wicked-crew 0.7.40 → 0.7.46

package/dist/mcp/broker.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The MCP broker's call path (DES-MCP-TOOLS-001 §6; slice S3). A worker on any seat reaches an
+ * upstream MCP tool only through here (the garden shim, `wicked-garden run mcp call`, sends
+ * `POST /api/v1/mcp/call {token, subject, args}`), and every step below runs in order:
+ *
+ *  1-3. **Judge.** The subject is resolved in the registry (unknown, disabled, `gone` or changed
+ *       tools go to the engine as `registered: false`, D-5), then core's `evaluateMcpCall` verifies
+ *       the token, judges the call for the unit the token is bound to (D-1 phase role, policy,
+ *       first use, the run's mode) and records the claim. `deny` and `ask` never reach an upstream.
+ *  4.   **Budget.** At most {@link DEFAULT_MCP_CALL_BUDGET} invoked calls per unit attempt
+ *       (`WICKED_MCP_CALL_BUDGET` overrides it).
+ *  5.   **Breaker.** After {@link BREAKER_THRESHOLD} consecutive upstream failures a tool is refused
+ *       for {@link BREAKER_OPEN_MS}; then one call is let through, and one more failure reopens it.
+ *  6.   **Invoke** with a deadline. The upstream's secret is resolved here, and only here. A `rest`
+ *       tool (slice S5a, `rest.ts`) sends only its allowlisted arguments, and only to its pinned
+ *       base URL: a request that would leave it is refused unsent, recorded as `guard_error`
+ *       (`rest_host_escape`, I6).
+ *  7.   **Retry** READ tools only, at most {@link MAX_READ_RETRIES} times, and only on transport
+ *       errors, 429 and 5xx. A write or destructive tool is never retried: a second attempt could
+ *       apply the write twice.
+ *  8.   **Post.** The result is scrubbed (the exact secrets injected on this call, then credential
+ *       field names and value shapes, D-2), then core's `evaluateMcpOutput` judges it; a deny
+ *       withholds it. A crash anywhere here is `guard_error`: refused, fail closed.
+ *  9.   **Record** (D-3). Every judged call is written to `calls.ndjson`; a call whose record cannot
+ *       be written is refused and its result withheld. The record then rides `/ws`
+ *       (`mcpCallCompleted`) and the bus (`wicked.crew.mcp_call.completed`).
+ *
+ * A call that ran and then could not be recorded HAS happened upstream; refusing it withholds the
+ * result from the worker, it does not undo the side effect. The record is written after the call
+ * because the span it records (timing, status, bytes) only exists then.
+ */
+import type { McpCallBody, McpCallOutcome, McpCallRecord, McpCallResponse } from '../core/types.js';
+import type { McpEngineGate } from '../core/adapter.js';
+import type { McpCallRecordSink } from './call-records.js';
+import { type Invoker } from './invoke.js';
+import type { McpRegistry } from './registry.js';
+/** The bus event each call record rides. */
+export declare const MCP_CALL_COMPLETED = "wicked.crew.mcp_call.completed";
+export declare const DEFAULT_MCP_CALL_BUDGET = 200;
+export declare const BREAKER_THRESHOLD = 5;
+export declare const BREAKER_OPEN_MS = 60000;
+export declare const MAX_READ_RETRIES = 2;
+/** The HTTP status each outcome is answered with. */
+export declare const OUTCOME_STATUS: Record<McpCallOutcome, number>;
+/** A call the broker answered: the HTTP status and the body. */
+export interface McpBrokerAnswer {
+    status: number;
+    body: McpCallResponse | {
+        error: string;
+        code: 'invalid_token' | 'bad_request';
+    };
+}
+export interface McpBrokerDeps {
+    registry: Pick<McpRegistry, 'resolveCall' | 'callSecret'>;
+    /** The engine's gate, read per call; `null` = the linked engine has none (every call refused). */
+    engine: () => McpEngineGate | null;
+    records: McpCallRecordSink;
+    invoke?: Invoker;
+    /** Called with every record once it is written (`/ws` + bus). Never throws into the call. */
+    publish?: (record: McpCallRecord) => void | Promise<void>;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    budgetPerUnit?: number;
+    timeoutMs?: number;
+    log?: (message: string) => void;
+}
+export declare function budgetFromEnv(env?: NodeJS.ProcessEnv): number;
+export declare class McpBroker {
+    private readonly deps;
+    private readonly invoke;
+    private readonly now;
+    private readonly sleep;
+    private readonly budget;
+    private readonly timeoutMs;
+    private readonly used;
+    private readonly breakers;
+    constructor(deps: McpBrokerDeps);
+    call(body: McpCallBody): Promise<McpBrokerAnswer>;
+    private record;
+    /**
+     * Answer a call that does not hand a result back, after recording it. A refusal is a refusal
+     * whether or not its record lands; a failed write is logged, and the answer keeps its outcome
+     * (a deny is never re-labelled `guard_error`, I5).
+     */
+    private refuse;
+    private publish;
+}
+//# sourceMappingURL=broker.d.ts.map

package/dist/mcp/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../src/mcp/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,KAAK,EACV,WAAW,EAEX,cAAc,EACd,aAAa,EACb,eAAe,EAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAA6D,KAAK,OAAO,EAA2B,MAAM,aAAa,CAAC;AAE/H,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AACnE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AA2BlC,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CASzD,CAAC;AAEF,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,eAAe,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,GAAG,aAAa,CAAA;KAAE,CAAC;CAClF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IAC1D,kGAAkG;IAClG,MAAM,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAkBD,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI1E;AAED,qBAAa,SAAS;IASR,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;gBAE/B,IAAI,EAAE,aAAa;IAQ1C,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IA0JvD,OAAO,CAAC,MAAM;IAmCd;;;;OAIG;YACW,MAAM;IAkCpB,OAAO,CAAC,OAAO;CAShB"}

package/dist/mcp/broker.js

@@ -0,0 +1,307 @@
+/**
+ * The MCP broker's call path (DES-MCP-TOOLS-001 §6; slice S3). A worker on any seat reaches an
+ * upstream MCP tool only through here (the garden shim, `wicked-garden run mcp call`, sends
+ * `POST /api/v1/mcp/call {token, subject, args}`), and every step below runs in order:
+ *
+ *  1-3. **Judge.** The subject is resolved in the registry (unknown, disabled, `gone` or changed
+ *       tools go to the engine as `registered: false`, D-5), then core's `evaluateMcpCall` verifies
+ *       the token, judges the call for the unit the token is bound to (D-1 phase role, policy,
+ *       first use, the run's mode) and records the claim. `deny` and `ask` never reach an upstream.
+ *  4.   **Budget.** At most {@link DEFAULT_MCP_CALL_BUDGET} invoked calls per unit attempt
+ *       (`WICKED_MCP_CALL_BUDGET` overrides it).
+ *  5.   **Breaker.** After {@link BREAKER_THRESHOLD} consecutive upstream failures a tool is refused
+ *       for {@link BREAKER_OPEN_MS}; then one call is let through, and one more failure reopens it.
+ *  6.   **Invoke** with a deadline. The upstream's secret is resolved here, and only here. A `rest`
+ *       tool (slice S5a, `rest.ts`) sends only its allowlisted arguments, and only to its pinned
+ *       base URL: a request that would leave it is refused unsent, recorded as `guard_error`
+ *       (`rest_host_escape`, I6).
+ *  7.   **Retry** READ tools only, at most {@link MAX_READ_RETRIES} times, and only on transport
+ *       errors, 429 and 5xx. A write or destructive tool is never retried: a second attempt could
+ *       apply the write twice.
+ *  8.   **Post.** The result is scrubbed (the exact secrets injected on this call, then credential
+ *       field names and value shapes, D-2), then core's `evaluateMcpOutput` judges it; a deny
+ *       withholds it. A crash anywhere here is `guard_error`: refused, fail closed.
+ *  9.   **Record** (D-3). Every judged call is written to `calls.ndjson`; a call whose record cannot
+ *       be written is refused and its result withheld. The record then rides `/ws`
+ *       (`mcpCallCompleted`) and the bus (`wicked.crew.mcp_call.completed`).
+ *
+ * A call that ran and then could not be recorded HAS happened upstream; refusing it withholds the
+ * result from the worker, it does not undo the side effect. The record is written after the call
+ * because the span it records (timing, status, bytes) only exists then.
+ */
+import { randomBytes } from 'node:crypto';
+import { parseMcpSubject } from './classify.js';
+import { classifyUpstreamError, invokeMcpTool, MCP_CALL_TIMEOUT_MS } from './invoke.js';
+import { scrubResult } from './redact.js';
+import { scrubSecrets } from './secrets.js';
+/** The bus event each call record rides. */
+export const MCP_CALL_COMPLETED = 'wicked.crew.mcp_call.completed';
+export const DEFAULT_MCP_CALL_BUDGET = 200;
+export const BREAKER_THRESHOLD = 5;
+export const BREAKER_OPEN_MS = 60_000;
+export const MAX_READ_RETRIES = 2;
+/** Units whose budget counters are kept; the oldest is dropped first. */
+const BUDGET_UNITS_MAX = 4096;
+/** The HTTP status each outcome is answered with. */
+export const OUTCOME_STATUS = {
+    ok: 200,
+    denied: 403,
+    withheld: 403,
+    pending_approval: 409,
+    budget_exhausted: 429,
+    breaker_open: 503,
+    upstream_error: 502,
+    guard_error: 500,
+};
+export function budgetFromEnv(env = process.env) {
+    const raw = env['WICKED_MCP_CALL_BUDGET'];
+    const n = raw === undefined ? NaN : Number(raw);
+    return Number.isInteger(n) && n > 0 ? n : DEFAULT_MCP_CALL_BUDGET;
+}
+export class McpBroker {
+    deps;
+    invoke;
+    now;
+    sleep;
+    budget;
+    timeoutMs;
+    used = new Map();
+    breakers = new Map();
+    constructor(deps) {
+        this.deps = deps;
+        this.invoke = deps.invoke ?? invokeMcpTool;
+        this.now = deps.now ?? Date.now;
+        this.sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        this.budget = deps.budgetPerUnit ?? budgetFromEnv();
+        this.timeoutMs = deps.timeoutMs ?? MCP_CALL_TIMEOUT_MS;
+    }
+    async call(body) {
+        const parts = parseMcpSubject(body.subject);
+        if (parts === null)
+            return { status: 400, body: { error: `subject must be mcp:<server>/<tool> (got ${JSON.stringify(body.subject)})`, code: 'bad_request' } };
+        const span = { start: this.now(), spanId: randomBytes(8).toString('hex'), subject: body.subject, verdict: null, kind: null, retries: 0, bytesOut: 0 };
+        // ── 1-3. Resolve and judge ──────────────────────────────────────────────────────────────
+        const gate = this.deps.engine();
+        if (gate === null) {
+            return this.refuse(span, 'guard_error', 'guard_error', 'broker', [], 'the linked engine has no MCP gate (wicked-core-ts predates evaluateMcpCall/evaluateMcpOutput)', 'upgrade the engine; no MCP call runs unjudged');
+        }
+        let target;
+        try {
+            target = await this.deps.registry.resolveCall(parts.server, parts.tool);
+        }
+        catch (err) {
+            return this.refuse(span, 'guard_error', 'guard_error', 'broker', [], `the MCP registry could not be read: ${message(err)}`, 'the operator fixes the registry in studio → MCP tools');
+        }
+        span.kind = target?.config.kind ?? null;
+        const call = {
+            server: parts.server,
+            tool: parts.tool,
+            args: body.args ?? {},
+            annotations: target?.annotations ?? null,
+            classOverride: target?.classOverride ?? null,
+            registered: target?.registered ?? false,
+            ...(target !== null ? { kind: target.config.kind } : {}),
+            carrier: 'shim',
+        };
+        let verdict;
+        try {
+            verdict = JSON.parse(await gate.evaluateCall(JSON.stringify({ token: body.token, call })));
+        }
+        catch (err) {
+            const msg = message(err);
+            if (msg.startsWith('invalid_token'))
+                return { status: 401, body: { error: msg, code: 'invalid_token' } };
+            if (msg.startsWith('bad_request'))
+                return { status: 400, body: { error: msg, code: 'bad_request' } };
+            return this.refuse(span, 'guard_error', 'guard_error', 'engine', [], `the call could not be judged or recorded: ${msg}`, 'nothing ran; try again, and report it if it persists');
+        }
+        span.verdict = verdict;
+        if (verdict.decision === 'deny') {
+            return this.refuse(span, 'denied', 'deny', verdict.ruleIds[0] ?? 'policy', verdict.ruleIds, verdict.reason, verdict.remedy);
+        }
+        if (verdict.decision === 'ask') {
+            return this.refuse(span, 'pending_approval', 'ask', verdict.ruleIds[0] ?? 'policy', verdict.ruleIds, verdict.reason, verdict.remedy);
+        }
+        if (target === null || !target.registered) {
+            // The engine allowed a subject the registry does not hold as registered (unknown, disabled,
+            // `gone` or changed since its preview): never invoke it (D-5 holds even if the engine errs).
+            return this.refuse(span, 'guard_error', 'guard_error', 'broker', verdict.ruleIds, `${body.subject} is not a registered, enabled tool`, 'register it in studio → MCP tools');
+        }
+        // ── 4. Budget ───────────────────────────────────────────────────────────────────────────
+        const unitKey = `${verdict.unit.runId}:${verdict.unit.ord}:${verdict.unit.attempt}`;
+        const used = this.used.get(unitKey) ?? 0;
+        if (used >= this.budget) {
+            return this.refuse(span, 'budget_exhausted', 'deny', 'budget', [], `this unit has made its ${this.budget} MCP calls`, 'finish with what you have; the budget is per unit');
+        }
+        // ── 5. Breaker ──────────────────────────────────────────────────────────────────────────
+        const breaker = this.breakers.get(body.subject) ?? { failures: 0, openUntil: 0 };
+        if (breaker.openUntil > this.now()) {
+            const secs = Math.ceil((breaker.openUntil - this.now()) / 1000);
+            return this.refuse(span, 'breaker_open', 'deny', 'breaker', [], `${body.subject} failed ${BREAKER_THRESHOLD} times in a row; refused for ${secs} s more`, 'continue without it, or try again later');
+        }
+        // ── 6. The secret, resolved here and only here. A call refused at this step never reaches the
+        //       upstream, so it spends no budget and does not move the breaker. ─────────────────────
+        let secret;
+        try {
+            const resolved = await this.deps.registry.callSecret(target.config);
+            if (resolved.missing) {
+                return this.refuse(span, 'upstream_error', 'allow', verdict.ruleIds[0] ?? 'policy', verdict.ruleIds, `${target.config.auth?.ref ?? 'the secret'} resolves to no secret; the call was not made unauthenticated`, 'the operator sets the secret in studio → MCP tools', 'secret_missing');
+            }
+            secret = resolved.secret;
+        }
+        catch (err) {
+            return this.refuse(span, 'guard_error', 'guard_error', 'broker', verdict.ruleIds, `the upstream's secret could not be read (${message(err)}); nothing ran`, 'try again, and report it if it persists');
+        }
+        if (breaker.openUntil !== 0) {
+            // Half-open: this call is let through, and one more failure reopens the breaker.
+            breaker.openUntil = 0;
+            breaker.failures = BREAKER_THRESHOLD - 1;
+        }
+        this.used.delete(unitKey);
+        this.used.set(unitKey, used + 1);
+        while (this.used.size > BUDGET_UNITS_MAX)
+            this.used.delete(this.used.keys().next().value);
+        // ── 6-7. Invoke, retrying read tools on transient failures only ─────────────────────────
+        const secrets = secret === null ? [] : [secret];
+        let result = null;
+        for (let attempt = 0;; attempt++) {
+            try {
+                result = await this.invoke(target.config, secret, parts.tool, call.args, this.timeoutMs, target.rest);
+                break;
+            }
+            catch (err) {
+                const failure = classifyUpstreamError(err);
+                if (failure.errorClass === 'boundary') {
+                    // I6: a REST request that would leave its pinned host was refused before it was sent (or a
+                    // redirect off the host was not followed). Not the tool's failure, so the breaker is not
+                    // moved; recorded as a guard_error, which fails closed.
+                    const reason = scrubResult(`${body.subject} was refused: ${failure.message}`, secrets);
+                    return this.refuse(span, 'guard_error', 'guard_error', 'broker:rest-host-pin', verdict.ruleIds, reason, 'call it with arguments that keep the request on the API\'s own host and path', 'rest_host_escape');
+                }
+                if (verdict.class === 'read' && failure.retryable && attempt < MAX_READ_RETRIES) {
+                    span.retries += 1;
+                    await this.sleep(200 * (attempt + 1));
+                    continue;
+                }
+                breaker.failures += 1;
+                if (breaker.failures >= BREAKER_THRESHOLD)
+                    breaker.openUntil = this.now() + BREAKER_OPEN_MS;
+                this.breakers.set(body.subject, breaker);
+                const reason = scrubResult(`${body.subject} failed upstream (${failure.errorClass}): ${failure.message}`, secrets);
+                return this.refuse(span, 'upstream_error', 'allow', verdict.ruleIds[0] ?? 'policy', verdict.ruleIds, reason, 'the call may be retried later; a write may or may not have applied', failure.errorClass);
+            }
+        }
+        breaker.failures = 0;
+        this.breakers.set(body.subject, breaker);
+        // ── 8. Post: scrub, then the output decision; a crash is guard_error ─────────────────────
+        let scrubbed;
+        let output;
+        try {
+            scrubbed = scrubResult(result, secrets);
+            const raw = JSON.stringify(scrubbed);
+            span.bytesOut = Buffer.byteLength(raw, 'utf8');
+            output = JSON.parse(await gate.evaluateOutput(JSON.stringify({ token: body.token, call, raw })));
+            if (output.decision !== 'allow' && output.decision !== 'deny')
+                throw new Error(`unknown output decision ${JSON.stringify(output.decision)}`);
+        }
+        catch (err) {
+            return this.refuse(span, 'guard_error', 'guard_error', 'engine:mcp-output', [], `the result could not be checked (${scrubSecrets(message(err), secrets)}); it is withheld`, 'the call ran; its result is not shown');
+        }
+        if (output.decision === 'deny') {
+            return this.refuse(span, 'withheld', 'deny', output.ruleIds[0] ?? 'policy', output.ruleIds, output.reason, output.remedy, null, output.claimId ?? null);
+        }
+        // ── 9. Record, then answer ──────────────────────────────────────────────────────────────
+        const isError = scrubbed['isError'] === true;
+        const record = this.record(span, 'ok', 'allow', verdict.ruleIds[0] ?? 'policy', verdict.ruleIds, isError ? 'tool_error' : null, verdict.claimId);
+        try {
+            await this.deps.records.append(record);
+        }
+        catch (err) {
+            this.deps.log?.(`[mcp] the call record for ${body.subject} could not be written (${message(err)}); its result is withheld`);
+            return {
+                status: OUTCOME_STATUS.guard_error,
+                body: {
+                    outcome: 'guard_error',
+                    subject: body.subject,
+                    callId: null,
+                    ruleIds: [],
+                    reason: 'the call could not be recorded (D-3); its result is withheld',
+                    remedy: 'the call ran; its result is not shown',
+                },
+            };
+        }
+        this.publish(record);
+        return { status: 200, body: { outcome: 'ok', subject: body.subject, callId: span.spanId, result: scrubbed, ruleIds: verdict.ruleIds } };
+    }
+    record(span, outcome, decision, by, ruleIds, errorClass, claimId) {
+        const end = this.now();
+        const v = span.verdict;
+        return {
+            traceId: v?.unit.runId ?? null,
+            spanId: span.spanId,
+            parentSpanId: v === null ? null : `${v.unit.ord}:${v.unit.attempt}`,
+            name: 'mcp.tool.call',
+            start: new Date(span.start).toISOString(),
+            end: new Date(end).toISOString(),
+            ms: end - span.start,
+            status: { code: errorClass === null && outcome === 'ok' ? 'ok' : 'error', errorClass: errorClass ?? (outcome === 'ok' ? null : outcome) },
+            decision: { decision, by, ruleIds, claimId },
+            outcome,
+            attrs: {
+                'mcp.subject': span.subject,
+                'mcp.class': v?.class ?? null,
+                'mcp.kind': span.kind,
+                'wicked.seat': v?.unit.seat ?? null,
+                'wicked.phase': v?.unit.phase ?? null,
+                'wicked.carrier': 'shim',
+                'bytes.out': span.bytesOut,
+                retries: span.retries,
+            },
+        };
+    }
+    /**
+     * Answer a call that does not hand a result back, after recording it. A refusal is a refusal
+     * whether or not its record lands; a failed write is logged, and the answer keeps its outcome
+     * (a deny is never re-labelled `guard_error`, I5).
+     */
+    async refuse(span, outcome, decision, by, ruleIds, reason, remedy, errorClass = null, claimId = span.verdict?.claimId ?? null) {
+        const record = this.record(span, outcome, decision, by, ruleIds, errorClass ?? outcome, claimId);
+        let recorded = true;
+        try {
+            await this.deps.records.append(record);
+        }
+        catch (err) {
+            recorded = false;
+            this.deps.log?.(`[mcp] the call record for ${span.subject} (${outcome}) could not be written: ${message(err)}`);
+        }
+        if (recorded)
+            this.publish(record);
+        const body = {
+            outcome,
+            subject: span.subject,
+            callId: recorded ? span.spanId : null,
+            ruleIds,
+            ...(reason !== undefined ? { reason } : {}),
+            ...(remedy !== undefined ? { remedy } : {}),
+            ...(outcome === 'pending_approval' ? { pending_approval: span.subject } : {}),
+            ...(outcome === 'denied' || outcome === 'withheld' ? { denied: true } : {}),
+        };
+        const status = outcome === 'upstream_error' && errorClass === 'timeout' ? 504 : OUTCOME_STATUS[outcome];
+        return { status, body };
+    }
+    publish(record) {
+        const publish = this.deps.publish;
+        if (publish === undefined)
+            return;
+        try {
+            void Promise.resolve(publish(record)).catch((err) => this.deps.log?.(`[mcp] publishing call ${record.spanId} failed: ${message(err)}`));
+        }
+        catch (err) {
+            this.deps.log?.(`[mcp] publishing call ${record.spanId} failed: ${message(err)}`);
+        }
+    }
+}
+function message(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=broker.js.map

package/dist/mcp/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/mcp/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,mBAAmB,EAAyC,MAAM,aAAa,CAAC;AAC/H,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAyB9B,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAmC;IAC5D,EAAE,EAAE,GAAG;IACP,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,GAAG;IACrB,YAAY,EAAE,GAAG;IACjB,cAAc,EAAE,GAAG;IACnB,WAAW,EAAE,GAAG;CACjB,CAAC;AAuCF,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,GAAG,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,SAAS;IASS;IARZ,MAAM,CAAU;IAChB,GAAG,CAAe;IAClB,KAAK,CAAgC;IACrC,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE5D,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;QAC9J,MAAM,IAAI,GAAS,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAE5J,2FAA2F;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,+FAA+F,EAAE,+CAA+C,CAAC,CAAC;QACzN,CAAC;QACD,IAAI,MAAqE,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,uCAAuC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,uDAAuD,CAAC,CAAC;QACvL,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI;YACxC,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;YAC5C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK;YACvC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,MAAM;SAChB,CAAC;QACF,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAkB,CAAC;QAC9G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;YACzG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,6CAA6C,GAAG,EAAE,EAAE,sDAAsD,CAAC,CAAC;QACnL,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvI,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1C,4FAA4F;YAC5F,6FAA6F;YAC7F,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,oCAAoC,EAAE,mCAAmC,CAAC,CAAC;QAC9K,CAAC;QAED,2FAA2F;QAC3F,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,0BAA0B,IAAI,CAAC,MAAM,YAAY,EAAE,mDAAmD,CAAC,CAAC;QAC7K,CAAC;QAED,2FAA2F;QAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACjF,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,WAAW,iBAAiB,gCAAgC,IAAI,SAAS,EAAE,yCAAyC,CAAC,CAAC;QACvM,CAAC;QAED,+FAA+F;QAC/F,8FAA8F;QAC9F,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,+DAA+D,EAAE,oDAAoD,EAAE,gBAAgB,CAAC,CAAC;YAC1R,CAAC;YACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,4CAA4C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;QACzM,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YAC5B,iFAAiF;YACjF,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,iBAAiB,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;QAEpG,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,GAA8B,IAAI,CAAC;QAC7C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtG,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACtC,2FAA2F;oBAC3F,yFAAyF;oBACzF,wDAAwD;oBACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;oBACvF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,8EAA8E,EAAE,kBAAkB,CAAC,CAAC;gBAC9M,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,GAAG,gBAAgB,EAAE,CAAC;oBAChF,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;oBAClB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,QAAQ,IAAI,iBAAiB;oBAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;gBAC5F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACzC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,qBAAqB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,oEAAoE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACzM,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEzC,4FAA4F;QAC5F,IAAI,QAA4B,CAAC;QACjC,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAwB,CAAC;YACxH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/I,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,EAAE,EAAE,oCAAoC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QACvN,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QAC1J,CAAC;QAED,2FAA2F;QAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjJ,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,6BAA6B,IAAI,CAAC,OAAO,0BAA0B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5H,OAAO;gBACL,MAAM,EAAE,cAAc,CAAC,WAAW;gBAClC,IAAI,EAAE;oBACJ,OAAO,EAAE,aAAa;oBACtB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,8DAA8D;oBACtE,MAAM,EAAE,uCAAuC;iBAChD;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1I,CAAC;IAEO,MAAM,CACZ,IAAU,EACV,OAAuB,EACvB,QAAyB,EACzB,EAAU,EACV,OAAiB,EACjB,UAAyB,EACzB,OAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE;YACnE,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACzC,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAChC,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;YACzI,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YAC5C,OAAO;YACP,KAAK,EAAE;gBACL,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI;gBAC7B,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;gBACnC,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;gBACrC,gBAAgB,EAAE,MAAM;gBACxB,WAAW,EAAE,IAAI,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,MAAM,CAClB,IAAU,EACV,OAAsC,EACtC,QAAyB,EACzB,EAAU,EACV,OAAiB,EACjB,MAA0B,EAC1B,MAA0B,EAC1B,aAA4B,IAAI,EAChC,UAAyB,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI;QAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC;QACjG,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,6BAA6B,IAAI,CAAC,OAAO,KAAK,OAAO,2BAA2B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,QAAQ;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAoB;YAC5B,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YACrC,OAAO;YACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,KAAK,gBAAgB,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACxG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,OAAO,CAAC,MAAqB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC;YACH,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,yBAAyB,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,yBAAyB,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/mcp/call-records.d.ts

@@ -0,0 +1,61 @@
+/**
+ * MCP call records at rest (DES-MCP-TOOLS-001 §5, D-3): `<state home>/mcp/calls.ndjson`, one OTel
+ * span-shaped record per brokered call. Arguments and results are never captured.
+ *
+ * The broker writes a record for every call it judged, whatever the outcome, and a call whose
+ * record cannot be written is refused (`guard_error`): its result is withheld. Appends are
+ * serialized on one promise chain so two concurrent calls never interleave a line.
+ *
+ * The usage slice (S7) reads the records back on the same chain. A read first folds every record
+ * that started more than {@link MCP_CALLS_RAW_DAYS} days ago into `calls-daily.ndjson` (one row per
+ * UTC day × subject × seat × decision: calls, errors, total ms) and rewrites `calls.ndjson` without
+ * them (write a temp file, then rename). The fold runs on demand, never on a timer.
+ */
+import type { McpCallDecision, McpCallRecord } from '../core/types.js';
+export declare const MCP_CALLS_FILENAME = "calls.ndjson";
+export declare const MCP_CALLS_DAILY_FILENAME = "calls-daily.ndjson";
+/** Records stay raw this long; older ones are folded into the daily file. */
+export declare const MCP_CALLS_RAW_DAYS = 30;
+export interface McpCallRecordSink {
+    append(record: McpCallRecord): Promise<void>;
+}
+/** One row of `calls-daily.ndjson`. */
+export interface McpCallDailyRow {
+    day: string;
+    subject: string;
+    seat: string | null;
+    decision: McpCallDecision;
+    calls: number;
+    errors: number;
+    msTotal: number;
+}
+export interface McpCallRecordsRead {
+    records: McpCallRecord[];
+    /** Lines that did not parse as a call record (kept in the file, left out of every fold). */
+    skipped: number;
+    /** Records this read folded into the daily file. */
+    folded: number;
+}
+/** The records the usage fold reads. */
+export interface McpCallRecordSource {
+    read(now: number): Promise<McpCallRecordsRead>;
+}
+/** A parsed line when it has the fields the usage fold reads; otherwise `null`. */
+export declare function parseCallRecord(line: string): McpCallRecord | null;
+/** Fold records into daily rows, sorted by day, subject, seat, decision. */
+export declare function foldDaily(records: readonly McpCallRecord[]): McpCallDailyRow[];
+export declare class McpCallRecordFile implements McpCallRecordSink, McpCallRecordSource {
+    private readonly dir;
+    private tail;
+    constructor(dir?: string);
+    get path(): string;
+    get dailyPath(): string;
+    append(record: McpCallRecord): Promise<void>;
+    /**
+     * Every record of the last {@link MCP_CALLS_RAW_DAYS} days, after folding older ones into the
+     * daily file. Serialized with the appends, so no call's line is lost to the rewrite.
+     */
+    read(now: number): Promise<McpCallRecordsRead>;
+    private serialize;
+}
+//# sourceMappingURL=call-records.d.ts.map

package/dist/mcp/call-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-records.d.ts","sourceRoot":"","sources":["../../src/mcp/call-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGvE,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAKrC,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAoBlE;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,eAAe,EAAE,CAe9E;AAED,qBAAa,iBAAkB,YAAW,iBAAiB,EAAE,mBAAmB;IAGlE,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,IAAI,CAAuC;gBAEtB,GAAG,GAAE,MAAsB;IAExD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5C;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwC9C,OAAO,CAAC,SAAS;CAKlB"}

package/dist/mcp/call-records.js

@@ -0,0 +1,135 @@
+/**
+ * MCP call records at rest (DES-MCP-TOOLS-001 §5, D-3): `<state home>/mcp/calls.ndjson`, one OTel
+ * span-shaped record per brokered call. Arguments and results are never captured.
+ *
+ * The broker writes a record for every call it judged, whatever the outcome, and a call whose
+ * record cannot be written is refused (`guard_error`): its result is withheld. Appends are
+ * serialized on one promise chain so two concurrent calls never interleave a line.
+ *
+ * The usage slice (S7) reads the records back on the same chain. A read first folds every record
+ * that started more than {@link MCP_CALLS_RAW_DAYS} days ago into `calls-daily.ndjson` (one row per
+ * UTC day × subject × seat × decision: calls, errors, total ms) and rewrites `calls.ndjson` without
+ * them (write a temp file, then rename). The fold runs on demand, never on a timer.
+ */
+import { appendFile, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { mcpStateDir } from './registry-store.js';
+export const MCP_CALLS_FILENAME = 'calls.ndjson';
+export const MCP_CALLS_DAILY_FILENAME = 'calls-daily.ndjson';
+/** Records stay raw this long; older ones are folded into the daily file. */
+export const MCP_CALLS_RAW_DAYS = 30;
+const DAY_MS = 86_400_000;
+const DECISIONS = new Set(['allow', 'ask', 'deny', 'guard_error']);
+/** A parsed line when it has the fields the usage fold reads; otherwise `null`. */
+export function parseCallRecord(line) {
+    let v;
+    try {
+        v = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    if (typeof v !== 'object' || v === null)
+        return null;
+    const r = v;
+    const ok = typeof r.spanId === 'string' &&
+        typeof r.start === 'string' &&
+        Number.isFinite(Date.parse(r.start)) &&
+        typeof r.ms === 'number' &&
+        typeof r.status?.code === 'string' &&
+        DECISIONS.has(r.decision?.decision) &&
+        typeof r.attrs?.['mcp.subject'] === 'string' &&
+        (r.traceId === null || typeof r.traceId === 'string') &&
+        (r.parentSpanId === null || typeof r.parentSpanId === 'string');
+    return ok ? r : null;
+}
+/** Fold records into daily rows, sorted by day, subject, seat, decision. */
+export function foldDaily(records) {
+    const rows = new Map();
+    for (const r of records) {
+        const day = new Date(Date.parse(r.start)).toISOString().slice(0, 10);
+        const seat = r.attrs['wicked.seat'] ?? null;
+        const key = JSON.stringify([day, r.attrs['mcp.subject'], seat, r.decision.decision]);
+        const row = rows.get(key) ?? { day, subject: r.attrs['mcp.subject'], seat, decision: r.decision.decision, calls: 0, errors: 0, msTotal: 0 };
+        row.calls += 1;
+        if (r.status.code === 'error')
+            row.errors += 1;
+        row.msTotal += r.ms;
+        rows.set(key, row);
+    }
+    return [...rows.values()].sort((a, b) => a.day.localeCompare(b.day) || a.subject.localeCompare(b.subject) || (a.seat ?? '').localeCompare(b.seat ?? '') || a.decision.localeCompare(b.decision));
+}
+export class McpCallRecordFile {
+    dir;
+    tail = Promise.resolve();
+    constructor(dir = mcpStateDir()) {
+        this.dir = dir;
+    }
+    get path() {
+        return join(this.dir, MCP_CALLS_FILENAME);
+    }
+    get dailyPath() {
+        return join(this.dir, MCP_CALLS_DAILY_FILENAME);
+    }
+    append(record) {
+        const line = `${JSON.stringify(record)}\n`;
+        return this.serialize(async () => {
+            await mkdir(this.dir, { recursive: true, mode: 0o700 });
+            await appendFile(this.path, line, { mode: 0o600 });
+        });
+    }
+    /**
+     * Every record of the last {@link MCP_CALLS_RAW_DAYS} days, after folding older ones into the
+     * daily file. Serialized with the appends, so no call's line is lost to the rewrite.
+     */
+    read(now) {
+        return this.serialize(async () => {
+            let text;
+            try {
+                text = await readFile(this.path, 'utf8');
+            }
+            catch (err) {
+                if (err.code === 'ENOENT')
+                    return { records: [], skipped: 0, folded: 0 };
+                throw err;
+            }
+            const cutoff = now - MCP_CALLS_RAW_DAYS * DAY_MS;
+            const keep = [];
+            const records = [];
+            const old = [];
+            let skipped = 0;
+            for (const line of text.split('\n')) {
+                if (line.trim() === '')
+                    continue;
+                const r = parseCallRecord(line);
+                if (r === null) {
+                    skipped += 1;
+                    keep.push(line);
+                }
+                else if (Date.parse(r.start) < cutoff) {
+                    old.push(r);
+                }
+                else {
+                    keep.push(line);
+                    records.push(r);
+                }
+            }
+            if (old.length > 0) {
+                // The raw file is rewritten only after the daily rows are durable: a crash in between
+                // counts those records twice in the archive, never zero times.
+                const daily = foldDaily(old).map((row) => `${JSON.stringify(row)}\n`).join('');
+                await appendFile(this.dailyPath, daily, { mode: 0o600 });
+                const tmp = `${this.path}.${process.pid}.tmp`;
+                await writeFile(tmp, keep.map((l) => `${l}\n`).join(''), { mode: 0o600 });
+                await rename(tmp, this.path);
+            }
+            return { records, skipped, folded: old.length };
+        });
+    }
+    serialize(work) {
+        const next = this.tail.then(work);
+        this.tail = next.catch(() => undefined);
+        return next;
+    }
+}
+//# sourceMappingURL=call-records.js.map

package/dist/mcp/call-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-records.js","sourceRoot":"","sources":["../../src/mcp/call-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAC7D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AA8BpF,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,CAA2B,CAAC;IACtC,MAAM,EAAE,GACN,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;QAClC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAA2B,CAAC;QACtD,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,KAAK,QAAQ;QAC5C,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QACrD,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,OAAiC;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5I,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/C,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CACjK,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGC;IAFrB,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,YAA6B,MAAc,WAAW,EAAE;QAA3B,QAAG,GAAH,GAAG,CAAwB;IAAG,CAAC;IAE5D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,MAAqB;QAC1B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBACpG,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,GAAG,kBAAkB,GAAG,MAAM,CAAC;YACjD,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAoB,EAAE,CAAC;YACpC,MAAM,GAAG,GAAoB,EAAE,CAAC;YAChC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,SAAS;gBACjC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACf,OAAO,IAAI,CAAC,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC;oBACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,sFAAsF;gBACtF,+DAA+D;gBAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/E,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;gBAC9C,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAI,IAAsB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}