{"version":3,"sources":["../src/adapter.ts","../src/guardrails.ts","../src/governance.ts","../src/registries/banking.ts","../src/registries/boletin-oficial.ts","../src/registries/facturacion.ts","../src/registries/firma-digital.ts","../src/registries/gde-tad.ts","../src/registries/identity.ts","../src/registries/whatsapp.ts","../src/registries/identity-attest.ts","../src/registries/igj.ts","../src/registries/mercadolibre.ts","../src/registries/mercadopago.ts","../src/registries/mi-argentina.ts","../src/registries/shipping.ts","../src/cli-doctor.ts"],"names":["z","halt","bankingTools","BcraPublicApiAdapter","boletinOficialTools","InMemoryBoSubscriptionAdapter","UnconfiguredBoFetcher","LiveBoFetcher","facturacionTools","WsfeClient","firmaDigitalTools","gdeTadTools","UnconfiguredDomicilioAdapter","UnconfiguredTramitesAdapter","identityTools","WsaaWscdcAfipPadronAdapter","whatsappTools","WhatsAppClient","WhatsAppOtpAdapter","EmailMagicLinkAdapter","AttestationClient","identityAttestTools","buildFetcher","igjTools","UnconfiguredIgjFetcher","LiveCkanFetcher","MeliClient","meliTools","MercadoPagoClient","mercadoPagoTools","InMemoryStateAdapter","MiArgentinaClient","miArgentinaTools","AndreaniAdapter","OcaAdapter","CorreoAdapter","shippingTools","classifyTool","levelRequiresApproval"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA+CO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,MAAM,QAAmB,EAAC;AAC1B,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAiD;AAKpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAuB;AAE3C,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACvC,IAAA,MAAM,WAAA,GACJ,iBAAiB,IAAA,IAAQ,OAAO,KAAK,WAAA,KAAgB,QAAA,GAAW,KAAK,WAAA,GAAc,EAAA;AACrF,IAAA,MAAM,YACJ,aAAA,IAAiB,IAAA,IAAQ,IAAA,CAAK,WAAA,GAAe,KAAK,WAAA,GAA4B,IAAA;AAChF,IAAA,MAAM,WAAA,GAAc,SAAA,GACfA,KAAA,CAAE,YAAA,CAAa,SAAS,CAAA,GACzB,EAAE,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,sBAAsB,KAAA,EAAM;AAClE,IAAA,IAAI,SAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,SAAS,CAAA;AAG1C,IAAA,MAAM,WAAA,GACJ,iBAAiB,IAAA,IAAQ,OAAO,KAAK,WAAA,KAAgB,QAAA,GACjD,KAAK,WAAA,GACL,MAAA;AAEN,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,WAAA,EAAa,aAAa,CAAA;AAE1D,IAAA,MAAM,IAAA,GAAO,SAAA,IAAa,IAAA,GAAQ,IAAA,CAAK,OAAA,GAAkD,IAAA;AACzF,IAAA,IAAI,CAAC,IAAA,EAAM;AAET,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,GAAA,CAAI,MAAM,IAAI,CAAA;AAAA,EACvB;AAEA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,IAAA,EAAM,OAAO,IAAA,EAAM,IAAA,KAAS;AAC1B,MAAA,MAAM,EAAA,GAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC1B,MAAA,IAAI,CAAC,EAAA,EAAI;AACP,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,kEAAA,CAAoE,CAAA;AAAA,MACnG;AAIA,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC/B,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AACpC,QAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,UAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,EAA+B,IAAI,MAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,QACjF;AACA,QAAA,OAAO,EAAA,CAAG,OAAO,IAAI,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,GAAG,IAAI,CAAA;AAAA,IAChB;AAAA,GACF;AACF;AAMO,SAAS,gBAAgB,QAAA,EAA6C;AAC3E,EAAA,MAAM,QAAmB,EAAC;AAC1B,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAiD;AACpE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,KAAA,MAAW,MAAM,QAAA,EAAU;AACzB,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,MAAM,OAAA,GAAU,kBAAkB,EAAE,CAAA;AACpC,IAAA,KAAA,MAAW,IAAA,IAAQ,QAAQ,KAAA,EAAO;AAChC,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,sBAAA,EAAyB,KAAK,IAAI,CAAA,0EAAA;AAAA,SACpC;AAAA,MACF;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,IAAI,CAAA;AAClB,MAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAEf,MAAA,MAAM,aAAA,GAAgB,OAAA;AACtB,MAAA,MAAM,WAAW,IAAA,CAAK,IAAA;AACtB,MAAA,MAAA,CAAO,GAAA,CAAI,UAAU,CAAC,IAAA,KAAkB,cAAc,IAAA,CAAK,QAAA,EAAU,IAAI,CAAC,CAAA;AAAA,IAC5E;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,IAAA,EAAM,OAAO,IAAA,EAAM,IAAA,KAAS;AAC1B,MAAA,MAAM,EAAA,GAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC1B,MAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,4BAAA,CAA8B,CAAA;AACpE,MAAA,OAAO,GAAG,IAAI,CAAA;AAAA,IAChB;AAAA,GACF;AACF;AC/FO,SAAS,aAAA,GAA+B;AAC7C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAoB;AACtC,EAAA,MAAM,GAAA,GAAM,CAAC,QAAA,KAAqB,CAAA,EAAA,qBAAO,IAAA,EAAK,EAAE,WAAA,EAAY,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,IAAI,QAAQ,CAAA,CAAA;AACtF,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,CAAC,QAAA,KAAa,KAAA,CAAM,IAAI,GAAA,CAAI,QAAQ,CAAC,CAAA,IAAK,CAAA;AAAA,IACtD,KAAK,CAAC,QAAA,EAAU,MAAA,KAAW,KAAA,CAAM,IAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,CAAI,KAAA,CAAM,IAAI,GAAA,CAAI,QAAQ,CAAC,CAAA,IAAK,KAAK,MAAM;AAAA,GAC9F;AACF;;;AC2CA,SAAS,UAAU,GAAA,EAA8C;AAC/D,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAC9B,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY;AACjC,EAAA,IAAI,CAAA,KAAM,IAAK,OAAO,MAAA;AACtB,EAAA,IAAI,CAAC,KAAA,EAAO,GAAA,EAAK,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW,UAAU,CAAA,CAAE,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,KAAA;AAC3E,EAAA,IAAI,CAAC,IAAA,EAAM,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,QAAA,EAAU,SAAS,CAAA,CAAE,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,IAAA;AAExE,EAAA,OAAO,IAAA;AACT;AAWO,SAAS,kBACd,IAAA,GAA0B,EAAC,EAC3B,GAAA,GAAyB,QAAQ,GAAA,EACb;AACpB,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAW,SAAA,CAAU,GAAA,CAAI,qBAAqB,CAAA,IAAK,IAAA;AAG1D,EAAA,IAAI,WAAiC,IAAA,CAAK,QAAA;AAC1C,EAAA,IAAI,CAAC,QAAA,IAAY,SAAA,CAAU,GAAA,CAAI,kBAAkB,MAAM,IAAA,EAAM;AAC3D,IAAA,QAAA,GAAW,MAAM,IAAA;AAAA,EACnB;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,IAAW,CAAC,IAAA,CAAK,OAAA;AAEpC,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,QAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS,aAAA;AAAc,GACrC;AACF;AA4GO,SAAS,mBAAmB,GAAA,EAAiC;AAClE,EAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,IAAA,MAAMC,KAAAA,GAAO,GAAA,CAAI,QAAA,GAAW,sCAAA,GAAsC,EAAA;AAClE,IAAA,OAAO,0FAAkFA,KAAI,CAAA,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,GAAU,oBAAA,GAAuB,yCAAA;AAClD,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,GAAW,sCAAA,GAAsC,EAAA;AAClE,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA,GACb,cAAW,GAAA,CAAI,IAAA,CAAK,YAAY,MAAM,CAAA,KAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,YAAY,MAAM,CAAA,KAAA,EAAQ,IAAI,IAAA,CAAK,QAAA,IAAY,KAAK,CAAA,CAAA,CAAA,GAC3G,EAAA;AACJ,EAAA,OAAO,CAAA,sDAAA,EAAiD,IAAI,CAAA,CAAA,EAAI,IAAI,GAAG,IAAI,CAAA,CAAA;AAC7E;AC/OO,SAAS,iBAAA,GAA6B;AAC3C,EAAA,MAAM,OAAO,gBAAA,EAAiB;AAC9B,EAAA,OAAOC,qBAAa,IAAA,GAAO,EAAE,IAAA,EAAK,GAAI,EAAE,CAAA;AAC1C;AAEA,SAAS,gBAAA,GAAiD;AACxD,EAAA,IAAI,QAAQ,GAAA,CAAI,uBAAA,EAAyB,IAAA,EAAK,KAAM,KAAK,OAAO,MAAA;AAChE,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,IAAI,eAAA,EAAiB,IAAA,MAAU,OAAO,CAAA;AACrE,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,IAAI,gBAAA,EAAkB,IAAA,MAAU,GAAG,CAAA;AAClE,EAAA,OAAO,IAAIC,4BAAA,CAAqB;AAAA,IAC9B,gBAAA,EAAkB,MAAA,CAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,GAAA;AAAA,IACvD,UAAA,EAAY,MAAA,CAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU;AAAA,GAClD,CAAA;AACH;ACVO,SAAS,wBAAA,GAAoC;AAClD,EAAA,MAAM,UAAU,YAAA,EAAa;AAC7B,EAAA,OAAOC,kCAAA,CAAoB;AAAA,IACzB,OAAA;AAAA,IACA,aAAA,EAAe,IAAIC,4CAAA;AAA8B,GAClD,CAAA;AACH;AAEA,SAAS,YAAA,GAA0B;AACjC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,qBAAA,EAAuB,IAAA,OAAW,GAAA,EAAK;AACrD,IAAA,OAAO,IAAIC,oCAAA,EAAsB;AAAA,EACnC;AACA,EAAA,OAAO,IAAIC,4BAAA,EAAc;AAC3B;ACXO,SAAS,qBAAA,GAAiC;AAC/C,EAAA,MAAM,OAAO,eAAA,EAAgB;AAC7B,EAAA,MAAM,aAAA,GAAgB,MAAA;AAAA,IACpB,OAAA,CAAQ,GAAA,CAAI,mBAAA,EAAqB,IAAA,EAAK,IAAK;AAAA,GAC7C;AACA,EAAA,MAAM,OAA+C,EAAC;AACtD,EAAA,IAAI,IAAA,OAAW,IAAA,GAAO,IAAA;AACtB,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAAK,aAAA,GAAgB,CAAA;AACpD,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACvB,EAAA,OAAOC,6BAAiB,IAAI,CAAA;AAC9B;AAEA,SAAS,eAAA,GAA0C;AACjD,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,sBAAA,EAAwB,IAAA,EAAK;AACtD,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,MAAM,GAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,MAAK,IAAK,MAAA;AAC7C,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,IAAI,eAAA,EAAiB,IAAA,MAAU,OAAO,CAAA;AACrE,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,IAAI,gBAAA,EAAkB,IAAA,MAAU,GAAG,CAAA;AAClE,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,aAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,YAAA;AAC3B,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAIC,sBAAA,CAAW;AAAA,MACpB,OAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,GAAA;AAAA,MACvD,UAAA,EAAY,MAAA,CAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU;AAAA,KAClD,CAAA;AAAA,EACH;AACA,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,IAAA,EAAK;AAClD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,IAAA,EAAK;AAChD,EAAA,IAAI,YAAY,OAAA,EAAS;AACvB,IAAA,OAAO,IAAIA,sBAAA,CAAW;AAAA,MACpB,QAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,GAAA;AAAA,MACvD,UAAA,EAAY,MAAA,CAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU;AAAA,KAClD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAA;AACT;AC1DO,SAAS,sBAAA,GAAyC;AACvD,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,gCAAA,EAAkC,IAAA,OAAW,GAAA,EAAK;AAChE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAOC,8BAAA,EAAkB;AAC3B;ACOO,SAAS,gBAAA,GAA4B;AAC1C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,0BAAA,EAA4B,IAAA,OAAW,GAAA,EAAK;AAC1D,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,OAAOC,kBAAA,CAAY;AAAA,IACjB,SAAA,EAAW,IAAIC,mCAAA,EAA6B;AAAA,IAC5C,QAAA,EAAU,IAAIC,kCAAA;AAA4B,GAC3C,CAAA;AACH;ACnBO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,MAAM,OAAO,gBAAA,EAAiB;AAC9B,EAAA,OAAOC,uBAAc,IAAA,GAAO,EAAE,IAAA,EAAK,GAAI,EAAE,CAAA;AAC3C;AAEA,SAAS,gBAAA,GAAkD;AACzD,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,sBAAA,EAAwB,IAAA,EAAK;AACtD,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,MAAM,GAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,MAAK,IAAK,MAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,aAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,YAAA;AAC3B,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAIC,gCAA2B,EAAE,OAAA,EAAS,QAAQ,gBAAA,EAAkB,IAAA,EAAM,KAAK,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,IAAA,EAAK;AAClD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,IAAA,EAAK;AAChD,EAAA,IAAI,YAAY,OAAA,EAAS;AACvB,IAAA,OAAO,IAAIA,gCAA2B,EAAE,QAAA,EAAU,SAAS,gBAAA,EAAkB,IAAA,EAAM,KAAK,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO,MAAA;AACT;AC1BO,SAAS,kBAAA,GAAqC;AACnD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACtD,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,kBAAA,EAAoB,IAAA,EAAK;AAC3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,aAAA,EAAe,OAAO,IAAA;AAC3C,EAAA,OAAOC,uBAAc,IAAIC,uBAAA,CAAe,EAAE,WAAA,EAAa,aAAA,EAAe,CAAC,CAAA;AACzE;AAWO,SAAS,iBAAA,GAA2C;AACzD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACtD,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,kBAAA,EAAoB,IAAA,EAAK;AAC3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,aAAA,EAAe,OAAO,IAAA;AAC3C,EAAA,OAAO,IAAIA,uBAAA,CAAe,EAAE,WAAA,EAAa,eAAe,CAAA;AAC1D;;;ACTO,SAAS,wBAAA,GAA2C;AACzD,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,qBAAA,EAAuB,IAAA,EAAK;AAC9D,EAAA,IAAI,CAAC,eAAe,OAAO,IAAA;AAE3B,EAAA,MAAM,WAAmG,EAAC;AAG1G,EAAA,MAAM,KAAK,iBAAA,EAAkB;AAC7B,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,QAAA,CAAS,cAAc,CAAA,GAAI,IAAIC,iCAAA,CAAmB;AAAA,MAChD,cAAA,EAAgB,EAAA;AAAA,MAChB,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,MAAK,IAAK;AAAA,KACpD,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,IAAA,EAAK;AACnD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,mBAAA,EAAqB,IAAA,EAAK;AAC1D,EAAA,IAAI,aAAa,WAAA,EAAa;AAC5B,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,iBAAA,EAAmB,MAAK,IAAK,qBAAA;AAC3D,IAAA,MAAM,SAAsB,OAAO,EAAE,IAAI,OAAA,EAAS,IAAA,EAAM,MAAK,KAAM;AACjE,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,+BAAA,EAAiC;AAAA,QACvD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,UAAU,SAAS,CAAA,CAAA;AAAA,UAClC,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,WAAW,EAAA,EAAI,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM;AAAA,OAClE,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAA,CAAI,MAAM,IAAI,MAAM,GAAA,CAAI,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,MACzE;AAAA,IACF,CAAA;AACA,IAAA,QAAA,CAAS,kBAAkB,CAAA,GAAI,IAAIC,oCAAA,CAAsB;AAAA,MACvD,MAAA;AAAA,MACA,eAAA,EAAiB,WAAA;AAAA,MACjB,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,MAAK,IAAK;AAAA,KACpD,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,OAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,IAAA;AAE/C,EAAA,MAAM,SAAS,IAAIC,gCAAA,CAAkB,EAAE,aAAA,EAAe,UAAU,CAAA;AAChE,EAAA,OAAOC,mCAAoB,MAAM,CAAA;AACnC;AClDO,SAAS,aAAA,GAAyB;AACvC,EAAA,MAAM,UAAUC,aAAAA,EAAa;AAC7B,EAAA,OAAOC,YAAA,CAAS,EAAE,OAAA,EAAS,CAAA;AAC7B;AAEA,SAASD,aAAAA,GAA2B;AAClC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,sBAAA,EAAwB,IAAA,OAAW,GAAA,EAAK;AACtD,IAAA,OAAO,IAAIE,0BAAA,EAAuB;AAAA,EACpC;AACA,EAAA,OAAO,IAAIC,mBAAA,EAAgB;AAC7B;ACAO,SAAS,sBAAA,GAAyC;AACvD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,iBAAA,EAAmB,IAAA,EAAK;AACxD,EAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,QAAQ,GAAA,CAAI,cAAA,IAAkB,IAAI,EAAE,CAAA;AACrE,EAAA,MAAM,MAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAK,KAAA;AASpD,EAAA,IAAI,CAAC,aAAa,OAAO,IAAA;AACzB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,GAAG,OAAO,IAAA;AAEvC,EAAA,MAAM,IAAA,GAAiB,EAAE,IAAA,EAAM,QAAA,EAAU,WAAA,EAAY;AACrD,EAAA,MAAM,MAAA,GAAS,IAAIC,uBAAA,CAAW,EAAE,MAAM,CAAA;AACtC,EAAA,OAAOC,eAAA,CAAU,MAAA,EAAQ,EAAE,MAAA,EAAQ,UAAU,CAAA;AAC/C;AC1BO,SAAS,qBAAA,GAAwC;AACtD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACtD,EAAA,IAAI,CAAC,aAAa,OAAO,IAAA;AACzB,EAAA,MAAM,MAAA,GAAS,IAAIC,6BAAA,CAAkB,EAAE,aAAa,CAAA;AACpD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,WAAA,EAAa,MAAK,IAAK,0BAAA;AACnD,EAAA,OAAOC,6BAAiB,MAAA,EAAQ;AAAA,IAC9B,KAAA,EAAO,IAAIC,gCAAA,EAAqB;AAAA,IAChC;AAAA,GACD,CAAA;AACH;ACKO,SAAS,qBAAA,GAAwC;AACtD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,sBAAA,EAAwB,IAAA,EAAK;AAC1D,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,0BAAA,EAA4B,IAAA,EAAK;AAClE,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,yBAAA,EAA2B,IAAA,EAAK;AAChE,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,IAAgB,CAAC,aAAa,OAAO,IAAA;AAEvD,EAAA,MAAM,QAAA,GACH,OAAA,CAAQ,GAAA,CAAI,qBAAA,EAAuB,MAAK,IAGvB,aAAA;AAEpB,EAAA,MAAM,MAAA,GAAS,IAAIC,6BAAA,CAAkB;AAAA,IACnC,MAAA,EAAQ,EAAE,QAAA,EAAU,YAAA,EAAc,aAAa,QAAA,EAAS;AAAA,IACxD,KAAA,EAAO,IAAID,gCAAAA;AAAqB,GACjC,CAAA;AACD,EAAA,OAAOE,6BAAiB,MAAM,CAAA;AAChC;ACNO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,MAAM,WAAsF,EAAC;AAE7F,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,iBAAA,EAAmB,IAAA,EAAK;AACzD,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,iBAAA,EAAmB,IAAA,EAAK;AACzD,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,sBAAA,EAAwB,IAAA,EAAK;AAChE,EAAA,IAAI,YAAA,IAAgB,gBAAgB,cAAA,EAAgB;AAClD,IAAA,QAAA,CAAS,QAAA,GAAW,IAAIC,wBAAA,CAAgB;AAAA,MACtC,QAAA,EAAU,YAAA;AAAA,MACV,QAAA,EAAU,YAAA;AAAA,MACV,YAAA,EAAc,cAAA;AAAA,MACd,GAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAK;AAAA,KAC3C,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,IAAA,EAAK;AAC3C,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,IAAA,EAAK;AACrD,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,QAAA,CAAS,GAAA,GAAM,IAAIC,mBAAA,CAAW,EAAE,MAAM,OAAA,EAAS,SAAA,EAAW,cAAc,CAAA;AAAA,EAC1E;AAEA,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,yBAAA,EAA2B,IAAA,OAAW,GAAA,EAAK;AACzD,IAAA,QAAA,CAAS,gBAAA,GAAmB,IAAIC,sBAAA,EAAc;AAAA,EAChD;AAEA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AAMlE,EAAA,OAAOC,sBAAA,CAAc;AAAA,IACnB,QAAA;AAAA,IACA,GAAI,cAAA,GAAiB,EAAE,cAAA,KAAmB;AAAC,GAC5C,CAAA;AACH;;;ACvCA,IAAM,CAAA,GAAI;AAAA,EACR,KAAA,EAAO,SAAA;AAAA,EACP,GAAA,EAAK,SAAA;AAAA,EACL,GAAA,EAAK,UAAA;AAAA,EACL,KAAA,EAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,UAAA;AAAA,EACT,IAAA,EAAM;AACR,CAAA;AACA,IAAM,WAAW,OAAA,CAAQ,GAAA,CAAI,YAAY,IAAA,IAAQ,CAAC,QAAQ,MAAA,CAAO,KAAA;AACjE,IAAM,CAAA,GAAI,CAAC,GAAA,EAAqB,CAAA,KAC9B,WAAW,CAAA,GAAI,CAAA,EAAG,CAAA,CAAE,GAAG,CAAC,CAAA,EAAG,CAAC,CAAA,EAAG,EAAE,KAAK,CAAA,CAAA;AAaxC,SAAS,eAAe,KAAA,EAKJ;AAClB,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,EAAG,IAAA,EAAM,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,QAAA,CAAS,MAAA;AACrD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,CAAC,UAAA;AAC3C,EAAA,MAAM,MAAA,GAAiB,UAAA,GAAa,UAAA,GAAa,WAAA,GAAc,SAAA,GAAY,SAAA;AAC3E,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,OAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,EAAC;AAAA,IAC7B,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB;AAAA,GACF;AACF;AAEA,SAAS,OAAO,CAAA,EAA8B;AAC5C,EAAA,MAAM,OACJ,CAAA,CAAE,MAAA,KAAW,SAAA,GACT,CAAA,CAAE,SAAS,QAAG,CAAA,GACd,CAAA,CAAE,MAAA,KAAW,YACX,CAAA,CAAE,QAAA,EAAU,QAAG,CAAA,GACf,CAAA,CAAE,OAAO,QAAG,CAAA;AACpB,EAAA,MAAM,KAAA,GACJ,EAAE,MAAA,KAAW,SAAA,GACT,EAAE,OAAA,EAAS,SAAS,CAAA,GACpB,CAAA,CAAE,MAAA,KAAW,SAAA,GACX,EAAE,QAAA,EAAU,CAAA,uBAAA,EAAqB,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA,GACvD,CAAA,CAAE,KAAA,EAAO,mCAAmC,CAAA;AACpD,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,IAAI,CAAC,CAAA,QAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AACxD,EAAA,IAAI,EAAE,MAAA,KAAW,UAAA,IAAc,CAAA,CAAE,QAAA,CAAS,SAAS,CAAA,EAAG;AACpD,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA,CAAE,OAAO,CAAA,qBAAA,EAAwB,CAAA,CAAE,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,IAAI,CAAA,CAAE,WAAW,UAAA,EAAY;AAC3B,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,CAAE,KAAA,EAAO,CAAA,cAAA,EAAiB,CAAA,CAAE,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,KAAA;AACT;AAOA,SAAS,iBAAA,GAA+B;AACtC,EAAA,OAAO,eAAA,CAAgB;AAAA,IACrB,kBAAA,EAAmB;AAAA,IACnB,qBAAA,EAAsB;AAAA,IACtB,qBAAA,EAAsB;AAAA,IACtB,sBAAA,EAAuB;AAAA,IACvB,kBAAA,EAAmB;AAAA,IACnB,wBAAA,EAAyB;AAAA,IACzB,iBAAA,EAAkB;AAAA,IAClB,qBAAA,EAAsB;AAAA,IACtB,kBAAA,EAAmB;AAAA,IACnB,wBAAA,EAAyB;AAAA,IACzB,aAAA,EAAc;AAAA,IACd,sBAAA,EAAuB;AAAA,IACvB,gBAAA;AAAiB,GAClB,CAAA,CAAE,KAAA;AACL;AAEA,IAAM,WAAA,GAA8C;AAAA,EAClD,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAQ,MAAA;AAAA,EACR,KAAA,EAAO,KAAA;AAAA,EACP,MAAA,EAAQ,KAAA;AAAA,EACR,KAAA,EAAO,KAAA;AAAA,EACP,YAAA,EAAc,KAAA;AAAA,EACd,OAAA,EAAS;AACX,CAAA;AASA,SAAS,aAAA,GAA0B;AACjC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,MAAM,iBAAA,EAAkB;AAC9B,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,CAAE,MAAA,EAAQ,4BAA4B,CAAC,CAAA;AAClD,EAAA,KAAA,CAAM,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,EAAA,EAAK,mBAAmB,GAAG,CAAC,EAAE,CAAC,CAAA;AAKnD,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,iBAAA,EAAkB;AAAA,EAC9B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,IAAA,KAAA,CAAM,KAAK,CAAA,CAAE,KAAA,EAAO,CAAA,6BAAA,EAAgC,GAAG,EAAE,CAAC,CAAA;AAC1D,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CACX,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,IAAA,MAAM,QAAQC,iBAAAA,CAAa;AAAA,MACzB,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,aAAa,CAAA,CAAE;AAAA,KAChB,CAAA;AACD,IAAA,OAAO,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,OAAO,KAAA,EAAOC,0BAAAA,CAAsB,KAAK,CAAA,EAAE;AAAA,EACpE,CAAC,CAAA,CACA,IAAA;AAAA,IACC,CAAC,CAAA,EAAG,CAAA,KACF,MAAA,CAAO,EAAE,KAAK,CAAA,GAAI,MAAA,CAAO,CAAA,CAAE,KAAK,CAAA,IAAK,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI;AAAA,GACpE;AAEF,EAAA,MAAM,aAAa,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,KAAK,CAAA,CAAE,MAAA;AAEhD,EAAA,MAAM,MAAA,GAAS,IAAI,QAAA,IAAY,IAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,SACT,sCAAA,GACA,CAAC,IAAI,OAAA,GACH,uDAAA,GACA,GAAA,CAAI,OAAA,GACF,wCAAA,GACA,gDAAA;AACR,EAAA,KAAA,CAAM,IAAA;AAAA,IACJ,KAAK,CAAA,CAAE,SAAA,EAAW,OAAO,UAAU,CAAC,CAAC,CAAA,IAAA,EAAO,CAAA,CAAE,WAAW,MAAA,CAAO,KAAA,CAAM,MAAM,CAAC,CAAC,mCAA8B,CAAA,CAAE,MAAA,EAAQ,IAAI,CAAC,CAAA;AAAA,GAC7H;AACA,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAEb,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,MAAM,GAAA,GAAM,WAAA,CAAY,CAAA,CAAE,KAAK,CAAA,IAAK,QAAA;AAEpC,IAAA,MAAM,SAAA,GAAY,EAAE,KAAA,GAChB,MAAA,GACE,WACA,CAAC,GAAA,CAAI,OAAA,GACH,SAAA,GACA,OAAA,GACJ,SAAA;AACJ,IAAA,MAAM,OAAA,GAA0B,EAAE,KAAA,GAC9B,MAAA,GACE,QACA,CAAC,GAAA,CAAI,OAAA,GACH,KAAA,GACA,KAAA,GACJ,OAAA;AACJ,IAAA,MAAM,OAAO,CAAA,CAAE,OAAA,EAAS,SAAA,CAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAC3C,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,EAAE,GAAA,EAAK,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,EAAE,CAAC,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,EAChE;AACA,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,IAAI,UAAA,GAAa,KAAK,GAAA,CAAI,OAAA,IAAW,CAAC,GAAA,CAAI,OAAA,IAAW,CAAC,MAAA,EAAQ;AAC5D,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA;AAAA,QACE,QAAA;AAAA,QACA;AAAA;AAMF,KACF;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,EACf;AACA,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,SAAA,GAA6B;AACjD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,CAAA,EAAG,EAAE,MAAA,EAAQ,gBAAgB,CAAC,CAAA,OAAA,CAAS,CAAC,CAAA;AAC7D,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,CAAE,KAAA,EAAO,0DAA0D,CAAC,CAAA;AAC/E,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAEb,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,CAAQ,QAAA,CAAS,KAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA;AACxD,EAAA,IAAI,QAAQ,EAAA,EAAI;AACd,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,CAAA,CAAE,KAAA,EAAO,QAAG,CAAC,CAAA,MAAA,EAAS,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,4BAAA,CAAyB,CAAA;AAClF,IAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,IAAI,IAAI,IAAI,CAAA;AAC5C,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,CAAA,CAAE,OAAA,EAAS,QAAG,CAAC,CAAA,MAAA,EAAS,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,CAAE,CAAA;AAC7D,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAEb,EAAA,MAAM,WAAA,GAAiC;AAAA;AAAA,IAErC,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,qBAAA;AAAA,MACN,QAAA,EAAU,CAAC,eAAA,EAAiB,cAAA,EAAgB,WAAW,CAAA;AAAA,MACvD,QAAA,EAAU,CAAC,eAAe,CAAA;AAAA,MAC1B,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,IACD,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,wBAAA;AAAA,MACN,QAAA,EAAU,CAAC,iBAAiB,CAAA;AAAA,MAC5B,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,IACD,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,qBAAA;AAAA,MACN,QAAA,EAAU,CAAC,uBAAA,EAAyB,0BAA0B,CAAA;AAAA,MAC9D,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,IACD,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,4BAAA;AAAA,MACN,QAAA,EAAU,CAAC,yBAAyB,CAAA;AAAA,MACpC,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA;AAAA,IAED,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,oBAAA;AAAA,MACN,QAAA,EAAU,CAAC,mBAAmB,CAAA;AAAA,MAC9B,QAAA,EAAU;AAAA,QACR,cAAA;AAAA,QACA,qBAAA;AAAA,QACA,YAAA;AAAA,QACA,WAAA;AAAA,QACA,iBAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,mBAAA;AAAA,QACA,qBAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,IACD,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,wBAAA;AAAA,MACN,QAAA,EAAU,CAAC,eAAA,EAAiB,cAAA,EAAgB,WAAW,CAAA;AAAA,MACvD,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,IACD,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,qBAAA;AAAA,MACN,UAAU,EAAC;AAAA;AAAA,MACX,QAAA,EAAU;AAAA,QACR,sBAAA;AAAA,QACA,4BAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA;AAAA,IAED,cAAA,CAAe;AAAA,MACb,IAAA,EAAM,oBAAA;AAAA,MACN,QAAA,EAAU,CAAC,uBAAA,EAAyB,sBAAsB,CAAA;AAAA,MAC1D,QAAA,EAAU,CAAC,0BAA0B,CAAA;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ;AAAA,GACH;AAEA,EAAA,KAAA,MAAW,OAAO,WAAA,EAAa;AAC7B,IAAA,KAAA,MAAW,QAAQ,MAAA,CAAO,GAAG,CAAA,EAAG,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACjD;AACA,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAGb,EAAA,MAAM,OAAA,GAAU,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,SAAS,CAAA,CAAE,MAAA;AAClE,EAAA,MAAM,OAAA,GAAU,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,SAAS,CAAA,CAAE,MAAA;AAClE,EAAA,MAAM,QAAA,GAAW,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,UAAU,CAAA,CAAE,MAAA;AACpE,EAAA,MAAM,aAAa,WAAA,CAChB,MAAA,CAAO,CAAC,CAAA,KAAM,EAAE,MAAA,KAAW,SAAS,CAAA,CACpC,MAAA,CAAO,CAAC,GAAA,EAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,WAAW,CAAC,CAAA;AAE1C,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,CAAE,MAAA,EAAQ,SAAS,CAAC,CAAA;AAC/B,EAAA,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,CAAE,OAAA,EAAS,YAAY,OAAO,CAAA,CAAE,CAAC,CAAA,MAAA,EAAM,CAAA,CAAE,QAAA,EAAU,YAAY,OAAO,CAAA,CAAE,CAAC,CAAA,MAAA,EAAM,CAAA,CAAE,OAAO,CAAA,UAAA,EAAa,QAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,CAAA;AAClI,EAAA,KAAA,CAAM,IAAA,CAAK,oBAAoB,CAAA,CAAE,SAAA,EAAW,OAAO,UAAU,CAAC,CAAC,CAAA,uBAAA,CAAyB,CAAA;AACxF,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAGb,EAAA,KAAA,MAAW,IAAA,IAAQ,aAAA,EAAc,EAAG,KAAA,CAAM,KAAK,IAAI,CAAA;AAGnD,EAAA,IAAI,YAAY,CAAA,EAAG;AACjB,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA;AAAA,QACE,QAAA;AAAA,QACA;AAAA;AAGF,KACF;AAAA,EACF,CAAA,MAAA,IAAW,aAAa,GAAA,EAAK;AAC3B,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA;AAAA,QACE,QAAA;AAAA,QACA;AAAA;AAEF,KACF;AAAA,EACF;AACA,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAEb,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,IAAI,IAAI,IAAI,CAAA;AAE5C,EAAA,OAAO,OAAA,KAAY,CAAA,IAAK,OAAA,KAAY,CAAA,GAAI,CAAA,GAAI,CAAA;AAC9C","file":"cli.cjs","sourcesContent":["import type { ToolSet } from \"ai\";\nimport { z } from \"zod\";\n\n/**\n * Convert a Vercel AI SDK ToolSet to MCP-compatible tool definitions.\n *\n * Vercel AI SDK's `tool()` shape:\n *   { description, inputSchema: ZodSchema, execute: (args) => result }\n *\n * MCP's tool shape:\n *   { name, description, inputSchema: JSONSchema }\n *   + a separate handler that takes (name, args) and returns the result\n */\n\nexport interface McpTool {\n  name: string;\n  description: string;\n  inputSchema: object; // JSON Schema\n  /**\n   * The tool's `sideEffects` classification, when the source AI-SDK tool object\n   * carries one (a string like \"moves money\" / \"irreversible\" / \"creates\n   * resource\" / \"network read\"). Threaded through so the art. 102 gate can pass\n   * it into `@ar-agents/core` `classifyTool` — restoring parity with the local\n   * `enforceRiskPolicy` path, where sideEffects is a POSITIVE risk signal that\n   * wins over a read-ish name. `undefined` when the tool ships none.\n   *\n   * NOTE: MCP's wire protocol has no `sideEffects` field; the MCP SDK strips\n   * unknown keys from ListTools responses, so this never leaks to the host. It\n   * exists purely for server-side classification.\n   */\n  sideEffects?: string | undefined;\n}\n\nexport interface McpAdapter {\n  /** All MCP tool definitions (for ListTools response). */\n  tools: McpTool[];\n  /** Handler for CallTool — looks up the original Vercel AI SDK tool and runs execute. */\n  call: (name: string, args: unknown) => Promise<unknown>;\n}\n\n/**\n * Bridge a Vercel AI SDK ToolSet → MCP tools + dispatcher.\n *\n * Throws on unknown tool name or if execute is missing (safety: every Vercel\n * AI SDK tool ships with `execute` for server-side flows, which is what\n * MCP needs).\n */\nexport function adaptToolSetToMcp(toolSet: ToolSet): McpAdapter {\n  const tools: McpTool[] = [];\n  const lookup = new Map<string, (args: unknown) => Promise<unknown>>();\n  // Keep each tool's Zod input schema so CallTool can RE-VALIDATE args server-side\n  // before dispatching to `execute`. The MCP host, not the AI SDK runtime, supplies\n  // the args here, so without this parse a malformed/hostile args object reaches the\n  // tool body unchecked (the JSON Schema on the wire is advisory metadata only).\n  const schemas = new Map<string, z.ZodType>();\n\n  for (const [name, tool] of Object.entries(toolSet)) {\n    if (!tool || typeof tool !== \"object\") continue;\n    const description =\n      \"description\" in tool && typeof tool.description === \"string\" ? tool.description : \"\";\n    const zodSchema =\n      \"inputSchema\" in tool && tool.inputSchema ? (tool.inputSchema as z.ZodType) : null;\n    const inputSchema = zodSchema\n      ? (z.toJSONSchema(zodSchema) as object)\n      : { type: \"object\", properties: {}, additionalProperties: false };\n    if (zodSchema) schemas.set(name, zodSchema);\n    // Carry the source tool's `sideEffects` (if it ships one) so the art. 102\n    // gate can use it as a POSITIVE risk signal — parity with enforceRiskPolicy.\n    const sideEffects =\n      \"sideEffects\" in tool && typeof tool.sideEffects === \"string\"\n        ? tool.sideEffects\n        : undefined;\n\n    tools.push({ name, description, inputSchema, sideEffects });\n\n    const exec = \"execute\" in tool ? (tool.execute as (args: unknown) => Promise<unknown>) : null;\n    if (!exec) {\n      // Server-side execution required for MCP; skip tools without execute.\n      continue;\n    }\n    lookup.set(name, exec);\n  }\n\n  return {\n    tools,\n    call: async (name, args) => {\n      const fn = lookup.get(name);\n      if (!fn) {\n        throw new Error(`Tool \"${name}\" not found or has no execute fn (MCP requires server-side tools).`);\n      }\n      // Server-side input validation (parity with the AI SDK runtime's own parse).\n      // A ZodError becomes a clean thrown Error, which server.ts turns into an MCP\n      // isError result — never an unvalidated call into a live adapter/upstream.\n      const schema = schemas.get(name);\n      if (schema) {\n        const parsed = schema.safeParse(args);\n        if (!parsed.success) {\n          throw new Error(`Invalid arguments for tool \"${name}\": ${parsed.error.message}`);\n        }\n        return fn(parsed.data);\n      }\n      return fn(args);\n    },\n  };\n}\n\n/**\n * Combine multiple Vercel AI SDK ToolSets into a single McpAdapter. Tool\n * name collisions throw at adapter-build time.\n */\nexport function combineToolSets(toolSets: Array<ToolSet | null>): McpAdapter {\n  const tools: McpTool[] = [];\n  const lookup = new Map<string, (args: unknown) => Promise<unknown>>();\n  const seen = new Set<string>();\n\n  for (const ts of toolSets) {\n    if (!ts) continue;\n    const adapter = adaptToolSetToMcp(ts);\n    for (const tool of adapter.tools) {\n      if (seen.has(tool.name)) {\n        throw new Error(\n          `Tool name collision: \"${tool.name}\" appears in multiple registered tool sets. Rename one or skip a registry.`,\n        );\n      }\n      seen.add(tool.name);\n      tools.push(tool);\n      // Bind this specific tool's call through the source adapter\n      const sourceAdapter = adapter;\n      const toolName = tool.name;\n      lookup.set(toolName, (args: unknown) => sourceAdapter.call(toolName, args));\n    }\n  }\n\n  return {\n    tools,\n    call: async (name, args) => {\n      const fn = lookup.get(name);\n      if (!fn) throw new Error(`Tool \"${name}\" not found in combined set.`);\n      return fn(args);\n    },\n  };\n}\n","// Guardrails for the public MCP server: spending caps + amount-aware approval,\n// and a kill-switch wired to the ar-agents registry good-standing state.\n//\n// These EXTEND the art. 102 gate (governance.ts). The art. 102 gate answers\n// \"does this act need a human?\"; guardrails answer \"how much, and is this entity\n// still allowed to operate at all?\".\n//\n// AMOUNT-AWARE APPROVAL (opt-in): with NO caps configured the fail-closed default\n// is unchanged (every money tool needs the approve hook). With caps configured, a\n// money tool whose amount is WITHIN the per-op + daily limits AUTO-APPROVES (so an\n// autonomous entity can make small payments without a human on each one); an\n// amount OVER the caps (or one we cannot read) falls back to the human approve\n// hook. This never LOOSENS a non-money act and never runs when caps are absent.\n\nimport { classifyTool } from \"@ar-agents/core\";\nimport type { HaltHook } from \"./governance\";\n\nexport interface SpendingCaps {\n  /** Max amount for a SINGLE money tool call. Undefined = no per-op cap. */\n  perOpMax?: number;\n  /** Max cumulative amount per UTC day. Undefined = no daily cap. */\n  dailyMax?: number;\n  /** Currency label (single-currency v1; used to bucket the daily tally). */\n  currency?: string;\n  /**\n   * Operator-supplied, TOOL-AWARE amount reader. REQUIRED for amount-based\n   * auto-approval: it must return the TRUE charge a money tool will move (e.g. for\n   * MercadoPago `create_payment` -> args.amount_ars; for a payment preference ->\n   * sum(items[].unit_price * quantity)). Return null whenever unsure.\n   *\n   * Without this, money tools NEVER auto-approve (they fall to the human approve\n   * hook). We deliberately do NOT guess the amount from generic arg keys: a caller\n   * can add a small decoy `amount` key (which the tool's schema strips before\n   * execution) to auto-approve a large real charge, and generic keys miss the real\n   * fields (amount_ars, items[].unit_price) entirely.\n   */\n  extractAmount?: (toolName: string, args: unknown) => number | null;\n}\n\n/** Pluggable running spend store (default: in-memory, per-process, resets by UTC day). */\nexport interface SpendingTally {\n  spentToday(currency: string): number;\n  add(currency: string, amount: number): void;\n}\n\n/** In-memory daily tally. Keyed by `${utcDay}:${currency}`; older days are inert. */\nexport function inMemoryTally(): SpendingTally {\n  const store = new Map<string, number>();\n  const key = (currency: string) => `${new Date().toISOString().slice(0, 10)}:${currency}`;\n  return {\n    spentToday: (currency) => store.get(key(currency)) ?? 0,\n    add: (currency, amount) => store.set(key(currency), (store.get(key(currency)) ?? 0) + amount),\n  };\n}\n\n// NOTE: there is deliberately NO built-in generic amount extractor. Reading a\n// money amount from generic arg keys is UNSAFE: (1) a caller can add a small decoy\n// `amount` key that the tool's Zod schema strips before execution, auto-approving\n// a large real charge; (2) generic keys miss the real fields the bundled tools use\n// (amount_ars, items[].unit_price); (3) first-match ordering can under-read.\n// Amount-based auto-approval therefore REQUIRES an operator-supplied, tool-aware\n// `caps.extractAmount`; absent that (or on ANY doubt) money tools go to the human.\n\nexport type SpendingDecision =\n  | { kind: \"not_applicable\" } // not a money tool, or no caps configured\n  | { kind: \"within_caps\"; amount: number } // auto-approve (recorded)\n  | { kind: \"over_caps\"; reason: string; amount: number | null }; // -> human approval\n\n/**\n * Decide the spending guardrail for one tool call. Records the spend on the tally\n * ONLY when it auto-approves (within caps). Non-money tools + absent caps return\n * `not_applicable` so the caller falls through to the art. 102 gate unchanged.\n */\nexport function decideSpending(\n  input: { toolName: string; description?: string | undefined; sideEffects?: string | undefined; args: unknown },\n  caps: SpendingCaps | undefined,\n  tally: SpendingTally,\n): SpendingDecision {\n  if (!caps) return { kind: \"not_applicable\" };\n  const level = classifyTool({ name: input.toolName, description: input.description, sideEffects: input.sideEffects });\n  if (level !== \"money\") return { kind: \"not_applicable\" };\n\n  const currency = caps.currency ?? \"ARS\";\n\n  // FAIL-SAFE 1: a caps object with NO numeric limit set must NEVER auto-approve\n  // (that would silently disable the fail-closed money gate). Require a human.\n  if (caps.perOpMax === undefined && caps.dailyMax === undefined) {\n    return { kind: \"over_caps\", reason: \"caps configured but no per-op/daily limit set; human approval required\", amount: null };\n  }\n\n  // FAIL-SAFE 2: amount-based auto-approval requires an operator-supplied,\n  // tool-aware reader. We NEVER guess the amount from generic keys. No reader -> human.\n  if (!caps.extractAmount) {\n    return { kind: \"over_caps\", reason: \"no caps.extractAmount configured; cannot confirm the amount safely, human approval required\", amount: null };\n  }\n\n  let amount: number | null;\n  try {\n    amount = caps.extractAmount(input.toolName, input.args);\n  } catch {\n    return { kind: \"over_caps\", reason: \"amount extractor threw; human approval required\", amount: null };\n  }\n\n  // FAIL-SAFE 3: any doubt about the amount -> human. Only a single, finite,\n  // non-negative number within the limits auto-approves.\n  if (amount === null || typeof amount !== \"number\" || !Number.isFinite(amount) || amount < 0) {\n    return {\n      kind: \"over_caps\",\n      reason: \"amount not confidently readable; human approval required\",\n      amount: typeof amount === \"number\" && Number.isFinite(amount) ? amount : null,\n    };\n  }\n  if (caps.perOpMax !== undefined && amount > caps.perOpMax) {\n    return { kind: \"over_caps\", reason: `amount ${amount} exceeds per-op cap ${caps.perOpMax} ${currency}`, amount };\n  }\n  if (caps.dailyMax !== undefined && tally.spentToday(currency) + amount > caps.dailyMax) {\n    return {\n      kind: \"over_caps\",\n      reason: `amount ${amount} would exceed the daily cap ${caps.dailyMax} ${currency} (spent ${tally.spentToday(currency)})`,\n      amount,\n    };\n  }\n  tally.add(currency, amount);\n  return { kind: \"within_caps\", amount };\n}\n\n/**\n * A kill-switch (HaltHook) wired to the ar-agents registry good-standing state.\n * Wire it as `createServer({ governance: { isHalted: goodStandingHalt({ entityId }) } })`\n * and the registry can REMOTELY halt this entity: once it is `suspended`/`revoked`\n * in the registry, every tool refuses.\n *\n * FAIL-CLOSED by default: an INDETERMINATE oracle answer (non-2xx — including the\n * 429 an attacker could induce by flooding the operator's egress past the oracle's\n * rate limit — a 5xx, a timeout, or a network error) HALTS. A kill-switch that\n * fails OPEN is bypassed precisely when it matters (a suspended entity would keep\n * authorizing money/fiscal/legal tools during an outage). Only a DEFINITIVE 2xx\n * answer whose state is neither suspended nor revoked lets tools proceed. An\n * operator who prefers availability over this safety can set\n * `haltOnUnreachable:false`, accepting that the kill-switch is unreliable then.\n */\nexport function goodStandingHalt(opts: {\n  entityId?: string;\n  entityUrl?: string;\n  oracleBase?: string;\n  haltOnUnreachable?: boolean;\n  timeoutMs?: number;\n}): HaltHook {\n  const base = (opts.oracleBase ?? \"https://ar-agents.ar\").replace(/\\/+$/, \"\");\n  const haltOnUnreachable = opts.haltOnUnreachable ?? true;\n  return async () => {\n    if (!opts.entityId && !opts.entityUrl) return false;\n    const q = opts.entityId\n      ? `id=${encodeURIComponent(opts.entityId)}`\n      : `url=${encodeURIComponent(opts.entityUrl!)}`;\n    try {\n      const r = await fetch(`${base}/api/registry/good-standing?${q}`, {\n        signal: AbortSignal.timeout(opts.timeoutMs ?? 4000),\n        headers: { \"user-agent\": \"ar-agents-mcp-killswitch\" },\n      });\n      // Non-2xx (429/5xx/…) is INDETERMINATE — we cannot confirm the entity is in\n      // good standing, so fail closed by default.\n      if (!r.ok) return haltOnUnreachable;\n      const d = (await r.json()) as {\n        body?: { goodStanding?: { state?: unknown } | null };\n      };\n      const gs = d.body?.goodStanding;\n      // A well-formed \"not in registry\" answer (found:false ⇒ goodStanding null) is\n      // NOT a sanction — proceed (the kill-switch gates suspensions, not registration).\n      if (gs == null) return false;\n      const state = (gs as { state?: unknown }).state;\n      const KNOWN = [\"active\", \"unverified\", \"suspended\", \"revoked\"];\n      // A present-but-unrecognized/missing state is a MALFORMED authentic-200 body:\n      // indeterminate → fail closed by default (do not proceed on a garbage verdict).\n      if (typeof state !== \"string\" || !KNOWN.includes(state)) return haltOnUnreachable;\n      return state === \"suspended\" || state === \"revoked\";\n    } catch {\n      // Timeout / network error / unparseable body → indeterminate → fail closed.\n      return haltOnUnreachable;\n    }\n  };\n}\n","// art. 102 governance gate for the public MCP server.\n//\n// Why this exists: the @ar-agents/mcp server is published to npm and launched by\n// `npx` inside any MCP host (Claude Desktop, Cursor, …). The host's model can\n// call ANY registered tool — including ones that move real money (Mercado Pago),\n// file real taxes (AFIP/ARCA) or constitute a real company (IGJ). The Sociedad\n// Automatizada regime (art. 102) makes a human administrator responsible and\n// bars delegating that supervision. So those acts MUST pass through a human.\n//\n// The @ar-agents/core risk manifest already decides WHICH tools are dangerous\n// (`classifyTool` + `levelRequiresApproval`). This module is the thin MCP-side\n// policy that turns that classification into a CallTool decision, default-ON,\n// fail-closed. It reuses core's exports verbatim — it never re-implements the\n// classifier.\n\nimport {\n  classifyTool,\n  levelRequiresApproval,\n  type RiskLevel,\n} from \"@ar-agents/core\";\nimport {\n  decideSpending,\n  inMemoryTally,\n  type SpendingCaps,\n  type SpendingTally,\n} from \"./guardrails\";\n\n/**\n * HITL approval hook. Called BEFORE an approval-level tool runs. Return true to\n * proceed; false (or throw) refuses. This is where the operator asks the human\n * administrator, consults a policy engine, or checks an approval token.\n */\nexport type ApproveHook = (\n  toolName: string,\n  args: unknown,\n) => Promise<boolean> | boolean;\n\n/**\n * Kill-switch hook. When it returns true, EVERY tool refuses (the society is\n * suspended), regardless of risk level. art. 102 supervision made operational.\n */\nexport type HaltHook = (\n  toolName: string,\n  args: unknown,\n) => Promise<boolean> | boolean;\n\n/**\n * Optional governance configuration passed to {@link createServer}. Every field\n * is optional: with NOTHING supplied the server is still default-ON and\n * fail-closed (see {@link resolveGovernance}), so a vanilla `npx` server refuses\n * money/fiscal/legal/irreversible/unknown tools.\n */\nexport interface GovernanceOptions {\n  /**\n   * Force enforce on/off, overriding the `AR_AGENTS_MCP_ENFORCE` env var and the\n   * default. `true` = gate on, `false` = ungated passthrough. Leave undefined to\n   * resolve from env, then default-ON.\n   */\n  enforce?: boolean;\n  /**\n   * HITL hook for approval-level tools. When enforce is on and no hook is\n   * supplied, the default decision is DENY (fail closed).\n   */\n  approve?: ApproveHook;\n  /**\n   * Kill-switch. Overrides the `AR_AGENTS_MCP_HALT` env var. When it resolves to\n   * a halt, ALL tools refuse with `society_suspended`. Default: no halt. See\n   * `goodStandingHalt` to wire this to the ar-agents registry state.\n   */\n  isHalted?: HaltHook;\n  /**\n   * Spending guardrail (opt-in). With caps set, a MONEY tool within the per-op +\n   * daily limits AUTO-APPROVES; over the caps it falls back to the approve hook.\n   * Absent = the unchanged fail-closed default (every money tool needs approval).\n   */\n  caps?: SpendingCaps;\n  /** Pluggable daily-spend tally (default: in-memory per-process). */\n  tally?: SpendingTally;\n}\n\n/** Fully-resolved governance state used at CallTool time. */\nexport interface ResolvedGovernance {\n  /** Whether the art. 102 risk gate is active. */\n  enforce: boolean;\n  /** The HITL approval hook, if the operator wired one. */\n  approve?: ApproveHook | undefined;\n  /** The kill-switch hook, if any (env or option). */\n  isHalted?: HaltHook | undefined;\n  /** True when enforce is on but NO approve hook was supplied (fail-closed deny). */\n  failClosed: boolean;\n  /** Spending caps, if configured (opt-in amount-aware approval). */\n  caps?: SpendingCaps | undefined;\n  /** Running daily-spend tally (always present; consulted only when caps are set). */\n  tally: SpendingTally;\n}\n\nfunction envFlagOn(raw: string | undefined): boolean | undefined {\n  if (raw === undefined) return undefined;\n  const v = raw.trim().toLowerCase();\n  if (v === \"\" ) return undefined;\n  if ([\"off\", \"0\", \"false\", \"no\", \"disable\", \"disabled\"].includes(v)) return false;\n  if ([\"on\", \"1\", \"true\", \"yes\", \"enable\", \"enabled\"].includes(v)) return true;\n  // Any other non-empty value: treat as \"on\" (fail safe — never silently off).\n  return true;\n}\n\n/**\n * Resolve the effective governance state. Resolution order, per the art. 102\n * invariant:\n *   enforce: explicit option  >  AR_AGENTS_MCP_ENFORCE env  >  default ON\n *   halt:    explicit isHalted >  AR_AGENTS_MCP_HALT=1 env   >  default no-halt\n *\n * Default-ON is the whole point: a self-hoster who sets nothing still gets the\n * gate. `AR_AGENTS_MCP_ENFORCE=off` is the documented opt-out.\n */\nexport function resolveGovernance(\n  opts: GovernanceOptions = {},\n  env: NodeJS.ProcessEnv = process.env,\n): ResolvedGovernance {\n  const enforce =\n    opts.enforce ?? envFlagOn(env.AR_AGENTS_MCP_ENFORCE) ?? true;\n\n  // Halt: an explicit hook wins; otherwise the env flag becomes a constant hook.\n  let isHalted: HaltHook | undefined = opts.isHalted;\n  if (!isHalted && envFlagOn(env.AR_AGENTS_MCP_HALT) === true) {\n    isHalted = () => true;\n  }\n\n  const failClosed = enforce && !opts.approve;\n\n  return {\n    enforce,\n    approve: opts.approve,\n    isHalted,\n    failClosed,\n    caps: opts.caps,\n    tally: opts.tally ?? inMemoryTally(),\n  };\n}\n\n/** A CallTool decision produced by {@link decideGovernance}. */\nexport type GovernanceDecision =\n  | { kind: \"allow\" }\n  | { kind: \"halted\"; message: string }\n  | { kind: \"deny\"; level: RiskLevel; reason: \"fail_closed\" | \"approve_refused\"; message: string };\n\n/**\n * Decide whether a tool call may proceed, given the resolved governance and the\n * tool's name + description (+ optional `sideEffects`). READ-level tools always\n * pass. The kill-switch is checked first (suspends EVERYTHING). Then the art.\n * 102 risk gate:\n *   - approval-level tool + no approve hook  -> DENY (fail closed)\n *   - approval-level tool + approve hook      -> ask it; refuse on false/throw\n *\n * Classification is delegated entirely to @ar-agents/core `classifyTool`. The\n * `sideEffects` arg is passed through so core's layer-3 (sideEffects: \"moves\n * money\"/\"irreversible\" -> approval-level) is LIVE here — parity with the local\n * `enforceRiskPolicy` path. Without it, a future read-ish-named tool carrying a\n * money/irreversible sideEffect would be downgraded to read and ALLOWED (a\n * latent fail-OPEN).\n */\nexport async function decideGovernance(\n  gov: ResolvedGovernance,\n  toolName: string,\n  description: string | undefined,\n  args: unknown,\n  sideEffects?: string | undefined,\n): Promise<GovernanceDecision> {\n  // Kill-switch is checked even when enforce is off: an operator who wired a\n  // halt (env or hook) means \"suspend the society\", full stop.\n  if (gov.isHalted) {\n    let halted = false;\n    try {\n      halted = await gov.isHalted(toolName, args);\n    } catch {\n      // Fail closed: a throwing kill-switch halts.\n      halted = true;\n    }\n    if (halted) {\n      return {\n        kind: \"halted\",\n        message:\n          `society_suspended: this autonomous company is halted (art. 102 kill-switch). ` +\n          `Tool \"${toolName}\" was refused. Clear AR_AGENTS_MCP_HALT or the isHalted hook to resume.`,\n      };\n    }\n  }\n\n  // Ungated passthrough when enforce is off.\n  if (!gov.enforce) return { kind: \"allow\" };\n\n  const level = classifyTool({ name: toolName, description, sideEffects });\n  if (!levelRequiresApproval(level)) {\n    // read / create -> always pass.\n    return { kind: \"allow\" };\n  }\n\n  // Spending guardrail (amount-aware, opt-in). Only affects MONEY tools when caps\n  // are configured: WITHIN caps -> auto-approve (spend recorded on the tally);\n  // OVER caps (or an unreadable amount) -> fall through to the human approve hook\n  // below. Non-money tools / no caps -> no effect (not_applicable).\n  const spend = decideSpending({ toolName, description, sideEffects, args }, gov.caps, gov.tally);\n  if (spend.kind === \"within_caps\") {\n    return { kind: \"allow\" };\n  }\n  const capNote = spend.kind === \"over_caps\" ? ` Spending guardrail: ${spend.reason}.` : \"\";\n\n  // Approval-level tool. Fail closed when no human-approval hook is wired.\n  if (!gov.approve) {\n    return {\n      kind: \"deny\",\n      level,\n      reason: \"fail_closed\",\n      message:\n        `Tool \"${toolName}\" needs human approval (art. 102): ${level} risk.${capNote} ` +\n        `This @ar-agents/mcp server enforces the art. 102 governance gate by default. ` +\n        `No approval hook is wired, so money/fiscal/legal/irreversible/unknown tools are refused. ` +\n        `Either wire an approve hook via createServer({ governance: { approve } }), ` +\n        `or set AR_AGENTS_MCP_ENFORCE=off to run ungated (NOT recommended for autonomous money/fiscal/legal acts).`,\n    };\n  }\n\n  let approved = false;\n  try {\n    approved = await gov.approve(toolName, args);\n  } catch (err) {\n    const why = err instanceof Error ? err.message : String(err);\n    return {\n      kind: \"deny\",\n      level,\n      reason: \"approve_refused\",\n      message: `Tool \"${toolName}\" refused by approval hook (art. 102, ${level} risk): ${why}`,\n    };\n  }\n  if (!approved) {\n    return {\n      kind: \"deny\",\n      level,\n      reason: \"approve_refused\",\n      message: `Tool \"${toolName}\" was not approved by the human administrator (art. 102, ${level} risk).`,\n    };\n  }\n  return { kind: \"allow\" };\n}\n\n/** One-line, stderr-friendly summary of the governance mode at boot. */\nexport function describeGovernance(gov: ResolvedGovernance): string {\n  if (!gov.enforce) {\n    const halt = gov.isHalted ? \" · HALT active (all tools refuse)\" : \"\";\n    return `governance      → enforce=OFF (ungated passthrough · AR_AGENTS_MCP_ENFORCE=off)${halt}`;\n  }\n  const hook = gov.approve ? \"approve hook wired\" : \"NO approve hook → fail-closed DENY\";\n  const halt = gov.isHalted ? \" · HALT active (all tools refuse)\" : \"\";\n  const caps = gov.caps\n    ? ` · caps(${gov.caps.perOpMax ?? \"none\"}/op, ${gov.caps.dailyMax ?? \"none\"}/day ${gov.caps.currency ?? \"ARS\"})`\n    : \"\";\n  return `governance      → enforce=ON (art. 102 gate · ${hook})${caps}${halt}`;\n}\n","import {\n  bankingTools,\n  BcraPublicApiAdapter,\n  type BcraDeudaAdapter,\n} from \"@ar-agents/banking\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/banking tool set.\n *\n * Pure-algorithm tools (validate_cbu, lookup_bank_by_code, list_banks,\n * list_psps) are ALWAYS available — no env vars required.\n *\n * The BCRA Central de Deudores tool is wired to `BcraPublicApiAdapter`\n * by default (BCRA's public REST API needs no auth). To opt out, set\n * `AR_AGENTS_BCRA_DISABLED=1` in env — the tool then returns\n * `{ available: false, error: \"<setup instructions>\" }`.\n */\nexport function buildBankingTools(): ToolSet {\n  const bcra = buildBcraAdapter();\n  return bankingTools(bcra ? { bcra } : {}) as ToolSet;\n}\n\nfunction buildBcraAdapter(): BcraDeudaAdapter | undefined {\n  if (process.env.AR_AGENTS_BCRA_DISABLED?.trim() === \"1\") return undefined;\n  const timeout = Number(process.env.BCRA_TIMEOUT_MS?.trim() ?? \"30000\");\n  const retries = Number(process.env.BCRA_MAX_RETRIES?.trim() ?? \"1\");\n  return new BcraPublicApiAdapter({\n    requestTimeoutMs: Number.isFinite(timeout) ? timeout : 30_000,\n    maxRetries: Number.isFinite(retries) ? retries : 1,\n  });\n}\n\nexport function describeBankingConfig(): string {\n  const bcraDisabled = process.env.AR_AGENTS_BCRA_DISABLED?.trim() === \"1\";\n  return bcraDisabled\n    ? \"validate_cbu, lookup_bank_by_code, list_banks, list_psps (BCRA disabled)\"\n    : \"validate_cbu, lookup_bank_by_code, list_banks, list_psps, lookup_credit_situation (BCRA public API)\";\n}\n","import {\n  boletinOficialTools,\n  InMemoryBoSubscriptionAdapter,\n  LiveBoFetcher,\n  UnconfiguredBoFetcher,\n  type BoFetcher,\n} from \"@ar-agents/boletin-oficial\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/boletin-oficial tool set.\n *\n * The Boletín Oficial is a public website with no auth — `LiveBoFetcher`\n * is enabled by default. Set `AR_AGENTS_BO_DISABLED=1` to opt out (the\n * tools then return `available: false` via `UnconfiguredBoFetcher`).\n *\n * Subscription storage defaults to in-memory (fine for single-process\n * stdio MCP). For shared subscriptions across instances, implement\n * `BoSubscriptionAdapter` against your store and wire directly via the\n * library API.\n */\nexport function buildBoletinOficialTools(): ToolSet {\n  const fetcher = buildFetcher();\n  return boletinOficialTools({\n    fetcher,\n    subscriptions: new InMemoryBoSubscriptionAdapter(),\n  }) as ToolSet;\n}\n\nfunction buildFetcher(): BoFetcher {\n  if (process.env.AR_AGENTS_BO_DISABLED?.trim() === \"1\") {\n    return new UnconfiguredBoFetcher();\n  }\n  return new LiveBoFetcher();\n}\n\nexport function describeBoletinOficialConfig(): string {\n  if (process.env.AR_AGENTS_BO_DISABLED?.trim() === \"1\") {\n    return \"disabled (AR_AGENTS_BO_DISABLED=1; subscriptions still callable but search returns empty)\";\n  }\n  return \"search + subscribe via LiveBoFetcher (boletinoficial.gob.ar)\";\n}\n","import { facturacionTools, WsfeClient } from \"@ar-agents/facturacion\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/facturacion tool set from environment variables.\n *\n * AFIP cert + key + CUIT required (same as @ar-agents/identity, but the\n * service must be authorized for `wsfe` in addition to whatever padron\n * service identity uses). When the env vars are missing, the tools return\n * `{ available: false, error: <setup instructions> }` instead of crashing —\n * MCP host can show the user what to set.\n *\n * # Env vars\n *\n * - `AFIP_CUIT_REPRESENTADO` (required)\n * - `AFIP_CERT_PEM` + `AFIP_KEY_PEM` (preferred for serverless / MCP) OR\n * - `AFIP_CERT_PATH` + `AFIP_KEY_PATH` (for local dev)\n * - `AFIP_ENV` — \"homo\" | \"prod\" (default \"prod\")\n * - `WSFE_DEFAULT_PTOVTA` — default punto de venta (optional, recommended for\n *   single-PtoVta SaaS so agents don't have to remember it)\n * - `WSFE_TIMEOUT_MS` — default 30000\n * - `WSFE_MAX_RETRIES` — default 1\n */\nexport function buildFacturacionTools(): ToolSet {\n  const wsfe = buildWsfeClient();\n  const defaultPtoVta = Number(\n    process.env.WSFE_DEFAULT_PTOVTA?.trim() ?? \"0\",\n  );\n  const opts: Parameters<typeof facturacionTools>[0] = {};\n  if (wsfe) opts.wsfe = wsfe;\n  if (Number.isFinite(defaultPtoVta) && defaultPtoVta > 0)\n    opts.defaultPtoVta = defaultPtoVta;\n  return facturacionTools(opts) as ToolSet;\n}\n\nfunction buildWsfeClient(): WsfeClient | undefined {\n  const cuit = process.env.AFIP_CUIT_REPRESENTADO?.trim();\n  if (!cuit) return undefined;\n  const env = (process.env.AFIP_ENV?.trim() ?? \"prod\") as \"homo\" | \"prod\";\n  const timeout = Number(process.env.WSFE_TIMEOUT_MS?.trim() ?? \"30000\");\n  const retries = Number(process.env.WSFE_MAX_RETRIES?.trim() ?? \"1\");\n  const certPem = process.env.AFIP_CERT_PEM;\n  const keyPem = process.env.AFIP_KEY_PEM;\n  if (certPem && keyPem) {\n    return new WsfeClient({\n      certPem,\n      keyPem,\n      cuit,\n      env,\n      requestTimeoutMs: Number.isFinite(timeout) ? timeout : 30_000,\n      maxRetries: Number.isFinite(retries) ? retries : 1,\n    });\n  }\n  const certPath = process.env.AFIP_CERT_PATH?.trim();\n  const keyPath = process.env.AFIP_KEY_PATH?.trim();\n  if (certPath && keyPath) {\n    return new WsfeClient({\n      certPath,\n      keyPath,\n      cuit,\n      env,\n      requestTimeoutMs: Number.isFinite(timeout) ? timeout : 30_000,\n      maxRetries: Number.isFinite(retries) ? retries : 1,\n    });\n  }\n  return undefined;\n}\n\nexport function describeFacturacionConfig(): string {\n  const cuit = process.env.AFIP_CUIT_REPRESENTADO?.trim();\n  if (!cuit) return \"no configurado (faltan AFIP_CUIT_REPRESENTADO + cert)\";\n  const certConfigured =\n    !!process.env.AFIP_CERT_PEM || !!process.env.AFIP_CERT_PATH;\n  if (!certConfigured) return \"no configurado (falta AFIP_CERT_PEM o AFIP_CERT_PATH)\";\n  const ptovta = process.env.WSFE_DEFAULT_PTOVTA?.trim();\n  return `WSFE habilitado (CUIT ${cuit}${ptovta ? `, PtoVta ${ptovta}` : \"\"})`;\n}\n","import { firmaDigitalTools } from \"@ar-agents/firma-digital\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/firma-digital tool set. All tools are pure\n * verification primitives — no env vars required. Always enabled, unless\n * `AR_AGENTS_FIRMA_DIGITAL_DISABLED=1`.\n */\nexport function buildFirmaDigitalTools(): ToolSet | null {\n  if (process.env.AR_AGENTS_FIRMA_DIGITAL_DISABLED?.trim() === \"1\") {\n    return null;\n  }\n  return firmaDigitalTools() as ToolSet;\n}\n\nexport function describeFirmaDigitalConfig(): string {\n  if (process.env.AR_AGENTS_FIRMA_DIGITAL_DISABLED?.trim() === \"1\") {\n    return \"disabled (AR_AGENTS_FIRMA_DIGITAL_DISABLED=1)\";\n  }\n  return \"X.509 + CMS verification (no I/O, pure primitives)\";\n}\n","import {\n  gdeTadTools,\n  UnconfiguredDomicilioAdapter,\n  UnconfiguredTramitesAdapter,\n} from \"@ar-agents/gde-tad\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/gde-tad tool set.\n *\n * As of 2026-05, the read-side adapters (Domicilio Electrónico inbox,\n * Mis Trámites) require per-organism integration that's still rolling\n * out. The MCP bundle wires the unconfigured shims by default — the\n * `validate_igj_inscription` tool (algorithm-only, no auth) works\n * regardless; the read tools return `available: false` with a setup\n * hint until you wire your own DomicilioAdapter / TramitesAdapter.\n *\n * Set `AR_AGENTS_GDE_TAD_DISABLED=1` to omit the entire surface from\n * the MCP server.\n */\nexport function buildGdeTadTools(): ToolSet {\n  if (process.env.AR_AGENTS_GDE_TAD_DISABLED?.trim() === \"1\") {\n    return {} as ToolSet;\n  }\n  return gdeTadTools({\n    domicilio: new UnconfiguredDomicilioAdapter(),\n    tramites: new UnconfiguredTramitesAdapter(),\n  }) as ToolSet;\n}\n\nexport function describeGdeTadConfig(): string {\n  if (process.env.AR_AGENTS_GDE_TAD_DISABLED?.trim() === \"1\") {\n    return \"disabled (AR_AGENTS_GDE_TAD_DISABLED=1)\";\n  }\n  return \"validate_igj_inscription (algorithm-only) wired; DEC inbox + Mis Trámites in unconfigured stub mode (RFC-001 § 3.4)\";\n}\n","import { identityTools, type AfipPadronAdapter } from \"@ar-agents/identity\";\nimport { WsaaWscdcAfipPadronAdapter } from \"@ar-agents/identity/wsaa\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/identity tool set from environment variables.\n * Returns null when AFIP env vars are missing (the algorithm-only `validate_cuit`\n * is always available; lookup_cuit_afip falls back to UnconfiguredAfipPadronAdapter).\n */\nexport function buildIdentityTools(): ToolSet {\n  const afip = buildAfipAdapter();\n  return identityTools(afip ? { afip } : {}) as ToolSet;\n}\n\nfunction buildAfipAdapter(): AfipPadronAdapter | undefined {\n  const cuit = process.env.AFIP_CUIT_REPRESENTADO?.trim();\n  if (!cuit) return undefined;\n  const env = (process.env.AFIP_ENV?.trim() ?? \"prod\") as \"homo\" | \"prod\";\n  const certPem = process.env.AFIP_CERT_PEM;\n  const keyPem = process.env.AFIP_KEY_PEM;\n  if (certPem && keyPem) {\n    return new WsaaWscdcAfipPadronAdapter({ certPem, keyPem, cuitRepresentado: cuit, env });\n  }\n  const certPath = process.env.AFIP_CERT_PATH?.trim();\n  const keyPath = process.env.AFIP_KEY_PATH?.trim();\n  if (certPath && keyPath) {\n    return new WsaaWscdcAfipPadronAdapter({ certPath, keyPath, cuitRepresentado: cuit, env });\n  }\n  return undefined;\n}\n\nexport function describeIdentityConfig(): string {\n  const cuit = process.env.AFIP_CUIT_REPRESENTADO?.trim();\n  if (!cuit) return \"validate_cuit only (no AFIP cert configured)\";\n  const certConfigured =\n    !!process.env.AFIP_CERT_PEM || !!process.env.AFIP_CERT_PATH;\n  return certConfigured\n    ? `validate_cuit + lookup_cuit_afip (AFIP cert configured for CUIT ${cuit})`\n    : `validate_cuit only (cert not configured)`;\n}\n","import { WhatsAppClient, whatsappTools } from \"@ar-agents/whatsapp\";\nimport type { ToolSet } from \"ai\";\n\nexport function buildWhatsAppTools(): ToolSet | null {\n  const accessToken = process.env.WA_ACCESS_TOKEN?.trim();\n  const phoneNumberId = process.env.WA_PHONE_NUMBER_ID?.trim();\n  if (!accessToken || !phoneNumberId) return null;\n  return whatsappTools(new WhatsAppClient({ accessToken, phoneNumberId })) as ToolSet;\n}\n\nexport function describeWhatsAppConfig(): string {\n  const accessToken = process.env.WA_ACCESS_TOKEN?.trim();\n  const phoneNumberId = process.env.WA_PHONE_NUMBER_ID?.trim();\n  if (!accessToken || !phoneNumberId)\n    return \"not configured (set WA_ACCESS_TOKEN + WA_PHONE_NUMBER_ID)\";\n  return `phone_number_id=${phoneNumberId.slice(0, 6)}…`;\n}\n\n/** Returns the configured client, used by identity-attest's WhatsAppOtpAdapter. */\nexport function getWhatsAppClient(): WhatsAppClient | null {\n  const accessToken = process.env.WA_ACCESS_TOKEN?.trim();\n  const phoneNumberId = process.env.WA_PHONE_NUMBER_ID?.trim();\n  if (!accessToken || !phoneNumberId) return null;\n  return new WhatsAppClient({ accessToken, phoneNumberId });\n}\n","import {\n  AttestationClient,\n  identityAttestTools,\n  WhatsAppOtpAdapter,\n  EmailMagicLinkAdapter,\n  type EmailSender,\n} from \"@ar-agents/identity-attest\";\nimport type { ToolSet } from \"ai\";\nimport { getWhatsAppClient } from \"./whatsapp\";\n\n/**\n * Build @ar-agents/identity-attest tools if ATTEST_SIGNING_SECRET is set\n * and at least one adapter can be configured (WhatsApp client present\n * OR email sender configured via SMTP_URL / RESEND_API_KEY).\n */\nexport function buildIdentityAttestTools(): ToolSet | null {\n  const signingSecret = process.env.ATTEST_SIGNING_SECRET?.trim();\n  if (!signingSecret) return null;\n\n  const adapters: Record<string, ConstructorParameters<typeof AttestationClient>[0][\"adapters\"][string]> = {};\n\n  // WhatsApp OTP — requires WhatsApp client\n  const wa = getWhatsAppClient();\n  if (wa) {\n    adapters[\"whatsapp_otp\"] = new WhatsAppOtpAdapter({\n      whatsappClient: wa,\n      businessName: process.env.BUSINESS_NAME?.trim() ?? \"this app\",\n    });\n  }\n\n  // Email magic-link — requires Resend API key + callback URL\n  const resendKey = process.env.RESEND_API_KEY?.trim();\n  const callbackUrl = process.env.ATTEST_CALLBACK_URL?.trim();\n  if (resendKey && callbackUrl) {\n    const fromEmail = process.env.ATTEST_FROM_EMAIL?.trim() ?? \"noreply@example.com\";\n    const sender: EmailSender = async ({ to, subject, html, text }) => {\n      const res = await fetch(\"https://api.resend.com/emails\", {\n        method: \"POST\",\n        headers: {\n          Authorization: `Bearer ${resendKey}`,\n          \"Content-Type\": \"application/json\",\n        },\n        body: JSON.stringify({ from: fromEmail, to, subject, html, text }),\n      });\n      if (!res.ok) {\n        throw new Error(`Resend send failed: ${res.status} ${await res.text()}`);\n      }\n    };\n    adapters[\"email_magic_link\"] = new EmailMagicLinkAdapter({\n      sender,\n      callbackBaseUrl: callbackUrl,\n      businessName: process.env.BUSINESS_NAME?.trim() ?? \"this app\",\n    });\n  }\n\n  if (Object.keys(adapters).length === 0) return null;\n\n  const client = new AttestationClient({ signingSecret, adapters });\n  return identityAttestTools(client) as ToolSet;\n}\n\nexport function describeIdentityAttestConfig(): string {\n  const signingSecret = process.env.ATTEST_SIGNING_SECRET?.trim();\n  if (!signingSecret) return \"not configured (set ATTEST_SIGNING_SECRET)\";\n  const adapters: string[] = [];\n  if (getWhatsAppClient()) adapters.push(\"whatsapp_otp\");\n  if (process.env.RESEND_API_KEY?.trim() && process.env.ATTEST_CALLBACK_URL?.trim())\n    adapters.push(\"email_magic_link\");\n  if (adapters.length === 0)\n    return \"configured but no adapters (set WhatsApp creds and/or RESEND_API_KEY + ATTEST_CALLBACK_URL)\";\n  return adapters.join(\", \");\n}\n","import { igjTools, LiveCkanFetcher, UnconfiguredIgjFetcher, type IgjFetcher } from \"@ar-agents/igj\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/igj tool set. The CKAN endpoint at\n * datos.jus.gob.ar requires no auth — `LiveCkanFetcher` is enabled by\n * default. Set `AR_AGENTS_IGJ_DISABLED=1` to opt out (tools then return\n * empty results via `UnconfiguredIgjFetcher`).\n */\nexport function buildIgjTools(): ToolSet {\n  const fetcher = buildFetcher();\n  return igjTools({ fetcher }) as ToolSet;\n}\n\nfunction buildFetcher(): IgjFetcher {\n  if (process.env.AR_AGENTS_IGJ_DISABLED?.trim() === \"1\") {\n    return new UnconfiguredIgjFetcher();\n  }\n  return new LiveCkanFetcher();\n}\n\nexport function describeIgjConfig(): string {\n  if (process.env.AR_AGENTS_IGJ_DISABLED?.trim() === \"1\") {\n    return \"disabled (AR_AGENTS_IGJ_DISABLED=1)\";\n  }\n  return \"search + fetch via datos.jus.gob.ar CKAN (sample dataset, not real-time)\";\n}\n","import { MeliClient, type AuthMode } from \"@ar-agents/mercadolibre\";\nimport { meliTools } from \"@ar-agents/mercadolibre/ai-sdk\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/mercadolibre tools for the MCP server.\n *\n * Auth resolution priority:\n *   1. MELI_ACCESS_TOKEN — direct bearer token (shortest path).\n *   2. MELI_APP_ID + MELI_APP_SECRET + MELI_USER_ID — managed OAuth (needs an\n *      OAuthTokenStore implementation, omitted here since the MCP host is\n *      stateless).\n *   3. None — `auth: { kind: \"none\" }` for public endpoints only.\n *\n * For day-to-day MCP usage, MELI_ACCESS_TOKEN is what users will set.\n *\n * MELI_SITE_ID + MELI_SELLER_ID are read at tool-build time so prompts like\n * \"list my unanswered questions\" don't need the user to repeat their id.\n */\nexport function buildMercadoLibreTools(): ToolSet | null {\n  const accessToken = process.env.MELI_ACCESS_TOKEN?.trim();\n  const sellerId = Number.parseInt(process.env.MELI_SELLER_ID ?? \"\", 10);\n  const siteId = (process.env.MELI_SITE_ID?.trim() ?? \"MLA\") as\n    | \"MLA\"\n    | \"MLB\"\n    | \"MLM\"\n    | \"MLC\"\n    | \"MCO\"\n    | \"MLU\"\n    | \"MPE\";\n\n  if (!accessToken) return null;\n  if (!Number.isFinite(sellerId)) return null;\n\n  const auth: AuthMode = { kind: \"bearer\", accessToken };\n  const client = new MeliClient({ auth });\n  return meliTools(client, { siteId, sellerId }) as ToolSet;\n}\n\nexport function describeMercadoLibreConfig(): string {\n  const accessToken = process.env.MELI_ACCESS_TOKEN?.trim();\n  const sellerId = process.env.MELI_SELLER_ID?.trim();\n  const siteId = process.env.MELI_SITE_ID?.trim() ?? \"MLA\";\n  if (!accessToken || !sellerId) {\n    return \"not configured (set MELI_ACCESS_TOKEN + MELI_SELLER_ID; optionally MELI_SITE_ID)\";\n  }\n  const tail = accessToken.slice(-6);\n  return `site=${siteId} seller=${sellerId} token=…${tail}`;\n}\n","import {\n  InMemoryStateAdapter,\n  MercadoPagoClient,\n  mercadoPagoTools,\n} from \"@ar-agents/mercadopago\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build @ar-agents/mercadopago tools if MP_ACCESS_TOKEN is set.\n * Returns null when not configured.\n */\nexport function buildMercadoPagoTools(): ToolSet | null {\n  const accessToken = process.env.MP_ACCESS_TOKEN?.trim();\n  if (!accessToken) return null;\n  const client = new MercadoPagoClient({ accessToken });\n  const backUrl = process.env.MP_BACK_URL?.trim() ?? \"https://example.com/done\";\n  return mercadoPagoTools(client, {\n    state: new InMemoryStateAdapter(),\n    backUrl,\n  }) as ToolSet;\n}\n\nexport function describeMercadoPagoConfig(): string {\n  const token = process.env.MP_ACCESS_TOKEN?.trim();\n  if (!token) return \"not configured (set MP_ACCESS_TOKEN)\";\n  const isTest = token.startsWith(\"TEST-\");\n  const backUrl = process.env.MP_BACK_URL?.trim();\n  return `${isTest ? \"TEST\" : \"PROD\"} mode${backUrl ? ` · back_url=${backUrl}` : \" · using default back_url\"}`;\n}\n","import {\n  InMemoryStateAdapter,\n  MiArgentinaClient,\n  miArgentinaTools,\n} from \"@ar-agents/mi-argentina\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/mi-argentina tool set from environment variables.\n *\n * The OAuth flow needs a registered client. Returns null when the env vars\n * are missing — server start logs the absence and the tool isn't exposed.\n *\n * Required:\n *   MI_ARGENTINA_CLIENT_ID\n *   MI_ARGENTINA_CLIENT_SECRET\n *   MI_ARGENTINA_REDIRECT_URI\n *\n * Optional:\n *   MI_ARGENTINA_PROVIDER (\"miargentina\" | \"miargentina_sandbox\", default \"miargentina\")\n *\n * State storage uses in-memory by default (fine for single-process stdio\n * MCP). For multi-instance, swap to VercelKVStateAdapter directly via the\n * library API.\n */\nexport function buildMiArgentinaTools(): ToolSet | null {\n  const clientId = process.env.MI_ARGENTINA_CLIENT_ID?.trim();\n  const clientSecret = process.env.MI_ARGENTINA_CLIENT_SECRET?.trim();\n  const redirectUri = process.env.MI_ARGENTINA_REDIRECT_URI?.trim();\n  if (!clientId || !clientSecret || !redirectUri) return null;\n\n  const provider =\n    (process.env.MI_ARGENTINA_PROVIDER?.trim() as\n      | \"miargentina\"\n      | \"miargentina_sandbox\"\n      | undefined) ?? \"miargentina\";\n\n  const client = new MiArgentinaClient({\n    config: { clientId, clientSecret, redirectUri, provider },\n    state: new InMemoryStateAdapter(),\n  });\n  return miArgentinaTools(client) as ToolSet;\n}\n\nexport function describeMiArgentinaConfig(): string {\n  const clientId = process.env.MI_ARGENTINA_CLIENT_ID?.trim();\n  if (!clientId)\n    return \"not configured (set MI_ARGENTINA_CLIENT_ID + _SECRET + _REDIRECT_URI)\";\n  const provider = process.env.MI_ARGENTINA_PROVIDER?.trim() ?? \"miargentina\";\n  return `client_id=${clientId.slice(0, 6)}… provider=${provider}`;\n}\n","import {\n  AndreaniAdapter,\n  CorreoAdapter,\n  OcaAdapter,\n  shippingTools,\n  type ShippingAdapter,\n} from \"@ar-agents/shipping\";\nimport type { ToolSet } from \"ai\";\n\n/**\n * Build the @ar-agents/shipping tool set from environment variables.\n *\n * Each carrier is wired independently — set the env vars for whichever\n * carriers you have credentials for. Without any credentials, the tools\n * return `{ available: false, error }` instead of crashing.\n *\n * # Env vars\n *\n * **Andreani** (full REST API):\n * - `ANDREANI_USERNAME` (required)\n * - `ANDREANI_PASSWORD` (required)\n * - `ANDREANI_CLIENT_NUMBER` (required)\n * - `ANDREANI_ENV` (\"homo\" | \"prod\", default \"prod\")\n *\n * **OCA** (Tarifador only in v0.1):\n * - `OCA_CUIT` (required)\n * - `OCA_OPERATIVA` (required)\n *\n * **Correo Argentino** (public REST, no creds needed):\n * - Auto-wired (no env vars).\n * - Set `AR_AGENTS_CORREO_DISABLED=1` to opt out.\n *\n * **Common**:\n * - `SHIPPING_DEFAULT_CARRIER` (\"andreani\" | \"oca\" | \"correo_argentino\")\n *   — when an agent doesn't specify a carrier, this is used.\n */\nexport function buildShippingTools(): ToolSet {\n  const adapters: Partial<Record<\"andreani\" | \"oca\" | \"correo_argentino\", ShippingAdapter>> = {};\n\n  const andreaniUser = process.env.ANDREANI_USERNAME?.trim();\n  const andreaniPass = process.env.ANDREANI_PASSWORD?.trim();\n  const andreaniClient = process.env.ANDREANI_CLIENT_NUMBER?.trim();\n  if (andreaniUser && andreaniPass && andreaniClient) {\n    adapters.andreani = new AndreaniAdapter({\n      username: andreaniUser,\n      password: andreaniPass,\n      clientNumber: andreaniClient,\n      env: (process.env.ANDREANI_ENV?.trim() ?? \"prod\") as \"homo\" | \"prod\",\n    });\n  }\n\n  const ocaCuit = process.env.OCA_CUIT?.trim();\n  const ocaOperativa = process.env.OCA_OPERATIVA?.trim();\n  if (ocaCuit && ocaOperativa) {\n    adapters.oca = new OcaAdapter({ cuit: ocaCuit, operativa: ocaOperativa });\n  }\n\n  if (process.env.AR_AGENTS_CORREO_DISABLED?.trim() !== \"1\") {\n    adapters.correo_argentino = new CorreoAdapter();\n  }\n\n  const defaultCarrier = process.env.SHIPPING_DEFAULT_CARRIER?.trim() as\n    | \"andreani\"\n    | \"oca\"\n    | \"correo_argentino\"\n    | undefined;\n\n  return shippingTools({\n    adapters,\n    ...(defaultCarrier ? { defaultCarrier } : {}),\n  }) as ToolSet;\n}\n\nexport function describeShippingConfig(): string {\n  const enabled: string[] = [];\n  if (process.env.ANDREANI_USERNAME?.trim()) enabled.push(\"andreani\");\n  if (process.env.OCA_CUIT?.trim()) enabled.push(\"oca\");\n  if (process.env.AR_AGENTS_CORREO_DISABLED?.trim() !== \"1\") enabled.push(\"correo_argentino\");\n  if (enabled.length === 0) return \"no carriers configurados\";\n  return `carriers activos: ${enabled.join(\", \")}`;\n}\n","/**\n * `ar-agents-mcp doctor` — diagnoses the MCP host bundle.\n *\n * The bundle exposes any of the underlying packages over MCP, deciding\n * which to enable based on env vars. The doctor's job is to make that\n * decision visible: which packages are wired, which tools each one\n * contributes, which env vars are missing for the rest — AND, in the\n * GOVERNANCE section, the art. 102 gate's exact blast radius: every exposed\n * tool, its resolved risk level, and whether it is GATED under the current\n * config. So an operator sees what default-ON refuses BEFORE/after upgrading.\n *\n * Treat this as the canonical \"is my MCP host configured for AR ops\"\n * checklist. Useful in Claude Desktop / Cursor / Continue configs.\n */\n\nimport { classifyTool, levelRequiresApproval } from \"@ar-agents/core\";\nimport { combineToolSets, type McpTool } from \"./adapter\";\nimport { describeGovernance, resolveGovernance } from \"./governance\";\nimport { buildBankingTools } from \"./registries/banking\";\nimport { buildBoletinOficialTools } from \"./registries/boletin-oficial\";\nimport { buildFacturacionTools } from \"./registries/facturacion\";\nimport { buildFirmaDigitalTools } from \"./registries/firma-digital\";\nimport { buildGdeTadTools } from \"./registries/gde-tad\";\nimport { buildIdentityTools } from \"./registries/identity\";\nimport { buildIdentityAttestTools } from \"./registries/identity-attest\";\nimport { buildIgjTools } from \"./registries/igj\";\nimport { buildMercadoLibreTools } from \"./registries/mercadolibre\";\nimport { buildMercadoPagoTools } from \"./registries/mercadopago\";\nimport { buildMiArgentinaTools } from \"./registries/mi-argentina\";\nimport { buildShippingTools } from \"./registries/shipping\";\nimport { buildWhatsAppTools } from \"./registries/whatsapp\";\n\nconst C = {\n  reset: \"\\x1b[0m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  cyan: \"\\x1b[36m\",\n  magenta: \"\\x1b[35m\",\n  bold: \"\\x1b[1m\",\n};\nconst NO_COLOR = process.env.NO_COLOR != null || !process.stdout.isTTY;\nconst c = (col: keyof typeof C, s: string) =>\n  NO_COLOR ? s : `${C[col]}${s}${C.reset}`;\n\ntype Status = \"enabled\" | \"partial\" | \"disabled\";\n\ntype SubpackageState = {\n  name: string;\n  status: Status;\n  toolCount: number;\n  required: string[]; // env vars that must be set together\n  missing: string[]; // missing env vars (subset of required)\n  alwaysOn: string[]; // tools that work regardless of config\n};\n\nfunction evalSubpackage(input: {\n  name: string;\n  required: string[];\n  alwaysOn?: string[];\n  toolCount: number;\n}): SubpackageState {\n  const missing = input.required.filter((e) => !process.env[e]?.trim());\n  const allMissing = missing.length === input.required.length;\n  const someMissing = missing.length > 0 && !allMissing;\n  const status: Status = allMissing ? \"disabled\" : someMissing ? \"partial\" : \"enabled\";\n  return {\n    name: input.name,\n    required: input.required,\n    missing,\n    alwaysOn: input.alwaysOn ?? [],\n    toolCount: input.toolCount,\n    status,\n  };\n}\n\nfunction fmtSub(s: SubpackageState): string[] {\n  const icon =\n    s.status === \"enabled\"\n      ? c(\"green\", \"●\")\n      : s.status === \"partial\"\n        ? c(\"yellow\", \"◐\")\n        : c(\"dim\", \"○\");\n  const label =\n    s.status === \"enabled\"\n      ? c(\"green\", \"enabled\")\n      : s.status === \"partial\"\n        ? c(\"yellow\", `partial — missing ${s.missing.join(\", \")}`)\n        : c(\"dim\", \"disabled (set env vars to enable)\");\n  const lines = [`${icon} ${c(\"bold\", s.name)} — ${label}`];\n  if (s.status === \"disabled\" && s.alwaysOn.length > 0) {\n    lines.push(\n      c(\"dim\", `    always-on tools: ${s.alwaysOn.join(\", \")}`),\n    );\n  }\n  if (s.status === \"disabled\") {\n    lines.push(c(\"dim\", `    requires: ${s.required.join(\", \")}`));\n  }\n  return lines;\n}\n\n/**\n * Build the exact tool surface the real server registers (same registries, same\n * order as {@link createServer}). Mirrors server.ts so the doctor's GOVERNANCE\n * section reflects what would actually be exposed under the current env.\n */\nfunction buildExposedTools(): McpTool[] {\n  return combineToolSets([\n    buildIdentityTools(),\n    buildMiArgentinaTools(),\n    buildMercadoPagoTools(),\n    buildMercadoLibreTools(),\n    buildWhatsAppTools(),\n    buildIdentityAttestTools(),\n    buildBankingTools(),\n    buildFacturacionTools(),\n    buildShippingTools(),\n    buildBoletinOficialTools(),\n    buildIgjTools(),\n    buildFirmaDigitalTools(),\n    buildGdeTadTools(),\n  ]).tools;\n}\n\nconst LEVEL_COLOR: Record<string, keyof typeof C> = {\n  read: \"green\",\n  create: \"cyan\",\n  money: \"red\",\n  fiscal: \"red\",\n  legal: \"red\",\n  irreversible: \"red\",\n  unknown: \"yellow\",\n};\n\n/**\n * GOVERNANCE section: the art. 102 gate's blast radius under the current config.\n * Lists every exposed tool with its resolved risk level and whether it is GATED,\n * then the effective enforce / approve-hook / halt state. The classification is\n * the SAME path the running server uses (name + description + sideEffects ->\n * @ar-agents/core classifyTool), so what you read here is what the gate does.\n */\nfunction fmtGovernance(): string[] {\n  const lines: string[] = [];\n  const gov = resolveGovernance(); // reads env: enforce / halt\n  lines.push(c(\"bold\", \"Governance (art. 102 gate)\"));\n  lines.push(c(\"dim\", `  ${describeGovernance(gov)}`));\n\n  // Building the surface can throw (e.g. a tool-name collision when two\n  // registries both expose `get_order`). Degrade to a clear note rather than\n  // crashing the whole doctor.\n  let exposed: McpTool[];\n  try {\n    exposed = buildExposedTools();\n  } catch (err) {\n    const why = err instanceof Error ? err.message : String(err);\n    lines.push(c(\"red\", `  could not enumerate tools: ${why}`));\n    lines.push(\"\");\n    return lines;\n  }\n\n  const tools = exposed\n    .map((t) => {\n      const level = classifyTool({\n        name: t.name,\n        description: t.description,\n        sideEffects: t.sideEffects,\n      });\n      return { name: t.name, level, gated: levelRequiresApproval(level) };\n    })\n    .sort(\n      (a, b) =>\n        Number(b.gated) - Number(a.gated) || a.name.localeCompare(b.name),\n    );\n\n  const gatedCount = tools.filter((t) => t.gated).length;\n  // What the gate DOES to a gated tool right now, given enforce/halt/hook.\n  const haltOn = gov.isHalted != null;\n  const fate = haltOn\n    ? \"ALL tools refuse (society_suspended)\"\n    : !gov.enforce\n      ? \"gate OFF — gated tools run ungated (passthrough)\"\n      : gov.approve\n        ? \"gated tools defer to your approve hook\"\n        : \"gated tools fail-closed DENY (no approve hook)\";\n  lines.push(\n    `  ${c(\"magenta\", String(gatedCount))} of ${c(\"magenta\", String(tools.length))} exposed tools are GATED → ${c(\"bold\", fate)}`,\n  );\n  lines.push(\"\");\n\n  for (const t of tools) {\n    const col = LEVEL_COLOR[t.level] ?? \"yellow\";\n    // Pad the PLAIN label first, then colorize, so columns align with color on.\n    const markLabel = t.gated\n      ? haltOn\n        ? \"HALTED\"\n        : !gov.enforce\n          ? \"ungated\"\n          : \"GATED\"\n      : \"allowed\";\n    const markCol: keyof typeof C = t.gated\n      ? haltOn\n        ? \"red\"\n        : !gov.enforce\n          ? \"dim\"\n          : \"red\"\n      : \"green\";\n    const mark = c(markCol, markLabel.padEnd(7));\n    lines.push(`  ${mark} ${c(col, t.level.padEnd(12))} ${t.name}`);\n  }\n  lines.push(\"\");\n  if (gatedCount > 0 && gov.enforce && !gov.approve && !haltOn) {\n    lines.push(\n      c(\n        \"yellow\",\n        \"  NOTE: default-ON fail-closed. ANY tool whose name is not a recognized \" +\n          \"read verb classifies as `unknown` and is GATED — this currently includes \" +\n          \"some registry/Boletín/firma/AFIP-catalog READ tools (e.g. igj_get_entity, \" +\n          \"bo_search, firma_inspect_cert, obtener_alicuotas_iva). To let them run: wire \" +\n          \"an approve hook via createServer({ governance: { approve } }), or set \" +\n          \"AR_AGENTS_MCP_ENFORCE=off (ungated — NOT recommended for money/fiscal/legal acts).\",\n      ),\n    );\n    lines.push(\"\");\n  }\n  return lines;\n}\n\nexport async function runDoctor(): Promise<number> {\n  const lines: string[] = [];\n  lines.push(\"\");\n  lines.push(c(\"bold\", `${c(\"cyan\", \"@ar-agents/mcp\")} doctor`));\n  lines.push(c(\"dim\", \"  which @ar-agents/* subpackages your MCP host has wired\"));\n  lines.push(\"\");\n\n  const major = Number(process.versions.node.split(\".\")[0]);\n  if (major < 20) {\n    lines.push(`${c(\"red\", \"✗\")} Node ${process.versions.node} too old — requires 20+`);\n    process.stdout.write(lines.join(\"\\n\") + \"\\n\");\n    return 1;\n  }\n  lines.push(`${c(\"green\", \"✓\")} Node ${process.versions.node}`);\n  lines.push(\"\");\n\n  const subpackages: SubpackageState[] = [\n    // Identity is always-on for `validate_cuit` (algorithm).\n    evalSubpackage({\n      name: \"@ar-agents/identity\",\n      required: [\"AFIP_CERT_PEM\", \"AFIP_KEY_PEM\", \"AFIP_CUIT\"],\n      alwaysOn: [\"validate_cuit\"],\n      toolCount: 2,\n    }),\n    evalSubpackage({\n      name: \"@ar-agents/mercadopago\",\n      required: [\"MP_ACCESS_TOKEN\"],\n      toolCount: 89,\n    }),\n    evalSubpackage({\n      name: \"@ar-agents/whatsapp\",\n      required: [\"WHATSAPP_ACCESS_TOKEN\", \"WHATSAPP_PHONE_NUMBER_ID\"],\n      toolCount: 6,\n    }),\n    evalSubpackage({\n      name: \"@ar-agents/identity-attest\",\n      required: [\"ATTESTATION_HMAC_SECRET\"],\n      toolCount: 5,\n    }),\n    // Banking is always-on for the 4 algorithm-only + 6 BCRA-public tools.\n    evalSubpackage({\n      name: \"@ar-agents/banking\",\n      required: [\"BCRA_DEUDORES_URL\"],\n      alwaysOn: [\n        \"validate_cbu\",\n        \"lookup_bank_by_code\",\n        \"list_banks\",\n        \"list_psps\",\n        \"get_usd_oficial\",\n        \"get_cer\",\n        \"get_uva\",\n        \"get_reservas_bcra\",\n        \"list_bcra_variables\",\n        \"get_bcra_variable\",\n      ],\n      toolCount: 11,\n    }),\n    evalSubpackage({\n      name: \"@ar-agents/facturacion\",\n      required: [\"AFIP_CERT_PEM\", \"AFIP_KEY_PEM\", \"AFIP_CUIT\"],\n      toolCount: 10,\n    }),\n    evalSubpackage({\n      name: \"@ar-agents/shipping\",\n      required: [], // no required vars; carriers are individually optional\n      alwaysOn: [\n        \"cotizar_envio (mock)\",\n        \"cotizar_envio_todos (mock)\",\n        \"trackear_envio (mock)\",\n      ],\n      toolCount: 6,\n    }),\n    // gde-tad: validate_igj_inscription is always-on (algorithm).\n    evalSubpackage({\n      name: \"@ar-agents/gde-tad\",\n      required: [\"TAD_DOMICILIO_ADAPTER\", \"TAD_TRAMITES_ADAPTER\"],\n      alwaysOn: [\"validate_igj_inscription\"],\n      toolCount: 4,\n    }),\n  ];\n\n  for (const sub of subpackages) {\n    for (const line of fmtSub(sub)) lines.push(line);\n  }\n  lines.push(\"\");\n\n  // Summary\n  const enabled = subpackages.filter((s) => s.status === \"enabled\").length;\n  const partial = subpackages.filter((s) => s.status === \"partial\").length;\n  const disabled = subpackages.filter((s) => s.status === \"disabled\").length;\n  const totalTools = subpackages\n    .filter((s) => s.status === \"enabled\")\n    .reduce((acc, s) => acc + s.toolCount, 0);\n\n  lines.push(c(\"bold\", \"Summary\"));\n  lines.push(`  ${c(\"green\", `enabled: ${enabled}`)} · ${c(\"yellow\", `partial: ${partial}`)} · ${c(\"dim\", `disabled: ${disabled}`)}`);\n  lines.push(`  exposed tools: ${c(\"magenta\", String(totalTools))}/133 (with current env)`);\n  lines.push(\"\");\n\n  // GOVERNANCE: the art. 102 gate's exact blast radius under the current config.\n  for (const line of fmtGovernance()) lines.push(line);\n\n  // Suggest the canonical Claude Desktop / Cursor config snippet\n  if (enabled === 0) {\n    lines.push(\n      c(\n        \"yellow\",\n        \"No subpackage is enabled. Set MP_ACCESS_TOKEN, AFIP_CERT_PEM/KEY/CUIT, \" +\n          \"WHATSAPP_ACCESS_TOKEN/PHONE_NUMBER_ID etc. in your MCP host config. \" +\n          \"See the README for the canonical Claude Desktop snippet.\",\n      ),\n    );\n  } else if (totalTools < 100) {\n    lines.push(\n      c(\n        \"yellow\",\n        \"Partial coverage. The full @ar-agents/* surface is 133 tools — wire the \" +\n          \"remaining subpackages for an end-to-end AR ops layer.\",\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  process.stdout.write(lines.join(\"\\n\") + \"\\n\");\n  // Exit 0 if at least one subpackage is enabled — disabled is informational, not a failure.\n  return enabled === 0 && partial === 0 ? 0 : 0;\n}\n"]}