text('tenant'), text('email'), token, `account "${name}": tenant`, `account "${name}": email and token`);
+        return { name, label: text('label'), credentials };
+    });
+    const defaultAccount = typeof root.default === 'string' ? root.default : accounts[0].name;
+    if (!accounts.some((a) => a.name === defaultAccount)) {
+        throw new ConfigError(`UOL_PROFILES_FILE: default account "${defaultAccount}" is not among the accounts`);
+    }
+    if (inlineTokens && process.platform !== 'win32' && (statSync(path).mode & 0o077) !== 0) {
+        warnings.push(`${path} contains API tokens and is readable by other users; run chmod 600 on it or use token_env`);
+    }
+    return { accounts, defaultAccount };
+}
+export const SETUP_HINT = 'Set UOL_TENANT (e.g. "firma" for https://firma.ucetnictvi.uol.cz, or "demo"), ' +
+    'UOL_EMAIL and UOL_TOKEN, or UOL_ACCOUNTS with UOL_ACCOUNT_<NAME>_TENANT / _EMAIL / _TOKEN ' +
+    'for several companies (create the token on your tenant at /api_tokens). ' +
+    'The UOL user needs the "REST API" permission.';
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,8BAA8B;IACvC,KAAK,EAAE,4BAA4B;IACnC,KAAK,EAAE,wBAAwB;CACvB,CAAC;AAUX,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;AAExF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAEzE,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AA0ChE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,aAAa,CAAC,GAAuB;IACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpF,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAE,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAY,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,IAAI,GAAG,YAAY;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEjF,IAAI,IAAY,CAAC;IACjB,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,wBAAwB,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACvF,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,+BAA+B,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,oBAAoB,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,uCAAuC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,GAAuB;IACpC,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7D,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClI,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,MAAM,CAAC;IACjE,MAAM,MAAM,GAAI,aAAmC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,SAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;IACzG,IAAI,MAAM,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,SAAS,yBAAyB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9H,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,EAAE,KAAK,CAAC,SAAS,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAc;QACxB,QAAQ;QACR,MAAM;QACN,UAAU,EAAE,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE;QAClF,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;QAClC,QAAQ;QACR,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,kBAAkB,EAAE;QAChE,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM;QACtF,KAAK,EAAE,GAAG,CAAC,SAAS,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM;KACzD,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,YAAY,IAAI,WAAW;gBAAE,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;YACjH,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAClE,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,sDAAsD,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9G,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACpC,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;YAChD,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,cAAc,CAAE,CAAC,WAAW,CAAC;YACpG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAC/C,MAAM,CAAC,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,MAA0B,EAC1B,KAAyB,EACzB,KAAyB,EACzB,UAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,UAAU,aAAa,CAAC,CAAC;IAC/D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACjG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,QAAQ,mBAAmB,CAAC,CAAC;IAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAsB;IAClE,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,+BAA+B,IAAI,6CAA6C,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;QACvE,MAAM,WAAW,GAAG,cAAc,CAChC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,EAC7B,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,EAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,EAC5B,GAAG,MAAM,QAAQ,EACjB,GAAG,MAAM,aAAa,MAAM,OAAO,CACpC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CAAC,wBAAwB,cAAc,iCAAiC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,GAAsB,EACtB,QAAkB;IAElB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,qBAAqB,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAA8E,CAAC;IACzG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,IAAI,oBAAoB,CAAC,CAAC;IAE/F,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,oCAAoC,IAAI,6CAA6C,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC;YAAE,YAAY,GAAG,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,QAAQ,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,WAAW,CAAC,+BAA+B,IAAI,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC;QACzI,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,IAAI,WAAW,EAAE,YAAY,IAAI,oBAAoB,CAAC,CAAC;QAC5I,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,WAAW,CAAC,uCAAuC,cAAc,6BAA6B,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,YAAY,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,2FAA2F,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GACrB,gFAAgF;IAChF,4FAA4F;IAC5F,0EAA0E;IAC1E,+CAA+C,CAAC"}