@0xmaxma/claude-gateway 1.8.7 → 1.8.8

package/dist/connectors/resolve.js

@@ -0,0 +1,176 @@
+"use strict";
+/**
+ * Connector resolution — the single source of truth shared by the session spawner
+ * and the HTTP API.
+ *
+ * resolveEnabledConnectors(): for the injection point in SessionProcess.writeMcpConfig.
+ * listConnectorStatus(): for GET /v1/connectors.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEnabledConnectors = resolveEnabledConnectors;
+exports.refreshStatusOf = refreshStatusOf;
+exports.listConnectorStatus = listConnectorStatus;
+const token_env_1 = require("./token-env");
+const custom_1 = require("./custom");
+const oauth_refresh_sweep_1 = require("./oauth-refresh-sweep");
+/**
+ * Build the mcpServers entries for every connector that is (a) in customConnectors,
+ * (b) enabled for this agent, and (c) connected (every `{placeholder}` secret it
+ * declares is present). Returns a map keyed by connector id, ready to merge into
+ * mcp-config.json.
+ *
+ * Enablement defaults to opt-OUT: a globally-connected connector is available to
+ * every agent the moment it's connected — an agent only misses it if explicitly
+ * disabled (`{enabled: false}`). Connecting a connector at all is the security gate;
+ * per-agent is a refinement, not a second required step.
+ *
+ * `defaultEnabled: false` (gateway.connectorsDefaultEnabled in config.json) flips
+ * that to opt-IN. The default suits the common single-operator install, but a
+ * gateway hosting agents for several different people is a different situation:
+ * there, connecting one connector hands its credential to every agent on the box,
+ * including agents whose chat users are not the person who connected it. Opting in
+ * per agent is the safer posture for that deployment, so it is available — as a
+ * deliberate choice, not a silent change of meaning for existing installs.
+ */
+function resolveEnabledConnectors(agentConfig, customConnectors = {}, defaultEnabled = true) {
+    const enabled = agentConfig.connectors ?? {};
+    const tokenEnv = (0, token_env_1.readTokenEnv)();
+    // Null-prototype for the reason the `secrets` map below is one, one level up:
+    // `restartSessionsUsingConnector` asks this map what a single id resolves to
+    // (`resolved[connectorId]`), and a connector id may legitimately be `constructor`
+    // or `valueOf`. On a plain object that lookup answers with an inherited Function
+    // for an id that resolves to nothing — a "changed" fingerprint that restarts every
+    // session on the box, forever, since it never matches what a spawn recorded.
+    const out = Object.create(null);
+    const isEnabled = (id) => enabled[id]?.enabled ?? defaultEnabled;
+    for (const [id, entry] of Object.entries(customConnectors)) {
+        if (!isEnabled(id))
+            continue; // opted out (or not opted in)
+        try {
+            // Null-prototype for the same reason token-env.ts's parse() uses one: the
+            // names come from a pasted config, and PLACEHOLDER_RE happily matches
+            // `{constructor}` or `{toString}`.
+            const secrets = Object.create(null);
+            let allPresent = true;
+            for (const name of entry.secretNames) {
+                const value = tokenEnv[(0, custom_1.customSecretKey)(id, name)];
+                if (!value) {
+                    allPresent = false;
+                    break;
+                }
+                secrets[name] = value;
+            }
+            if (!allPresent)
+                continue; // enabled but not fully connected — skip
+            out[id] = (0, custom_1.substitutePlaceholders)(entry.config, secrets);
+        }
+        catch (err) {
+            // A malformed pasted config (see CustomConnectorEntry's doc comment:
+            // admin-trusted, not code-reviewed) must not take down every other
+            // connector's resolution — or worse, the whole session spawn — for
+            // every user of this agent. Skip just this one.
+            console.error(`resolveEnabledConnectors: connector=${id} resolve failed: ${err.message}`);
+        }
+    }
+    return out;
+}
+/**
+ * The `refresh` block of ConnectorStatus, or undefined when the connector's
+ * background refresh is healthy (or was never failing). Reads the sweep's own
+ * bookkeeping out of an already-loaded token env rather than re-reading the file
+ * per connector.
+ *
+ * Both failure streaks are reported, not just the transient one. A connector two
+ * refusals into the three-strike permanent count is one tick away from having its
+ * credentials deleted — the most actionable state this block can describe, and the
+ * one a caller most needs to see before it happens.
+ *
+ * `unrefreshable` covers the cases with no streak at all. A provider that issues no
+ * refresh_token (an AS advertising scopes that don't include `offline_access` — see
+ * the scope fallback in mcp-oauth.ts's `resolveScope`) leaves the sweep nothing to
+ * refresh with, so it skips the connector on every tick and never records a failure.
+ * Without this flag that connector keeps a green checkmark forever over an
+ * access_token that expired an hour in, which is the exact state the sweep's module
+ * comment says it exists to prevent.
+ */
+function refreshStatusOf(id, tokenEnv) {
+    // A hand-edited or truncated mcp-token.env can hold anything, and the sweep floors
+    // the very same values before deciding whether to delete credentials — `parseCounter`
+    // is that floor, shared, so display and decision cannot drift apart.
+    const consecutiveFailures = (0, token_env_1.parseCounter)(tokenEnv[(0, oauth_refresh_sweep_1.refreshTransientCountSecretKey)(id)]);
+    const permanentFailures = (0, token_env_1.parseCounter)(tokenEnv[(0, oauth_refresh_sweep_1.refreshFailCountSecretKey)(id)]);
+    // Derived, not stored: the sweep never writes a marker for this, and shouldn't —
+    // it is a fact about what is already in the file, and computing it here means it
+    // cannot drift out of sync with the tokens it describes.
+    const expiresAt = (0, token_env_1.parseCounter)(tokenEnv[(0, oauth_refresh_sweep_1.expiresAtSecretKey)(id)]);
+    // Three states, one flag: there is a token here, nothing can renew it, and it is
+    // not currently known-good.
+    //
+    // `expiresAt === 0` is the third one, and it is not the "not signed in yet" case —
+    // that has no access_token at all, and the row already reports `connected: false`
+    // without help from here. A 'gateway' connector that HAS an access_token and no
+    // recorded expiry is one whose token this gateway never minted: every path that
+    // writes one writes an expiry alongside it, defaulting to an hour when the AS
+    // omits `expires_in` (see the callback and the sweep). The way to get here is to
+    // paste an access_token into an `oauth: true` add — now rejected at that route,
+    // but rows already in this state predate the check and are exactly the ones that
+    // need saying out loud, since they will simply stop working at a moment nothing
+    // recorded.
+    const unrefreshable = !!tokenEnv[(0, custom_1.customSecretKey)(id, 'access_token')] &&
+        !tokenEnv[(0, oauth_refresh_sweep_1.refreshTokenSecretKey)(id)] &&
+        (expiresAt === 0 || expiresAt <= Date.now());
+    if (!consecutiveFailures && !permanentFailures && !unrefreshable)
+        return undefined;
+    return {
+        consecutiveFailures,
+        permanentFailures,
+        nextAttemptAt: (0, token_env_1.parseCounter)(tokenEnv[(0, oauth_refresh_sweep_1.refreshBackoffUntilSecretKey)(id)]),
+        ...(unrefreshable ? { unrefreshable: true } : {}),
+    };
+}
+/** Connector list + connected state for the API. `connected` reflects secret presence. */
+function listConnectorStatus(customConnectors = {}) {
+    const tokenEnv = (0, token_env_1.readTokenEnv)();
+    return Object.entries(customConnectors).map(([id, entry]) => {
+        try {
+            const connected = entry.secretNames.every((name) => !!tokenEnv[(0, custom_1.customSecretKey)(id, name)]);
+            // Omitted rather than set to undefined when refresh is healthy: the single-status
+            // route omits it too, and a caller doing `'refresh' in status` should get the same
+            // answer from both.
+            //
+            // 'gateway' only. An 'external' entry is refreshed by the control plane that
+            // pushed it — this gateway holds no refresh_token for it, so the sweep skips it
+            // and every counter here would read a constant 0.
+            const refresh = entry.credentialOwner === 'gateway' ? refreshStatusOf(id, tokenEnv) : undefined;
+            return {
+                id,
+                label: entry.label,
+                description: entry.description,
+                credentialOwner: entry.credentialOwner,
+                connected,
+                repoUrl: entry.sourceUrl,
+                ...(refresh ? { refresh } : {}),
+            };
+        }
+        catch (err) {
+            // Same per-entry isolation resolveEnabledConnectors uses above, and for a
+            // sharper reason: `entry.secretNames` is typed but never validated at read
+            // time, so one hand-edited (or older-build) config.json entry missing it
+            // throws here — inside an `async` Express 4 handler, which does not catch
+            // rejections. The request then never gets a response at all and the whole
+            // connector panel hangs, rather than one row degrading.
+            console.error(`listConnectorStatus: connector=${id} status failed: ${err.message}`);
+            return {
+                id,
+                label: typeof entry?.label === 'string' ? entry.label : id,
+                description: 'This connector’s configuration could not be read.',
+                // Not the entry's own value, even if it has a readable one: this row
+                // describes a connector nothing can be done with, and every other owner
+                // would invite a caller to offer a connect action that cannot work.
+                credentialOwner: 'none',
+                connected: false,
+            };
+        }
+    });
+}
+//# sourceMappingURL=resolve.js.map

package/dist/connectors/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/connectors/resolve.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAiCH,4DA8CC;AAqBD,0CAqCC;AAGD,kDA+CC;AAvLD,2CAAyD;AACzD,qCAAmE;AACnE,+DAM+B;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,wBAAwB,CACtC,WAA4C,EAC5C,mBAAyD,EAAE,EAC3D,cAAc,GAAG,IAAI;IAErB,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAA,wBAAY,GAAE,CAAC;IAChC,8EAA8E;IAC9E,6EAA6E;IAC7E,kFAAkF;IAClF,iFAAiF;IACjF,mFAAmF;IACnF,6EAA6E;IAC7E,MAAM,GAAG,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,cAAc,CAAC;IAElF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,8BAA8B;QAE5D,IAAI,CAAC;YACH,0EAA0E;YAC1E,sEAAsE;YACtE,mCAAmC;YACnC,MAAM,OAAO,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,UAAU,GAAG,IAAI,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAA,wBAAe,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,UAAU,GAAG,KAAK,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,SAAS,CAAC,yCAAyC;YAEpE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAA,+BAAsB,EAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,gDAAgD;YAChD,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,oBAAqB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAC7B,EAAU,EACV,QAAgC;IAEhC,mFAAmF;IACnF,sFAAsF;IACtF,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,IAAA,wBAAY,EAAC,QAAQ,CAAC,IAAA,oDAA8B,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,iBAAiB,GAAG,IAAA,wBAAY,EAAC,QAAQ,CAAC,IAAA,+CAAyB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,QAAQ,CAAC,IAAA,wCAAkB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,iFAAiF;IACjF,4BAA4B;IAC5B,EAAE;IACF,mFAAmF;IACnF,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,YAAY;IACZ,MAAM,aAAa,GACjB,CAAC,CAAC,QAAQ,CAAC,IAAA,wBAAe,EAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/C,CAAC,QAAQ,CAAC,IAAA,2CAAqB,EAAC,EAAE,CAAC,CAAC;QACpC,CAAC,SAAS,KAAK,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,mBAAmB,IAAI,CAAC,iBAAiB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACnF,OAAO;QACL,mBAAmB;QACnB,iBAAiB;QACjB,aAAa,EAAE,IAAA,wBAAY,EAAC,QAAQ,CAAC,IAAA,kDAA4B,EAAC,EAAE,CAAC,CAAC,CAAC;QACvE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAgB,mBAAmB,CACjC,mBAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,IAAA,wBAAY,GAAE,CAAC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CACvC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAA,wBAAe,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CACxD,CAAC;YACF,kFAAkF;YAClF,mFAAmF;YACnF,oBAAoB;YACpB,EAAE;YACF,6EAA6E;YAC7E,gFAAgF;YAChF,kDAAkD;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChG,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,SAAS;gBACT,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACb,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,wDAAwD;YACxD,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/F,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC1D,WAAW,EAAE,mDAAmD;gBAChE,qEAAqE;gBACrE,wEAAwE;gBACxE,oEAAoE;gBACpE,eAAe,EAAE,MAAM;gBACvB,SAAS,EAAE,KAAK;aACE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/connectors/token-env.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Connector secret storage — ~/.claude-gateway/mcp-token.env
+ *
+ * A plain dotenv file (mode 0600) of `KEY=value` lines, one per connector secret
+ * (e.g. GITHUB_TOKEN=ghp_...). This mirrors the gateway's existing secret posture
+ * (~/.claude-gateway/.env holds bot tokens in plaintext); config.json only ever holds
+ * the env-var NAME, never the value.
+ *
+ * The file is parsed fresh on every read so a web "connect" takes effect on the next
+ * session spawn with no daemon restart. Reads fail soft (an unreadable file reads as
+ * "nothing is connected"); writes do not, because a write that fails soft would erase
+ * what it could not read — see `readTokenEnvForUpdate` vs `readTokenEnv`.
+ *
+ * Nothing outside this module parses the file — it is never handed to a shell or
+ * `--env-file` — so the quoting rules are ours and both sides of the round-trip live
+ * here. Secret VALUES are not ours, though: a provider's token endpoint decides what
+ * `access_token` looks like, and a value containing a newline would otherwise be
+ * written as a second `KEY=value` line and read back as a *different* connector's
+ * secret. See `encodeValue`/`decodeValue`.
+ */
+export declare function isValidSecretKey(key: string): boolean;
+/**
+ * Read all connector secrets for a caller that only intends to LOOK at them.
+ * Returns {} when the file does not exist — or cannot be read.
+ *
+ * Degrading here is the whole point: every caller asks "is this connected / when does
+ * it expire", and the honest answer for an unreadable file is "as far as we can tell,
+ * no". The throw it replaced propagated out of `GET /v1/connectors` — an `async`
+ * handler on Express 4, which does not catch rejections — into index.ts's
+ * `unhandledRejection` hook, which shuts the gateway down. A root-owned mcp-token.env
+ * (one `sudo`, or a restored volume) therefore killed every agent and channel on the
+ * box, and the panel's next poll after restart killed it again. Failures are still
+ * logged, because silence is its own harm.
+ */
+export declare function readTokenEnv(): Record<string, string>;
+/**
+ * `getSecret` against an ALREADY-loaded snapshot, for a caller reading several keys
+ * at once (`refreshOne`'s due-check, `refreshStatusOf`). Same "an empty value means
+ * absent" rule, in one place: it is the difference between "connected" and "not" on
+ * every status surface, and it was previously re-stated at each call site.
+ */
+export declare function getSecretFrom(map: Record<string, string>, envName: string): string | null;
+/** Get a single secret value, or null if absent (or unreadable — see `readTokenEnv`). */
+export declare function getSecret(envName: string): string | null;
+/**
+ * Coerce a raw value from this file into a non-negative, finite counter/timestamp.
+ *
+ * Every numeric thing stored here — the refresh failure streaks, the backoff deadline,
+ * the token expiry — is hand-editable text, and a NaN reached from it poisons whatever
+ * reads it: `NaN >= MAX_CONSECUTIVE_FAILURES` is false forever, so the sweep's give-up
+ * branch becomes unreachable and a NaN backoff never blocks its skip guard, while the
+ * same value serialized into a status response arrives as `null` and makes a caller's
+ * `failures >= 3` test quietly false. One floor, used by both the code that decides
+ * whether to delete credentials and the code that displays the decision, so the two
+ * cannot disagree about what the file says.
+ */
+export declare function parseCounter(raw: string | null | undefined): number;
+/** True when the secret is present and non-empty. */
+export declare function hasSecret(envName: string): boolean;
+/**
+ * Upsert a secret line (creates the file if needed).
+ *
+ * Throws on a malformed key — unlike the read path, this one cannot fail soft:
+ * silently dropping a write would leave the caller believing a secret was stored.
+ */
+export declare function setSecret(envName: string, value: string): void;
+/**
+ * Upsert several secrets in ONE read-modify-write.
+ *
+ * Not a race fix — each `setSecret` is already atomic against other JS (read, mutate
+ * and rename are all synchronous). It fixes *partial* application: storing an OAuth
+ * result used to be five separate rewrites, and a crash between them left an
+ * access_token with no expiry, which the sweep then treats as "due now" forever. One
+ * rename means the whole group lands or none of it does; every key is validated before
+ * anything is written, so a bad key aborts the batch rather than half-committing.
+ */
+export declare function setSecrets(entries: Record<string, string>): void;
+/**
+ * Upsert some secrets and remove others in ONE read-modify-write.
+ *
+ * `setSecrets` then `deleteSecrets` is two renames, reopening the partial-application
+ * hole `setSecrets` closes. The sweep needs this: recording one kind of failure clears
+ * the other kind's counter, and a crash between the writes leaves both set — which
+ * status reports as a backoff that is not in effect.
+ *
+ * Removals are applied before upserts, so a key appearing in both is written, not
+ * dropped. Validation covers every upserted key before anything is written; removals
+ * need none, since removing a key that could never have been written is a no-op.
+ */
+export declare function updateSecrets(entries: Record<string, string>, removals?: readonly string[]): void;
+/** Remove several secret lines in one rewrite. No-op for names that aren't present. */
+export declare function deleteSecrets(envNames: readonly string[]): void;
+//# sourceMappingURL=token-env.d.ts.map

package/dist/connectors/token-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-env.d.ts","sourceRoot":"","sources":["../../src/connectors/token-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAqCH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AA0ED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcrD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzF;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGnE;AAED,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElD;AA+BD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAEhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,IAAI,CAUN;AAED,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/D"}

package/dist/connectors/token-env.js

@@ -0,0 +1,323 @@
+"use strict";
+/**
+ * Connector secret storage — ~/.claude-gateway/mcp-token.env
+ *
+ * A plain dotenv file (mode 0600) of `KEY=value` lines, one per connector secret
+ * (e.g. GITHUB_TOKEN=ghp_...). This mirrors the gateway's existing secret posture
+ * (~/.claude-gateway/.env holds bot tokens in plaintext); config.json only ever holds
+ * the env-var NAME, never the value.
+ *
+ * The file is parsed fresh on every read so a web "connect" takes effect on the next
+ * session spawn with no daemon restart. Reads fail soft (an unreadable file reads as
+ * "nothing is connected"); writes do not, because a write that fails soft would erase
+ * what it could not read — see `readTokenEnvForUpdate` vs `readTokenEnv`.
+ *
+ * Nothing outside this module parses the file — it is never handed to a shell or
+ * `--env-file` — so the quoting rules are ours and both sides of the round-trip live
+ * here. Secret VALUES are not ours, though: a provider's token endpoint decides what
+ * `access_token` looks like, and a value containing a newline would otherwise be
+ * written as a second `KEY=value` line and read back as a *different* connector's
+ * secret. See `encodeValue`/`decodeValue`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidSecretKey = isValidSecretKey;
+exports.readTokenEnv = readTokenEnv;
+exports.getSecretFrom = getSecretFrom;
+exports.getSecret = getSecret;
+exports.parseCounter = parseCounter;
+exports.hasSecret = hasSecret;
+exports.setSecret = setSecret;
+exports.setSecrets = setSecrets;
+exports.updateSecrets = updateSecrets;
+exports.deleteSecrets = deleteSecrets;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const paths_1 = require("../utils/paths");
+/**
+ * Resolve the mcp-token.env path (override via GATEWAY_MCP_TOKEN_ENV_PATH, used by
+ * tests and by operators who keep secrets off the default volume).
+ *
+ * Tilde-expanded, because .env.example ships the override commented out as
+ * `~/.claude-gateway/mcp-token.env` and index.ts does the same for its sibling
+ * GATEWAY_CONFIG. A shell does not expand `~` inside a .env file, so without this
+ * an operator who uncomments the documented line gets a literal `~` directory
+ * created under the gateway's cwd by ensureDir() below — every existing connector
+ * then reads as disconnected and freshly minted OAuth tokens are written to the
+ * wrong file, with nothing logged to say so.
+ */
+function tokenEnvPath() {
+    const override = process.env.GATEWAY_MCP_TOKEN_ENV_PATH;
+    return override
+        ? (0, paths_1.expandHome)(override)
+        : path.join(os.homedir(), '.claude-gateway', 'mcp-token.env');
+}
+/**
+ * Keys are env-var names, and the only structural delimiter this format has. Anything
+ * outside this shape (a newline, `=`, a space, a quote) could forge extra entries, so
+ * it is rejected rather than escaped — every key the gateway writes is
+ * `customSecretKey()`/`internalSecretKey()` output, so a rejection means a caller
+ * passed unvalidated user input. `-` is allowed because connector ids are slugs
+ * (`CUSTOM__google-calendar__…`); these are map keys here, never real env vars.
+ */
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+function isValidSecretKey(key) {
+    return KEY_RE.test(key);
+}
+/**
+ * Encode a value for one `KEY=value` line. Values that survive a raw round-trip (the
+ * common case — tokens are base64url/JWT) are written bare so the file stays greppable;
+ * anything else is double-quoted and backslash-escaped, which `decodeValue` reverses.
+ */
+function encodeValue(value) {
+    const needsQuoting = value !== value.trim() || /["\\\n\r]/.test(value) || value.startsWith('#');
+    if (!needsQuoting)
+        return value;
+    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r')}"`;
+}
+/** Reverse of `encodeValue`. Bare values are returned trimmed, as they always were. */
+function decodeValue(raw) {
+    const v = raw.trim();
+    if (v.length < 2 || !v.startsWith('"') || !v.endsWith('"'))
+        return v;
+    const inner = v.slice(1, -1);
+    let out = '';
+    for (let i = 0; i < inner.length; i++) {
+        if (inner[i] !== '\\') {
+            out += inner[i];
+            continue;
+        }
+        const next = inner[++i];
+        out += next === 'n' ? '\n' : next === 'r' ? '\r' : (next ?? '');
+    }
+    return out;
+}
+/** Parse a dotenv file body into a flat map. Ignores blank lines and `#` comments. */
+function parse(body) {
+    // Null-prototype so a hostile `__proto__` key can never reach Object.prototype.
+    const out = Object.create(null);
+    for (const rawLine of body.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (!isValidSecretKey(key))
+            continue;
+        out[key] = decodeValue(line.slice(eq + 1));
+    }
+    return out;
+}
+/**
+ * The read half of a read-modify-write. Only ENOENT means "empty" — every other
+ * errno is rethrown, on purpose.
+ *
+ * `setSecrets`, `updateSecrets` and `deleteSecrets` rewrite the file whole from
+ * whatever this returns. Swallowing an EMFILE or a momentary EACCES here turned that
+ * into "write only the new entries", silently destroying every other connector's token
+ * with no error anywhere. Failing the write is strictly better — the file stays intact.
+ *
+ * Deliberately NOT exported: the strictness is right only when about to overwrite the
+ * file, and wrong for a read-only caller (see `readTokenEnv`).
+ */
+function readTokenEnvForUpdate() {
+    try {
+        return parse(fs.readFileSync(tokenEnvPath(), 'utf-8'));
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return {};
+        throw err;
+    }
+}
+// An unreadable file stays unreadable, and status pollers hit this every couple of
+// seconds. Logging every failure buries the log; logging none is how an EACCES goes
+// unnoticed for a week. One line per minute keeps the signal.
+const READ_FAILURE_LOG_INTERVAL_MS = 60 * 1000;
+let lastReadFailureLog = 0;
+/**
+ * Read all connector secrets for a caller that only intends to LOOK at them.
+ * Returns {} when the file does not exist — or cannot be read.
+ *
+ * Degrading here is the whole point: every caller asks "is this connected / when does
+ * it expire", and the honest answer for an unreadable file is "as far as we can tell,
+ * no". The throw it replaced propagated out of `GET /v1/connectors` — an `async`
+ * handler on Express 4, which does not catch rejections — into index.ts's
+ * `unhandledRejection` hook, which shuts the gateway down. A root-owned mcp-token.env
+ * (one `sudo`, or a restored volume) therefore killed every agent and channel on the
+ * box, and the panel's next poll after restart killed it again. Failures are still
+ * logged, because silence is its own harm.
+ */
+function readTokenEnv() {
+    try {
+        return readTokenEnvForUpdate();
+    }
+    catch (err) {
+        const now = Date.now();
+        if (now - lastReadFailureLog >= READ_FAILURE_LOG_INTERVAL_MS) {
+            lastReadFailureLog = now;
+            console.error(`token-env: cannot read ${tokenEnvPath()} (${err.code ?? 'unknown'})` +
+                ` — treating every connector as not connected until it is readable: ${err.message}`);
+        }
+        return {};
+    }
+}
+/**
+ * `getSecret` against an ALREADY-loaded snapshot, for a caller reading several keys
+ * at once (`refreshOne`'s due-check, `refreshStatusOf`). Same "an empty value means
+ * absent" rule, in one place: it is the difference between "connected" and "not" on
+ * every status surface, and it was previously re-stated at each call site.
+ */
+function getSecretFrom(map, envName) {
+    const v = map[envName];
+    return v === undefined || v === '' ? null : v;
+}
+/** Get a single secret value, or null if absent (or unreadable — see `readTokenEnv`). */
+function getSecret(envName) {
+    return getSecretFrom(readTokenEnv(), envName);
+}
+/**
+ * Coerce a raw value from this file into a non-negative, finite counter/timestamp.
+ *
+ * Every numeric thing stored here — the refresh failure streaks, the backoff deadline,
+ * the token expiry — is hand-editable text, and a NaN reached from it poisons whatever
+ * reads it: `NaN >= MAX_CONSECUTIVE_FAILURES` is false forever, so the sweep's give-up
+ * branch becomes unreachable and a NaN backoff never blocks its skip guard, while the
+ * same value serialized into a status response arrives as `null` and makes a caller's
+ * `failures >= 3` test quietly false. One floor, used by both the code that decides
+ * whether to delete credentials and the code that displays the decision, so the two
+ * cannot disagree about what the file says.
+ */
+function parseCounter(raw) {
+    const n = Number(raw ?? '0');
+    return Number.isFinite(n) && n > 0 ? n : 0;
+}
+/** True when the secret is present and non-empty. */
+function hasSecret(envName) {
+    return getSecret(envName) !== null;
+}
+/** Atomically rewrite the file (mode 0600) from a map. */
+function writeAll(map) {
+    const file = tokenEnvPath();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const body = Object.entries(map)
+        .map(([k, v]) => `${k}=${encodeValue(v)}`)
+        .join('\n') + '\n';
+    const tmp = `${file}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, body, { mode: 0o600 });
+    try {
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        // `tmp` holds every secret this process knows. A rename that fails — a full
+        // disk, the directory replaced underneath us, EACCES after a permissions
+        // change — leaves that complete copy sitting next to the real file under a
+        // name nothing will ever clean up, and no later write reuses the path
+        // (pid+timestamp), so it accumulates one leaked credential dump per failure.
+        // Best-effort: the original error is what the caller needs to see, so a
+        // failed unlink must not replace it.
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* nothing better to do — surface the rename failure below */
+        }
+        throw err;
+    }
+}
+/**
+ * Upsert a secret line (creates the file if needed).
+ *
+ * Throws on a malformed key — unlike the read path, this one cannot fail soft:
+ * silently dropping a write would leave the caller believing a secret was stored.
+ */
+function setSecret(envName, value) {
+    setSecrets({ [envName]: value });
+}
+/**
+ * Upsert several secrets in ONE read-modify-write.
+ *
+ * Not a race fix — each `setSecret` is already atomic against other JS (read, mutate
+ * and rename are all synchronous). It fixes *partial* application: storing an OAuth
+ * result used to be five separate rewrites, and a crash between them left an
+ * access_token with no expiry, which the sweep then treats as "due now" forever. One
+ * rename means the whole group lands or none of it does; every key is validated before
+ * anything is written, so a bad key aborts the batch rather than half-committing.
+ */
+function setSecrets(entries) {
+    updateSecrets(entries, []);
+}
+/**
+ * Upsert some secrets and remove others in ONE read-modify-write.
+ *
+ * `setSecrets` then `deleteSecrets` is two renames, reopening the partial-application
+ * hole `setSecrets` closes. The sweep needs this: recording one kind of failure clears
+ * the other kind's counter, and a crash between the writes leaves both set — which
+ * status reports as a backoff that is not in effect.
+ *
+ * Removals are applied before upserts, so a key appearing in both is written, not
+ * dropped. Validation covers every upserted key before anything is written; removals
+ * need none, since removing a key that could never have been written is a no-op.
+ */
+function updateSecrets(entries, removals = []) {
+    for (const key of Object.keys(entries)) {
+        if (!isValidSecretKey(key)) {
+            throw new Error(`Invalid secret key '${key}' — expected /${KEY_RE.source}/`);
+        }
+    }
+    const map = readTokenEnvForUpdate();
+    for (const name of removals)
+        delete map[name];
+    for (const [key, value] of Object.entries(entries))
+        map[key] = value;
+    writeAll(map);
+}
+/** Remove several secret lines in one rewrite. No-op for names that aren't present. */
+function deleteSecrets(envNames) {
+    const map = readTokenEnvForUpdate();
+    let changed = false;
+    for (const name of envNames) {
+        if (!(name in map))
+            continue;
+        delete map[name];
+        changed = true;
+    }
+    if (changed)
+        writeAll(map);
+}
+//# sourceMappingURL=token-env.js.map

package/dist/connectors/token-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-env.js","sourceRoot":"","sources":["../../src/connectors/token-env.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCH,4CAEC;AAuFD,oCAcC;AAQD,sCAGC;AAGD,8BAEC;AAcD,oCAGC;AAGD,8BAEC;AAqCD,8BAEC;AAYD,gCAEC;AAcD,sCAaC;AAGD,sCASC;AA5QD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,0CAA4C;AAE5C;;;;;;;;;;;GAWG;AACH,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACxD,OAAO,QAAQ;QACb,CAAC,CAAC,IAAA,kBAAU,EAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAE3C,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,YAAY,GAChB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9G,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACxB,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,SAAS,KAAK,CAAC,IAAY;IACzB,gFAAgF;IAChF,MAAM,GAAG,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,oFAAoF;AACpF,8DAA8D;AAC9D,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAE3B;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY;IAC1B,IAAI,CAAC;QACH,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,kBAAkB,IAAI,4BAA4B,EAAE,CAAC;YAC7D,kBAAkB,GAAG,GAAG,CAAC;YACzB,OAAO,CAAC,KAAK,CACX,0BAA0B,YAAY,EAAE,KAAM,GAA6B,CAAC,IAAI,IAAI,SAAS,GAAG;gBAC9F,sEAAuE,GAAa,CAAC,OAAO,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAA2B,EAAE,OAAe;IACxE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,yFAAyF;AACzF,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,aAAa,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,YAAY,CAAC,GAA8B;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,qDAAqD;AACrD,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,GAA2B;IAC3C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GACR,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACvD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,6EAA6E;QAC7E,wEAAwE;QACxE,qCAAqC;QACrC,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,KAAa;IACtD,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,OAA+B;IACxD,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,aAAa,CAC3B,OAA+B,EAC/B,WAA8B,EAAE;IAEhC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,iBAAiB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,uFAAuF;AACvF,SAAgB,aAAa,CAAC,QAA2B;IACvD,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS;QAC7B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}