wicked-crew 0.7.39 → 0.7.45

package/dist/mcp/registry.js

@@ -0,0 +1,509 @@
+/**
+ * The MCP tools registry (DES-MCP-TOOLS-001 §5, §8; slice S2): register upstream MCP servers,
+ * keep their tool lists honest, and hold their secrets out of every response.
+ *
+ * - **Preview, then save.** `preview` probes the server and answers its tools with their classes
+ *   and a `previewHash` over the exact config and tool schemas it saw. `save` takes ONLY that hash
+ *   and registers what the preview showed. A save without a hash, or with one this daemon did not
+ *   issue (or issued more than {@link PREVIEW_TTL_MS} ago), is refused, so nothing is registered
+ *   that the operator did not see.
+ * - **Tool diff.** `test` probes a registered server again and records the difference. A tool
+ *   whose schema hash changed, and a tool the server added, is `unregistered` (D-5 denies it)
+ *   until it is previewed and saved again. A tool the server dropped is `gone`: kept, never
+ *   deleted, so old call records still resolve. Health turns `failing` after 3 consecutive
+ *   failed probes.
+ * - **Secrets.** Only a reference is stored. A value is resolved just for the probe and scrubbed
+ *   from its result (`probe.ts`).
+ */
+import { canonicalJson, deriveToolClass, effectiveToolClass, mcpSubject, parseMcpSubject, sha256Hex, toolSchemaHash } from './classify.js';
+import { KEYCHAIN_SERVICE, keychainRef, parseSecretRef, resolveSecret, secretIsSet } from './secrets.js';
+/** How long a preview can be saved. */
+export const PREVIEW_TTL_MS = 15 * 60 * 1000;
+/** At most this many previews are held; the oldest is dropped first. */
+const PREVIEW_CACHE_MAX = 64;
+/** Consecutive failed probes before a server's health reads `failing`. */
+export const HEALTH_FAILING_AFTER = 3;
+/** A refusal the routes map to a status code. */
+export class McpRegistryError extends Error {
+    status;
+    code;
+    constructor(
+    // 500: the registry and the OS secret store disagree and crew could not reconcile them
+    // (crew#719, `secret_orphaned`) — the message names what was left behind.
+    status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+export class McpRegistry {
+    deps;
+    previews = new Map();
+    now;
+    env;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? Date.now;
+        this.env = deps.env ?? process.env;
+    }
+    get secretStoreAvailable() {
+        return this.deps.secrets.available;
+    }
+    async list() {
+        const file = await this.deps.store.read();
+        const servers = await Promise.all(file.servers.map((s) => this.view(s)));
+        const discovered = this.deps.discover(new Set(file.servers.map((s) => s.name)));
+        return { servers, discovered };
+    }
+    async get(name) {
+        const file = await this.deps.store.read();
+        return this.view(this.find(file.servers, name));
+    }
+    /**
+     * Probe `config` and hold exactly what it showed, for `save` (crew#719: with `stagedSecret`, the
+     * secret this server's own keychain reference will hold — probed with now, written only when the
+     * save commits, so the OS store and the registry row land together or not at all).
+     */
+    async preview(config, stagedSecret = null) {
+        if (stagedSecret !== null) {
+            if (!this.deps.secrets.available) {
+                throw new McpRegistryError(501, 'secret_store_unavailable', 'this platform has no OS secret store; reference a daemon env variable instead (auth.ref "env:<NAME>")');
+            }
+            if (config.auth === null || config.auth.ref !== keychainRef(config.name)) {
+                throw new McpRegistryError(400, 'secret_not_staged_here', `a staged secret is stored as this server's own keychain entry, so auth.ref must be ${keychainRef(config.name)}`);
+            }
+            // The reference is answered back and audited, so a value it contains would be echoed there.
+            if (config.auth.ref.includes(stagedSecret)) {
+                throw new McpRegistryError(400, 'secret_in_ref', 'the secret must not appear in its own reference; choose a different value');
+            }
+        }
+        const result = await this.probe(config, stagedSecret);
+        if ('missingSecret' in result)
+            throw new McpRegistryError(409, 'secret_missing', result.error);
+        if (!result.ok) {
+            const what = config.kind === 'rest' ? 'the OpenAPI document could not be imported' : 'the server did not answer tools/list';
+            throw new McpRegistryError(502, 'probe_failed', `${what}: ${result.error}`);
+        }
+        const tools = result.tools.map((t) => ({ ...t, schemaHash: toolSchemaHash(t) }));
+        const previewHash = sha256Hex(canonicalJson({ config, tools: tools.map((t) => [t.name, t.schemaHash]) }));
+        const expiresAt = this.now() + PREVIEW_TTL_MS;
+        this.hold(previewHash, { config, tools, expiresAt, secret: stagedSecret });
+        const existing = (await this.deps.store.read()).servers.find((s) => s.name === config.name);
+        return {
+            previewHash,
+            expiresAt: new Date(expiresAt).toISOString(),
+            server: configView(config),
+            serverInfo: result.serverInfo,
+            tools: tools.map((t) => ({
+                name: t.name,
+                subject: mcpSubject(config.name, t.name),
+                description: t.description,
+                annotations: t.annotations,
+                inputSchema: t.inputSchema,
+                class: deriveToolClass(t.annotations),
+                schemaHash: t.schemaHash,
+                ...(config.kind === 'rest' ? { rest: t.rest ?? null } : {}),
+            })),
+            diff: existing === undefined ? null : diffTools(existing.tools, tools),
+            ...(result.skipped !== undefined && result.skipped.length > 0 ? { skipped: result.skipped } : {}),
+        };
+    }
+    /**
+     * Register exactly what a preview showed. Saving over an existing name re-registers it: every
+     * tool of the preview becomes `registered`, a tool it no longer lists becomes `gone`, a tool's
+     * `enabled` switch survives, and a class override survives only while the schema is unchanged.
+     */
+    async save(previewHash) {
+        if (previewHash === undefined) {
+            throw new McpRegistryError(409, 'preview_required', 'saving a server needs the previewHash of a preview of it: POST /mcp/servers/preview first');
+        }
+        const held = this.previews.get(previewHash);
+        if (held === undefined || held.expiresAt <= this.now()) {
+            this.previews.delete(previewHash);
+            throw new McpRegistryError(409, 'preview_stale', 'that previewHash is unknown or expired: preview the server again, then save');
+        }
+        this.previews.delete(previewHash);
+        const stamp = new Date(this.now()).toISOString();
+        // (crew#719) The staged secret and the registry row commit TOGETHER. Studio used to write the
+        // keychain itself and then save, so a failure between the two left a keychain entry with no
+        // server — invisible, because nothing can enumerate the entries of a keychain service — or a
+        // server whose secret never landed. The write happens here, inside the save, and a save that
+        // then fails puts the entry back exactly as it was; the only residue left is one this call
+        // NAMES.
+        //
+        // The PRIOR value is read first (review of PR #724, HIGH). A re-key of a registered server
+        // whose registry write then failed used to leave the NEW secret behind under an unchanged row:
+        // the credential its running calls use had silently changed, which is a worse outcome than the
+        // orphan this was written to prevent. `null` = no prior value, and then the rollback deletes.
+        const prior = held.secret === null ? null : await this.deps.secrets.get(held.config.name);
+        if (held.secret !== null)
+            await this.deps.secrets.set(held.config.name, held.secret);
+        const saved = await this.restoreSecretOnFailure(held.config.name, held.secret !== null, prior, () => this.deps.store.mutate((file) => {
+            const prior = file.servers.find((s) => s.name === held.config.name);
+            const tools = held.tools.map((t) => {
+                const was = prior?.tools.find((p) => p.name === t.name);
+                return {
+                    name: t.name,
+                    description: t.description,
+                    inputSchema: t.inputSchema,
+                    outputSchema: t.outputSchema,
+                    annotations: t.annotations,
+                    classOverride: was !== undefined && was.schemaHash === t.schemaHash ? was.classOverride : null,
+                    enabled: was?.enabled ?? true,
+                    schemaHash: t.schemaHash,
+                    observedSchemaHash: t.schemaHash,
+                    present: true,
+                    ...(t.rest != null ? { rest: t.rest } : {}),
+                };
+            });
+            for (const old of prior?.tools ?? []) {
+                if (!tools.some((t) => t.name === old.name))
+                    tools.push({ ...old, present: false });
+            }
+            const record = {
+                ...held.config,
+                enabled: prior?.enabled ?? true,
+                health: { state: 'ok', consecutiveFailures: 0, checkedAt: stamp, lastError: null },
+                registeredAt: prior?.registeredAt ?? stamp,
+                updatedAt: stamp,
+                tools,
+            };
+            file.servers = [...file.servers.filter((s) => s.name !== record.name), record];
+            return record;
+        }));
+        return this.view(saved);
+    }
+    /**
+     * Run `commit`; if it throws and this save had written the OS secret store, put the entry back
+     * exactly as it was — deleted when there was no `prior` value, restored to `prior` when there
+     * was (crew#719, review of PR #724). Either way the registry row and the credential it
+     * references end up as they were before the save.
+     *
+     * A rollback that ALSO fails is reported rather than swallowed: the operator is told what was
+     * left behind and under which account, because nothing else can find a keychain entry for them.
+     */
+    async restoreSecretOnFailure(name, wrote, prior, commit) {
+        try {
+            return await commit();
+        }
+        catch (err) {
+            if (!wrote)
+                throw err;
+            try {
+                if (prior === null)
+                    await this.deps.secrets.delete(name);
+                else
+                    await this.deps.secrets.set(name, prior);
+            }
+            catch (rollback) {
+                const why = err instanceof Error ? err.message : String(err);
+                const also = rollback instanceof Error ? rollback.message : String(rollback);
+                const left = prior === null
+                    ? 'its secret could not be taken back out'
+                    : 'the secret it replaced could not be put back, so the entry now holds the value this save staged';
+                throw new McpRegistryError(500, 'secret_orphaned', `${name} was not registered (${why}) and ${left} (${also}); fix the "${KEYCHAIN_SERVICE}" keychain entry for account "${name}" by hand`);
+            }
+            throw err;
+        }
+    }
+    /** What a held preview would register: its server name and each tool's schema hash (S6). */
+    peekPreview(previewHash) {
+        const held = this.previews.get(previewHash);
+        if (held === undefined || held.expiresAt <= this.now())
+            return null;
+        return { name: held.config.name, tools: held.tools.map((t) => ({ name: t.name, schemaHash: t.schemaHash })) };
+    }
+    async setServerEnabled(name, enabled) {
+        const rec = await this.deps.store.mutate((file) => {
+            const s = this.find(file.servers, name);
+            s.enabled = enabled;
+            s.updatedAt = new Date(this.now()).toISOString();
+            return s;
+        });
+        return this.view(rec);
+    }
+    /** Remove a server, and the keychain secret it owns (`keychain:wicked-mcp/<name>`). */
+    async remove(name) {
+        const removed = await this.deps.store.mutate((file) => {
+            const s = this.find(file.servers, name);
+            file.servers = file.servers.filter((x) => x.name !== name);
+            return s;
+        });
+        if (removed.auth?.ref === keychainRef(name) && this.deps.secrets.available) {
+            try {
+                await this.deps.secrets.delete(name);
+            }
+            catch (err) {
+                // (crew#719) The row is already gone, so the secret is now unreachable by any route. Say
+                // so — the alternative is a silent orphan in the operator's keychain.
+                const why = err instanceof Error ? err.message : String(err);
+                throw new McpRegistryError(500, 'secret_orphaned', `${name} was removed but its secret could not be deleted (${why}); remove the "${KEYCHAIN_SERVICE}" keychain entry for account "${name}" by hand`);
+            }
+        }
+    }
+    async patchTool(subject, patch) {
+        const parts = parseMcpSubject(subject);
+        if (parts === null)
+            throw new McpRegistryError(404, 'unknown_tool', `no tool ${subject}`);
+        const stamp = new Date(this.now()).toISOString();
+        const { server, tool } = await this.deps.store.mutate((file) => {
+            const s = this.find(file.servers, parts.server);
+            const t = s.tools.find((x) => x.name === parts.tool);
+            if (t === undefined)
+                throw new McpRegistryError(404, 'unknown_tool', `no tool ${subject}`);
+            if (patch.enabled !== undefined)
+                t.enabled = patch.enabled;
+            if (patch.classOverride !== undefined)
+                t.classOverride = patch.classOverride;
+            s.updatedAt = stamp;
+            return { server: s, tool: t };
+        });
+        return toolView(server.name, tool);
+    }
+    /** Probe a registered server again: record its health and its tool diff. */
+    async test(name) {
+        const current = this.find((await this.deps.store.read()).servers, name);
+        const config = configOf(current);
+        const result = await this.probe(config);
+        const stamp = new Date(this.now()).toISOString();
+        let diff = null;
+        const rec = await this.deps.store.mutate((file) => {
+            const s = this.find(file.servers, name);
+            // A save with a different config landed while the probe ran: the result describes a server
+            // that is no longer registered, so it is not applied to the new one.
+            if (canonicalJson(configOf(s)) !== canonicalJson(config)) {
+                throw new McpRegistryError(409, 'server_changed', `${name} was saved again while it was being tested; test it again`);
+            }
+            if (!result.ok) {
+                const failures = s.health.consecutiveFailures + 1;
+                const state = failures >= HEALTH_FAILING_AFTER ? 'failing' : s.health.state;
+                s.health = { state, consecutiveFailures: failures, checkedAt: stamp, lastError: result.error };
+                return s;
+            }
+            const probed = result.tools.map((t) => ({ ...t, schemaHash: toolSchemaHash(t) }));
+            diff = diffTools(s.tools, probed);
+            for (const t of s.tools) {
+                const now = probed.find((p) => p.name === t.name);
+                t.present = now !== undefined;
+                if (now !== undefined)
+                    t.observedSchemaHash = now.schemaHash;
+                // The mapping a REST call is made with stays the SAVED one: a changed mapping is a changed
+                // schema hash, so the tool is unregistered (D-5) until it is previewed and saved again.
+            }
+            for (const p of probed) {
+                if (s.tools.some((t) => t.name === p.name))
+                    continue;
+                s.tools.push({
+                    name: p.name,
+                    description: p.description,
+                    inputSchema: p.inputSchema,
+                    outputSchema: p.outputSchema,
+                    annotations: p.annotations,
+                    classOverride: null,
+                    enabled: true,
+                    schemaHash: null,
+                    observedSchemaHash: p.schemaHash,
+                    present: true,
+                    ...(p.rest != null ? { rest: p.rest } : {}),
+                });
+            }
+            s.health = { state: 'ok', consecutiveFailures: 0, checkedAt: stamp, lastError: null };
+            return s;
+        });
+        return { ok: result.ok, error: result.ok ? null : result.error, diff, server: await this.view(rec) };
+    }
+    /** Write a server's secret to the OS store; answers the reference to put in its `auth.ref`. */
+    async setSecret(name, value) {
+        if (!this.deps.secrets.available) {
+            throw new McpRegistryError(501, 'secret_store_unavailable', 'this platform has no OS secret store; reference a daemon env variable instead (auth.ref "env:<NAME>")');
+        }
+        const ref = keychainRef(name);
+        // The route answers and audits the reference, so a value it contains would be echoed there.
+        if (ref.includes(value))
+            throw new McpRegistryError(400, 'secret_in_ref', 'the secret must not appear in its own reference; choose a different value');
+        // (crew#719) RE-KEY ONLY. A secret written for a name no registered server references is an
+        // orphan nothing can find again — a keychain service's entries cannot be enumerated — and it
+        // was the first half of the non-atomic add: secret, then save, with a window between them.
+        // A NEW server's secret is staged with its preview and committed by `save`.
+        const server = this.find((await this.deps.store.read()).servers, name);
+        if (server.auth?.ref !== ref) {
+            throw new McpRegistryError(400, 'secret_not_referenced', `${name} does not reference ${ref} (auth.ref is ${server.auth?.ref ?? 'unset'}), so a secret stored there would be unreachable; stage it with the preview instead`);
+        }
+        await this.deps.secrets.set(name, value);
+        return ref;
+    }
+    /**
+     * The broker's resolution of one subject (§6 step 2). `null` = no server of that name. A server
+     * that is disabled, a tool that is disabled, `gone`, never saved, or whose schema changed since it
+     * was saved reads `registered: false`, which the engine denies (D-5).
+     */
+    async resolveCall(server, tool) {
+        const s = (await this.deps.store.read()).servers.find((x) => x.name === server);
+        if (s === undefined)
+            return null;
+        const t = s.tools.find((x) => x.name === tool);
+        return {
+            config: configOf(s),
+            rest: t?.rest ?? null,
+            annotations: t?.annotations ?? null,
+            classOverride: t?.classOverride ?? null,
+            registered: s.enabled && t !== undefined && t.enabled && toolStatus(t) === 'registered',
+        };
+    }
+    /**
+     * Every tool a call could reach right now (slice S4, the shim's `list`): enabled servers, and
+     * their enabled tools whose saved schema is the one last seen. Anything else is D-5 and would be
+     * refused by the broker, so it is never offered.
+     */
+    async callableTools() {
+        const out = [];
+        for (const s of (await this.deps.store.read()).servers) {
+            if (!s.enabled)
+                continue;
+            for (const t of s.tools) {
+                if (!t.enabled || toolStatus(t) !== 'registered')
+                    continue;
+                out.push({
+                    server: s.name,
+                    tool: t.name,
+                    kind: s.kind,
+                    annotations: t.annotations,
+                    classOverride: t.classOverride,
+                    description: t.description,
+                    inputSchema: t.inputSchema,
+                });
+            }
+        }
+        return out;
+    }
+    /**
+     * The secret a call to `config` is made with, resolved at the moment of the call and nowhere
+     * else. `missing` = the server names a secret that resolves to nothing: the call is not made
+     * unauthenticated.
+     */
+    async callSecret(config) {
+        if (config.auth === null)
+            return { secret: null, missing: false };
+        const secret = await resolveSecret(config.auth.ref, this.deps.secrets, this.env);
+        return { secret, missing: secret === null };
+    }
+    // ── internals ──────────────────────────────────────────────────────────────────────────────
+    find(servers, name) {
+        const s = servers.find((x) => x.name === name);
+        if (s === undefined)
+            throw new McpRegistryError(404, 'unknown_server', `no MCP server named ${name}`);
+        return s;
+    }
+    hold(hash, preview) {
+        const now = this.now();
+        for (const [k, v] of this.previews)
+            if (v.expiresAt <= now)
+                this.previews.delete(k);
+        this.previews.delete(hash);
+        this.previews.set(hash, preview);
+        while (this.previews.size > PREVIEW_CACHE_MAX)
+            this.previews.delete(this.previews.keys().next().value);
+    }
+    /**
+     * Probe with the server's secret. A server whose `auth` names a secret that resolves to nothing
+     * is NOT probed unauthenticated (that would register what an anonymous caller sees): it fails
+     * without connecting.
+     */
+    async probe(config, staged = null) {
+        if (config.auth === null)
+            return this.deps.probe(config, null);
+        // (crew#719) A staged secret is probed with instead of being written first. The caller has
+        // already checked it belongs to THIS server's keychain reference.
+        const secret = staged ?? (await resolveSecret(config.auth.ref, this.deps.secrets, this.env));
+        if (secret === null) {
+            return { ok: false, error: `auth.ref ${config.auth.ref} resolves to no secret: set it, then try again`, missingSecret: true };
+        }
+        return this.deps.probe(config, secret);
+    }
+    async authState(auth) {
+        if (auth === null)
+            return 'none';
+        if (parseSecretRef(auth.ref) === null)
+            return 'missing';
+        return (await secretIsSet(auth.ref, this.deps.secrets, this.env)) ? 'set' : 'missing';
+    }
+    async view(s) {
+        const tools = s.tools.map((t) => toolView(s.name, t));
+        const live = tools.filter((t) => t.status !== 'gone');
+        return {
+            ...configView(configOf(s)),
+            authState: await this.authState(s.auth),
+            enabled: s.enabled,
+            health: s.health,
+            registeredAt: s.registeredAt,
+            updatedAt: s.updatedAt,
+            tools,
+            counts: {
+                total: live.length,
+                enabled: live.filter((t) => t.enabled).length,
+                registered: live.filter((t) => t.status === 'registered').length,
+                read: live.filter((t) => t.class === 'read').length,
+                write: live.filter((t) => t.class === 'write').length,
+                destructive: live.filter((t) => t.class === 'destructive').length,
+            },
+        };
+    }
+}
+function configOf(s) {
+    const base = { name: s.name, kind: s.kind, command: s.command, args: s.args, url: s.url, auth: s.auth };
+    if (s.kind !== 'rest')
+        return base;
+    return { ...base, openapiUrl: s.openapiUrl ?? null, openapi: s.openapi ?? null, operations: s.operations ?? null };
+}
+/** What a response shows of a config. A pasted OpenAPI document is not echoed back. */
+function configView(c) {
+    const view = { name: c.name, kind: c.kind, command: c.command, args: c.args, url: c.url, auth: c.auth };
+    if (c.kind === 'rest') {
+        view.openapiUrl = c.openapiUrl ?? null;
+        view.operations = c.operations ?? null;
+    }
+    return view;
+}
+export function toolStatus(t) {
+    if (!t.present)
+        return 'gone';
+    return t.schemaHash !== null && t.schemaHash === t.observedSchemaHash ? 'registered' : 'unregistered';
+}
+function toolView(server, t) {
+    const derivedClass = deriveToolClass(t.annotations);
+    return {
+        name: t.name,
+        ...(t.rest != null ? { rest: t.rest } : {}),
+        subject: mcpSubject(server, t.name),
+        description: t.description,
+        annotations: t.annotations,
+        inputSchema: t.inputSchema,
+        derivedClass,
+        classOverride: t.classOverride,
+        class: effectiveToolClass(derivedClass, t.classOverride),
+        enabled: t.enabled,
+        status: toolStatus(t),
+        schemaHash: t.schemaHash,
+        observedSchemaHash: t.observedSchemaHash,
+    };
+}
+/** The difference between the registered tools and a probe's (by name, then schema hash). */
+export function diffTools(registered, probed) {
+    const known = registered.filter((t) => t.present);
+    const diff = { added: [], removed: [], changed: [], unchanged: [] };
+    for (const p of probed) {
+        const was = known.find((t) => t.name === p.name);
+        // A tool that was never registered (added after the last save) is still `added`.
+        if (was === undefined || was.schemaHash === null)
+            diff.added.push(p.name);
+        else if (was.schemaHash === p.schemaHash)
+            diff.unchanged.push(p.name);
+        else
+            diff.changed.push(p.name);
+    }
+    for (const t of known)
+        if (!probed.some((p) => p.name === t.name))
+            diff.removed.push(t.name);
+    return diff;
+}
+//# sourceMappingURL=registry.js.map

package/dist/mcp/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/mcp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAkBH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG3I,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAoB,MAAM,cAAc,CAAC;AAE3H,uCAAuC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,iDAAiD;AACjD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAI9B;IACA;IAJX;IACE,uFAAuF;IACvF,0EAA0E;IACjE,MAA+C,EAC/C,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAyC;QAC/C,SAAI,GAAJ,IAAI,CAAQ;IAIvB,CAAC;CACF;AA+CD,MAAM,OAAO,WAAW;IAKO;IAJZ,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,GAAG,CAAe;IAClB,GAAG,CAAoB;IAExC,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAyB,EAAE,eAA8B,IAAI;QACzE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,0BAA0B,EAAE,uGAAuG,CAAC,CAAC;YACvK,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,wBAAwB,EAAE,sFAAsF,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9K,CAAC;YACD,4FAA4F;YAC5F,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,2EAA2E,CAAC,CAAC;YAChI,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,eAAe,IAAI,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,sCAAsC,CAAC;YAC5H,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,SAAS,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5F,OAAO;YACL,WAAW;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC5C,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBACxC,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;gBACrC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;YACH,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,WAA+B;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,2FAA2F,CAAC,CAAC;QACnJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,6EAA6E,CAAC,CAAC;QAClI,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,SAAS;QACT,EAAE;QACF,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACnI,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpE,MAAM,KAAK,GAAoB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClD,MAAM,GAAG,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO;oBACL,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,aAAa,EAAE,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;oBAC9F,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;oBAC7B,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,kBAAkB,EAAE,CAAC,CAAC,UAAU;oBAChC,OAAO,EAAE,IAAI;oBACb,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,IAAI,CAAC,MAAM;gBACd,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;gBAC/B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE;gBAClF,YAAY,EAAE,KAAK,EAAE,YAAY,IAAI,KAAK;gBAC1C,SAAS,EAAE,KAAK;gBAChB,KAAK;aACN,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,sBAAsB,CAAI,IAAY,EAAE,KAAc,EAAE,KAAoB,EAAE,MAAwB;QAClH,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK;gBAAE,MAAM,GAAG,CAAC;YACtB,IAAI,CAAC;gBACH,IAAI,KAAK,KAAK,IAAI;oBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;oBACpD,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,IAAI,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC7E,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI;oBACzB,CAAC,CAAC,wCAAwC;oBAC1C,CAAC,CAAC,iGAAiG,CAAC;gBACtG,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,iBAAiB,EACjB,GAAG,IAAI,wBAAwB,GAAG,SAAS,IAAI,KAAK,IAAI,eAAe,gBAAgB,iCAAiC,IAAI,WAAW,CACxI,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,WAAW,CAAC,WAAmB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,OAAgB;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACpD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yFAAyF;gBACzF,sEAAsE;gBACtE,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,IAAI,qDAAqD,GAAG,kBAAkB,gBAAgB,iCAAiC,IAAI,WAAW,CAAC,CAAC;YACxM,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,KAAyF;QACxH,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;YAC3F,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC3D,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;gBAAE,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;YAC7E,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,IAAI,GAAuB,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,2FAA2F;YAC3F,qEAAqE;YACrE,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,IAAI,2DAA2D,CAAC,CAAC;YACxH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,QAAQ,IAAI,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5E,CAAC,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC/F,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC;gBAC9B,IAAI,GAAG,KAAK,SAAS;oBAAE,CAAC,CAAC,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC;gBAC7D,2FAA2F;gBAC3F,wFAAwF;YAC1F,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACrD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI;oBAChB,kBAAkB,EAAE,CAAC,CAAC,UAAU;oBAChC,OAAO,EAAE,IAAI;oBACb,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;YACD,CAAC,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACtF,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvG,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,KAAa;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,0BAA0B,EAAE,uGAAuG,CAAC,CAAC;QACvK,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,4FAA4F;QAC5F,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,2EAA2E,CAAC,CAAC;QACvJ,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,IAAI,uBAAuB,GAAG,iBAAiB,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,qFAAqF,CAAC,CAAC;QAC/N,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,IAAY;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC/C,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnB,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI;YACrB,WAAW,EAAE,CAAC,EAAE,WAAW,IAAI,IAAI;YACnC,aAAa,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI;YACvC,UAAU,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,YAAY;SACxF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,SAAS;YACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,YAAY;oBAAE,SAAS;gBAC3D,GAAG,CAAC,IAAI,CAAC;oBACP,MAAM,EAAE,CAAC,CAAC,IAAI;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,MAAyB;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,8FAA8F;IAEtF,IAAI,CAAC,OAA0B,EAAE,IAAY;QACnD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,OAAoB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,iBAAiB;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IACnH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,KAAK,CAAC,MAAyB,EAAE,SAAwB,IAAI;QACzE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/D,2FAA2F;QAC3F,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,MAAM,CAAC,IAAI,CAAC,GAAG,gDAAgD,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChI,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA0B;QAChD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,CAAkB;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACtD,OAAO;YACL,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC1B,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YACvC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,KAAK;YACL,MAAM,EAAE;gBACN,KAAK,EAAE,IAAI,CAAC,MAAM;gBAClB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;gBAC7C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,MAAM;gBAChE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM;gBACnD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,MAAM;gBACrD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,MAAM;aAClE;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAkB;IAClC,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3H,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;AACrH,CAAC;AAaD,uFAAuF;AACvF,SAAS,UAAU,CAAC,CAAoB;IACtC,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpH,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAuE;IAChG,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;AACxG,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,CAAgB;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACnC,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,KAAK,EAAE,kBAAkB,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,CAAC;QACxD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,SAAS,CAAC,UAAiF,EAAE,MAA2D;IACtK,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,iFAAiF;QACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACrE,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;;YACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp/rest.d.ts

@@ -0,0 +1,111 @@
+/**
+ * REST upstreams (DES-MCP-TOOLS-001 §2, §5, invariant I6; slice S5a): a plain HTTP API wrapped as
+ * brokered tools, one tool per chosen OpenAPI 3 operation.
+ *
+ * - **Import.** The OpenAPI document is fetched from `openapiUrl` (bounded in time and size; the
+ *   server's auth header rides along only when the document is on the API's own origin) or taken as
+ *   pasted. Local `$ref`s are resolved (a cycle becomes `{}`); an external `$ref` is not followed.
+ *   Each operation becomes a tool whose input schema is its path, query and header parameters and
+ *   its JSON body, and whose class comes from its method: `GET`/`HEAD`/`OPTIONS` read, `POST`
+ *   write, `PUT`/`PATCH`/`DELETE` destructive (the broker's classification, §4.2).
+ * - **Mapping, an allowlist.** A tool carries its {@link McpRestMapping}: which argument fills
+ *   which path variable, query parameter, header or body key. An argument no map names is DROPPED,
+ *   never sent; its name is disclosed in the result's `_meta["wicked/rest"].droppedArgs`.
+ * - **Host pin (I6).** Every request is built on the server's base URL and checked before it is
+ *   sent: its scheme, host and port must be the base URL's and its path must stay under the base
+ *   path. A request that would leave, and a redirect to another host, are refused with
+ *   {@link RestBoundaryError}, which the broker records as a `guard_error`. Redirects are never
+ *   followed. The auth header can't be set or overridden by an argument.
+ *
+ * Ideas only from ContextForge (`openapi_service.py`, `tool_service.py`); no code is copied.
+ */
+import type { McpRestMapping, McpToolAnnotations } from '../core/types.js';
+import type { UpstreamToolResult } from './invoke.js';
+import type { McpUpstreamConfig, ProbedTool, ProbeResult } from './probe.js';
+import { UpstreamCallError } from './upstream-error.js';
+export declare const REST_SPEC_TIMEOUT_MS = 10000;
+/** The largest OpenAPI document crew reads (fetched or pasted). */
+export declare const REST_SPEC_MAX_BYTES: number;
+/** The largest response body handed back; the rest is cut and disclosed as `truncated`. */
+export declare const REST_RESPONSE_MAX_BYTES: number;
+export declare const REST_DEFAULT_TIMEOUT_MS = 30000;
+type Method = McpRestMapping['method'];
+/** A request that would leave the API's pinned base URL (I6). Never retried; recorded as `guard_error`. */
+export declare class RestBoundaryError extends UpstreamCallError {
+    constructor(message: string);
+}
+/** A tool probed from an OpenAPI document: an MCP tool shape plus its request mapping. */
+export type RestProbedTool = ProbedTool & {
+    rest: McpRestMapping;
+};
+/** Parse a base URL: http(s), no credentials, no query or fragment. `null` = not acceptable. */
+export declare function parseBaseUrl(raw: string | null): URL | null;
+/**
+ * The request URL for `pathTemplate` filled with `values`, pinned to `base`: the same origin, and a
+ * path under the base path. Anything else is a {@link RestBoundaryError}.
+ */
+export declare function pinnedUrl(base: URL, pathTemplate: string, values: Record<string, string>): URL;
+/** Why `url` is outside `base` (another origin, or a path off the base path); `null` = inside. */
+export declare function boundaryEscape(base: URL, url: URL): string | null;
+type Json = Record<string, unknown>;
+/**
+ * `value` with every local `$ref` replaced by what it points to. A `$ref` already being resolved
+ * on the current path (a cycle), an unresolvable or external one, and anything deeper than
+ * {@link MAX_REF_DEPTH} become `{}` (any value): the schema is a hint to the caller, never a check.
+ */
+export declare function derefLocal(doc: Json, value: unknown, seen?: ReadonlyArray<string>, depth?: number): unknown;
+/** Parse an OpenAPI document's text: JSON, else YAML. */
+export declare function parseOpenApiText(text: string): Json;
+/** The class an HTTP method implies, as annotations (§4.2): the broker decides it, never the carrier. */
+export declare function annotationsForMethod(method: Method): McpToolAnnotations;
+export interface OpenApiImport {
+    serverInfo: {
+        name: string;
+        version: string;
+    } | null;
+    tools: RestProbedTool[];
+    /** Operations that could not be wrapped, with why (a non-JSON body, a name clash past 512 tools). */
+    skipped: string[];
+}
+/**
+ * Wrap an OpenAPI 3 document's operations as tools. `operations` (by `operationId` or tool name)
+ * picks which; a name that matches no operation is an error, so a typo never silently wraps less.
+ */
+export declare function importOpenApi(doc: Json, opts?: {
+    authHeader?: string | undefined;
+    operations?: ReadonlyArray<string> | null;
+    timeoutMs?: number;
+}): OpenApiImport;
+export type RestFetch = typeof fetch;
+/**
+ * The `rest` probe: read the OpenAPI document and wrap its operations. The auth header goes to the
+ * document's URL only when it is on the base URL's own origin. Every string returned has the
+ * secret scrubbed out.
+ *
+ * The document's URL is NOT pinned to the base URL, by design: it is the operator's own input at
+ * preview time (an API's spec often lives elsewhere, e.g. a docs host), not a worker's call, and it
+ * carries no secret off the API's origin. The host pin (I6) is on the tools' calls.
+ */
+export declare function probeRestServer(config: McpUpstreamConfig, secret: string | null, fetchImpl?: RestFetch): Promise<ProbeResult>;
+/**
+ * Build the one HTTP request a `rest` tool call makes, from the ALLOWLISTED arguments only, pinned
+ * to the base URL. Exported so the allowlist and the pin are testable without a network.
+ */
+export declare function buildRestRequest(config: McpUpstreamConfig, secret: string | null, mapping: McpRestMapping, args: Record<string, unknown>): {
+    url: URL;
+    init: {
+        method: string;
+        headers: Record<string, string>;
+        body?: string;
+    };
+    droppedArgs: string[];
+};
+/**
+ * Call one `rest` tool. Transport failures, 429 and 5xx are retryable {@link UpstreamCallError}s; a
+ * redirect is never followed (one to another host is a {@link RestBoundaryError}); any other
+ * status is handed back as the tool's own result (`isError` on 4xx). The result is RAW: the broker
+ * scrubs it.
+ */
+export declare function invokeRestTool(config: McpUpstreamConfig, secret: string | null, mapping: McpRestMapping, args: Record<string, unknown>, timeoutMs: number, fetchImpl?: RestFetch): Promise<UpstreamToolResult>;
+export {};
+//# sourceMappingURL=rest.d.ts.map