@ambitresearch/genie 1.3.1

package/dist/transport.js

@@ -0,0 +1,448 @@
+import { randomUUID } from "node:crypto";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createServer as createHttpServer, } from "node:http";
+import { isIP } from "node:net";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { extractBearerToken, verifyToken } from "./auth/bearer.js";
+import { tryCreateOAuthRouter } from "./auth/oauth/router.js";
+import { tryCreateOidcVerifier } from "./auth/oidc/verifier.js";
+import { GroupAccessDeniedError } from "./auth/oidc/group-policy.js";
+export function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    if (normalized === "localhost" || normalized.endsWith(".localhost"))
+        return true;
+    const unwrapped = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+    const ipVersion = isIP(unwrapped);
+    if (ipVersion === 4)
+        return unwrapped.split(".")[0] === "127";
+    if (ipVersion !== 6)
+        return false;
+    try {
+        return new URL(`http://[${unwrapped}]/`).hostname === "[::1]";
+    }
+    catch {
+        return false;
+    }
+}
+export function normalizeListenHost(host) {
+    const trimmed = host.trim();
+    return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+}
+export function formatHttpEndpoint(host, port) {
+    const normalized = normalizeListenHost(host);
+    const urlHost = isIP(normalized) === 6 ? `[${normalized}]` : normalized;
+    return `http://${urlHost}:${port}/mcp`;
+}
+const serverTransportKinds = new WeakMap();
+const serverDisposers = new WeakMap();
+const serverDisposerHooks = new WeakSet();
+/** Register session-scoped resources that must close with their MCP server. */
+export function registerServerDisposer(server, disposer) {
+    const disposers = serverDisposers.get(server) ?? new Set();
+    disposers.add(disposer);
+    serverDisposers.set(server, disposers);
+    if (!serverDisposerHooks.has(server)) {
+        serverDisposerHooks.add(server);
+        const previousOnClose = server.server.onclose;
+        server.server.onclose = () => {
+            try {
+                previousOnClose?.();
+            }
+            finally {
+                void disposeServer(server);
+            }
+        };
+    }
+}
+async function disposeServer(server) {
+    const disposers = serverDisposers.get(server);
+    if (disposers === undefined)
+        return;
+    serverDisposers.delete(server);
+    await Promise.allSettled([...disposers].map((dispose) => dispose()));
+}
+/** Return the transport selected for a started server, if startup has begun. */
+export function getServerTransportKind(server) {
+    return serverTransportKinds.get(server);
+}
+/**
+ * Resolve which transport to use (RFC §5.2 transport multiplexer):
+ *   1. explicit `kind` argument (from the --transport CLI flag), else
+ *   2. MCP_TRANSPORT env var, else
+ *   3. auto-detect: a TTY on stdin means a human launched us → HTTP;
+ *      otherwise a harness is piping JSON-RPC over stdio → stdio.
+ */
+export function resolveTransport(kind) {
+    const choice = (kind ?? process.env.MCP_TRANSPORT ?? "").toLowerCase();
+    if (choice === "stdio" || choice === "http")
+        return choice;
+    if (choice) {
+        throw new Error(`Unknown transport "${choice}". Use "stdio" or "http".`);
+    }
+    return process.stdin.isTTY ? "http" : "stdio";
+}
+/**
+ * Resolve whether preview URLs are reachable from the MCP client. HTTP is
+ * conservative by default because a loopback bind can still sit behind a
+ * reverse proxy or tunnel; same-machine HTTP deployments must opt into local
+ * URLs explicitly.
+ */
+export function resolvePreviewLocality(transportKind, locality, env = process.env) {
+    const choice = (locality ?? env.GENIE_PREVIEW_LOCALITY ?? "").trim().toLowerCase();
+    if (choice === "local" || choice === "remote")
+        return choice;
+    if (choice) {
+        throw new Error(`Unknown preview locality "${choice}". Use "local" or "remote".`);
+    }
+    return transportKind === "stdio" ? "local" : "remote";
+}
+/** Connect the server over stdio (the default for local harnesses). */
+async function startStdio(server, input = process.stdin, output = process.stdout) {
+    const transport = new StdioServerTransport(input, output);
+    let closing = false;
+    const closeOnEof = () => {
+        if (closing)
+            return;
+        closing = true;
+        void transport.close().catch((error) => {
+            process.stderr.write(`genie: stdio close failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        });
+    };
+    const removeEofListeners = () => {
+        input.off("end", closeOnEof);
+        input.off("close", closeOnEof);
+    };
+    transport.onclose = removeEofListeners;
+    input.once("end", closeOnEof);
+    input.once("close", closeOnEof);
+    try {
+        await server.connect(transport);
+    }
+    catch (error) {
+        removeEofListeners();
+        throw error;
+    }
+    // No stdout logging on stdio — it would corrupt the JSON-RPC stream.
+}
+const DEFAULT_HTTP_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+function sessionIdFrom(req) {
+    const value = req.headers["mcp-session-id"];
+    return Array.isArray(value) ? value[0] : value;
+}
+function writeProtocolError(res, status, message, headers = {}) {
+    if (res.headersSent)
+        return;
+    res.writeHead(status, { "content-type": "application/json", ...headers });
+    res.end(JSON.stringify({
+        jsonrpc: "2.0",
+        error: { code: -32000, message },
+        id: null,
+    }));
+}
+function reportHttpFailure(res, error) {
+    process.stderr.write(JSON.stringify({
+        event: "transport.http.error",
+        error: error instanceof Error ? (error.stack ?? error.message) : String(error),
+    }) + "\n");
+    writeProtocolError(res, 500, "Internal server error");
+}
+/**
+ * Create the stateful Streamable HTTP request handler. Each initialized client
+ * receives its own MCP server + transport, keyed by Mcp-Session-Id, so
+ * initialize-scoped capabilities never leak between clients.
+ */
+export function createStreamableHttpRequestHandler(serverFactory, options = {}) {
+    const sessions = new Map();
+    const sessionIdleTimeoutMs = options.sessionIdleTimeoutMs ?? DEFAULT_HTTP_SESSION_IDLE_TIMEOUT_MS;
+    if (!Number.isFinite(sessionIdleTimeoutMs) || sessionIdleTimeoutMs <= 0) {
+        throw new Error("sessionIdleTimeoutMs must be a positive finite number.");
+    }
+    const oauthRouter = options.oauthIssuer
+        ? tryCreateOAuthRouter({ issuer: options.oauthIssuer })
+        : undefined;
+    const refreshIdleTimer = (sessionId, session) => {
+        if (session.idleTimer !== undefined)
+            clearTimeout(session.idleTimer);
+        session.idleTimer = setTimeout(() => {
+            if (sessions.get(sessionId) !== session)
+                return;
+            if (session.activeRequests > 0)
+                return;
+            session.idleTimer = undefined;
+            sessions.delete(sessionId);
+            void session.transport.close().finally(() => disposeServer(session.server));
+        }, sessionIdleTimeoutMs);
+        session.idleTimer.unref?.();
+    };
+    const disposeSession = (session) => {
+        if (session.disposed)
+            return;
+        session.disposed = true;
+        if (session.idleTimer !== undefined) {
+            clearTimeout(session.idleTimer);
+            session.idleTimer = undefined;
+        }
+        void disposeServer(session.server);
+    };
+    const acquireSession = (session, sessionId) => {
+        if (session.idleTimer !== undefined) {
+            clearTimeout(session.idleTimer);
+            session.idleTimer = undefined;
+        }
+        session.activeRequests += 1;
+        return { session, sessionId, released: false };
+    };
+    const releaseSession = (lease) => {
+        if (lease.released)
+            return;
+        lease.released = true;
+        lease.session.activeRequests -= 1;
+        const activeId = lease.sessionId ?? lease.session.transport.sessionId;
+        if (activeId !== undefined &&
+            lease.session.activeRequests === 0 &&
+            sessions.get(activeId) === lease.session) {
+            refreshIdleTimer(activeId, lease.session);
+        }
+    };
+    const handleMcp = async (req, res, body, acquiredLease) => {
+        const sessionId = sessionIdFrom(req);
+        let session = acquiredLease?.session ?? sessions.get(sessionId ?? "");
+        let createdSession = false;
+        if (session === undefined) {
+            if (sessionId !== undefined) {
+                writeProtocolError(res, 404, "Unknown MCP session");
+                return;
+            }
+            if (!isInitializeRequest(body)) {
+                writeProtocolError(res, 400, "Missing MCP session ID");
+                return;
+            }
+            const sessionServer = serverFactory();
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (initializedId) => {
+                    const initializedSession = session;
+                    sessions.set(initializedId, initializedSession);
+                },
+            });
+            session = { server: sessionServer, transport, activeRequests: 0, disposed: false };
+            createdSession = true;
+            transport.onclose = () => {
+                const closedId = transport.sessionId;
+                if (closedId !== undefined)
+                    sessions.delete(closedId);
+                disposeSession(session);
+            };
+            serverTransportKinds.set(sessionServer, "http");
+            try {
+                await sessionServer.connect(transport);
+            }
+            catch (error) {
+                await transport.close().catch(() => undefined);
+                disposeSession(session);
+                throw error;
+            }
+        }
+        const lease = acquiredLease ?? acquireSession(session, sessionId);
+        try {
+            await session.transport.handleRequest(req, res, body);
+        }
+        finally {
+            releaseSession(lease);
+            if (createdSession && session.transport.sessionId === undefined) {
+                await session.transport.close().catch(() => undefined);
+                disposeSession(session);
+            }
+        }
+    };
+    const requireBearerAuth = options.requireBearerAuth ?? false;
+    const { oidcVerifier } = options;
+    /**
+     * Authenticate `/mcp` against every configured credential source. Sources
+     * are alternatives: a token accepted by self-issued OAuth, static bearer
+     * auth, OR external OIDC may proceed. An OIDC token that verifies but lacks
+     * the required group gets 403 only after the other enabled sources also
+     * reject it; a token invalid for every source gets 401.
+     */
+    const authorizeMcp = async (req, res) => {
+        const authEnabled = oauthRouter !== undefined || requireBearerAuth || oidcVerifier !== undefined;
+        if (!authEnabled)
+            return true;
+        const authorizationHeader = Array.isArray(req.headers.authorization)
+            ? req.headers.authorization[0]
+            : req.headers.authorization;
+        const token = extractBearerToken(authorizationHeader);
+        if (token === undefined) {
+            writeUnauthorized(res, "Missing bearer token");
+            return false;
+        }
+        if (oauthRouter !== undefined) {
+            try {
+                oauthRouter.verifyBearerToken(authorizationHeader);
+                return true;
+            }
+            catch {
+                // Try the remaining configured credential sources.
+            }
+        }
+        if (requireBearerAuth && (await verifyToken(token)).ok)
+            return true;
+        let groupDenied;
+        if (oidcVerifier !== undefined) {
+            try {
+                await oidcVerifier.verify(token);
+                return true;
+            }
+            catch (error) {
+                if (error instanceof GroupAccessDeniedError)
+                    groupDenied = error;
+            }
+        }
+        if (groupDenied !== undefined) {
+            res.writeHead(403, {
+                "content-type": "application/json",
+                "www-authenticate": 'Bearer error="insufficient_scope"',
+            });
+            res.end(JSON.stringify({
+                error: "insufficient_group",
+                message: `Caller is not a member of the "${groupDenied.requiredGroup}" group.`,
+            }));
+            return false;
+        }
+        writeUnauthorized(res, "Invalid bearer token", "invalid_token");
+        return false;
+    };
+    const writeUnauthorized = (res, message, error) => {
+        if (oauthRouter === undefined) {
+            const challenge = error === undefined ? "Bearer" : `Bearer error="${error}"`;
+            writeProtocolError(res, 401, message, { "www-authenticate": challenge });
+            return;
+        }
+        res.writeHead(401, {
+            "content-type": "application/json",
+            "www-authenticate": `Bearer resource_metadata="${options.oauthIssuer}/.well-known/oauth-authorization-server"`,
+        });
+        res.end(JSON.stringify({ error: "invalid_token" }));
+    };
+    return (req, res) => {
+        const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+        if (oauthRouter?.handle(req, res, pathname))
+            return;
+        if (pathname === "/mcp") {
+            void authorizeMcp(req, res).then((authorized) => {
+                if (!authorized)
+                    return;
+                dispatchMcp(req, res, pathname);
+            });
+            return;
+        }
+        dispatchMcp(req, res, pathname);
+    };
+    function dispatchMcp(req, res, pathname) {
+        if (req.method === "POST" && pathname === "/mcp") {
+            const sessionId = sessionIdFrom(req);
+            let lease;
+            if (sessionId !== undefined) {
+                const session = sessions.get(sessionId);
+                if (session === undefined) {
+                    writeProtocolError(res, 404, "Unknown MCP session");
+                    return;
+                }
+                lease = acquireSession(session, sessionId);
+            }
+            let handedOff = false;
+            const releaseBufferedRequest = () => {
+                if (!handedOff && lease !== undefined)
+                    releaseSession(lease);
+            };
+            const chunks = [];
+            req.on("data", (c) => chunks.push(c));
+            req.once("aborted", releaseBufferedRequest);
+            req.once("error", releaseBufferedRequest);
+            req.on("end", () => {
+                if (req.aborted) {
+                    releaseBufferedRequest();
+                    return;
+                }
+                let body;
+                try {
+                    body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                }
+                catch {
+                    releaseBufferedRequest();
+                    res.writeHead(400, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ error: "invalid JSON" }));
+                    return;
+                }
+                handedOff = true;
+                void handleMcp(req, res, body, lease).catch((error) => {
+                    reportHttpFailure(res, error);
+                });
+            });
+            return;
+        }
+        if ((req.method === "GET" || req.method === "DELETE") && pathname === "/mcp") {
+            void handleMcp(req, res).catch((error) => {
+                reportHttpFailure(res, error);
+            });
+            return;
+        }
+        if (req.method === "GET" && pathname === "/health") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ status: "ok", server: "genie" }));
+            return;
+        }
+        res.writeHead(404).end();
+    }
+}
+/** Connect the server over Streamable HTTP (for remote / multi-client use). */
+async function startHttp(port, host, serverFactory, requireBearerAuth) {
+    if (serverFactory === undefined) {
+        throw new Error("HTTP transport requires an explicit serverFactory for per-client session isolation.");
+    }
+    // OAuth is opt-in: only mounted when OAUTH_HS256_KEY is set (AC1-AC5). The
+    // issuer is the externally-reachable endpoint clients will hit for DCR +
+    // token exchange, so it must match how `claude mcp add` / `codex mcp
+    // login` reach this process — override via GENIE_OAUTH_ISSUER for
+    // reverse-proxy/tunnel deployments.
+    const oauthIssuer = process.env.OAUTH_HS256_KEY !== undefined
+        ? (process.env.GENIE_OAUTH_ISSUER ?? `http://${normalizeListenHost(host)}:${port}`)
+        : undefined;
+    // OIDC relying-party mode is opt-in: only engages when GENIE_OIDC_ISSUER +
+    // GENIE_OIDC_AUDIENCE are set (M5-04, DRO-276). Independent of oauthIssuer.
+    const oidcVerifier = await tryCreateOidcVerifier(process.env);
+    const http = createHttpServer(createStreamableHttpRequestHandler(serverFactory, {
+        requireBearerAuth,
+        oauthIssuer,
+        oidcVerifier,
+    }));
+    await new Promise((resolve) => http.listen(port, host, resolve));
+    process.stderr.write(`genie MCP server listening on ${formatHttpEndpoint(host, port)}\n`);
+    if (oauthIssuer) {
+        process.stderr.write(`genie MCP server: OAuth 2.0 + DCR enabled (issuer ${oauthIssuer})\n`);
+    }
+    if (oidcVerifier) {
+        process.stderr.write(`genie MCP server: OIDC relying-party mode enabled (issuer ${oidcVerifier.issuer}, ` +
+            `required group "${oidcVerifier.requiredGroup}")\n`);
+    }
+}
+/** Start the server on the resolved transport. Returns the kind actually used. */
+export async function startTransport(server, opts = {}) {
+    const kind = resolveTransport(opts.kind);
+    serverTransportKinds.set(server, kind);
+    try {
+        if (kind === "http") {
+            await startHttp(opts.port ?? 3000, normalizeListenHost(opts.host ?? "127.0.0.1"), opts.serverFactory, opts.requireBearerAuth);
+        }
+        else {
+            await startStdio(server, opts.stdioInput, opts.stdioOutput);
+        }
+    }
+    catch (error) {
+        serverTransportKinds.delete(server);
+        throw error;
+    }
+    return kind;
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,YAAY,IAAI,gBAAgB,GAIjC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAqB,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAIrE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjF,MAAM,SAAS,GACb,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAChG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;IAC9D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAC3D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IACxE,OAAO,UAAU,OAAO,IAAI,IAAI,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA4B,CAAC;AACrE,MAAM,eAAe,GAAG,IAAI,OAAO,EAA8C,CAAC;AAClF,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAa,CAAC;AAErD,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CACpC,MAAiB,EACjB,QAAoC;IAEpC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;IAC3D,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,eAAe,EAAE,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAiB;IAC5C,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,OAAO,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,2BAA2B,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAA4B,EAC5B,QAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnF,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,6BAA6B,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,UAAU,CACvB,MAAiB,EACjB,QAAkB,OAAO,CAAC,KAAK,EAC/B,SAAmB,OAAO,CAAC,MAAM;IAEjC,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,SAAS,CAAC,OAAO,GAAG,kBAAkB,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,qEAAqE;AACvE,CAAC;AAgBD,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgC5D,SAAS,aAAa,CAAC,GAAoB;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAmB,EACnB,MAAc,EACd,OAAe,EACf,UAAkC,EAAE;IAEpC,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO;IAC5B,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE;QAChC,EAAE,EAAE,IAAI;KACT,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAmB,EAAE,KAAc;IAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC/E,CAAC,GAAG,IAAI,CACV,CAAC;IACF,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,aAA8B,EAC9B,UAAwC,EAAE;IAE1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,oCAAoC,CAAC;IAClG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW;QACrC,CAAC,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACvD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,OAAoB,EAAQ,EAAE;QACzE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO;gBAAE,OAAO;YAChD,IAAI,OAAO,CAAC,cAAc,GAAG,CAAC;gBAAE,OAAO;YACvC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACzB,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,OAAoB,EAAQ,EAAE;QACpD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO;QAC7B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxB,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAChC,CAAC;QACD,KAAK,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,OAAoB,EAAE,SAAkB,EAAgB,EAAE;QAChF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,KAAmB,EAAQ,EAAE;QACnD,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO;QAC3B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;QACtE,IACE,QAAQ,KAAK,SAAS;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,OAAO,EACxC,CAAC;YACD,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EACrB,GAAoB,EACpB,GAAmB,EACnB,IAAc,EACd,aAA4B,EACb,EAAE;QACjB,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,aAAa,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBACtC,oBAAoB,EAAE,CAAC,aAAa,EAAE,EAAE;oBACtC,MAAM,kBAAkB,GAAG,OAAsB,CAAC;oBAClD,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;gBAClD,CAAC;aACF,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACnF,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;gBACrC,IAAI,QAAQ,KAAK,SAAS;oBAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACtD,cAAc,CAAC,OAAsB,CAAC,CAAC;YACzC,CAAC,CAAC;YACF,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/C,cAAc,CAAC,OAAO,CAAC,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,IAAI,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACvD,cAAc,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAC7D,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAEjC;;;;;;OAMG;IACH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAoB,EAAE;QACzF,MAAM,WAAW,GACf,WAAW,KAAK,SAAS,IAAI,iBAAiB,IAAI,YAAY,KAAK,SAAS,CAAC;QAC/E,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAClE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,iBAAiB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,WAAW,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAEpE,IAAI,WAA+C,CAAC;QACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,sBAAsB;oBAAE,WAAW,GAAG,KAAK,CAAC;YACnE,CAAC;QACH,CAAC;QAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,mCAAmC;aACxD,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,kCAAkC,WAAW,CAAC,aAAa,UAAU;aAC/E,CAAC,CACH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iBAAiB,CAAC,GAAG,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CACxB,GAAmB,EACnB,OAAe,EACf,KAAuB,EACjB,EAAE;QACR,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,KAAK,GAAG,CAAC;YAC7E,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,6BAA6B,OAAO,CAAC,WAAW,0CAA0C;SAC/G,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QAEtE,IAAI,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC;YAAE,OAAO;QAEpD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,KAAK,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBAC9C,IAAI,CAAC,UAAU;oBAAE,OAAO;gBACxB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,SAAS,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAA+B,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,MAAM,sBAAsB,GAAG,GAAS,EAAE;gBACxC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,SAAS;oBAAE,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC,CAAC;YACF,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAC1C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,sBAAsB,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,IAAI,IAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC7D,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7E,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAChD,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,IAAY,EACZ,aAA+B,EAC/B,iBAA2B;IAE3B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;QACvC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACnF,CAAC,CAAC,SAAS,CAAC;IAChB,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,gBAAgB,CAC3B,kCAAkC,CAAC,aAAa,EAAE;QAChD,iBAAiB;QACjB,WAAW;QACX,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,WAAW,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6DAA6D,YAAY,CAAC,MAAM,IAAI;YAClF,mBAAmB,YAAY,CAAC,aAAa,MAAM,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAeD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAiB,EACjB,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,IAAI,IAAI,EACjB,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAC7C,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/ui/card-asset-broker.d.ts

@@ -0,0 +1,42 @@
+/** Optional stable port for hosts that must advertise frame origins before a request. */
+export declare const CARD_ASSET_PORT_ENV = "GENIE_CARD_ASSET_PORT";
+declare const LOOPBACK_ADDRESS: "127.0.0.1";
+export interface CardAssetBrokerOptions {
+    /**
+     * TCP port for the process-scoped asset listener. `0` asks the OS for an
+     * ephemeral port. The explicit option wins over `GENIE_CARD_ASSET_PORT`.
+     */
+    port?: number;
+    /** Injectable environment for deterministic composition and tests. */
+    env?: Readonly<Record<string, string | undefined>>;
+}
+/** A kit-specific opaque route on the process-scoped loopback origin. */
+export interface CardAssetKit {
+    readonly kitId: string;
+    readonly token: string;
+    readonly routePrefix: string;
+    readonly hostname: string;
+    readonly authority: string;
+    readonly origin: string;
+    /** Build an absolute URL from a logical, kit-relative POSIX path. */
+    urlFor(path: string): string;
+}
+/** One loopback listener intended to live for the MCP server process lifetime. */
+export interface CardAssetBroker {
+    readonly address: typeof LOOPBACK_ADDRESS;
+    readonly port: number;
+    registerKit(kitId: string, root: string): Promise<CardAssetKit>;
+    getKit(kitId: string): CardAssetKit | undefined;
+    /** Immutable snapshot for exact MCP App `frameDomains` composition. */
+    frameOrigins(): readonly string[];
+    close(): Promise<void>;
+}
+/**
+ * Start a process-scoped, loopback-only card asset broker.
+ *
+ * The promise resolves only after the concrete port is known, so callers can
+ * safely publish each registration's exact `origin` in MCP App CSP metadata.
+ */
+export declare function startCardAssetBroker(options?: CardAssetBrokerOptions): Promise<CardAssetBroker>;
+export {};
+//# sourceMappingURL=card-asset-broker.d.ts.map

package/dist/ui/card-asset-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-asset-broker.d.ts","sourceRoot":"","sources":["../../src/ui/card-asset-broker.ts"],"names":[],"mappings":"AASA,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D,QAAA,MAAM,gBAAgB,EAAG,WAAoB,CAAC;AAuB9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,gBAAgB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IAChD,uEAAuE;IACvE,YAAY,IAAI,SAAS,MAAM,EAAE,CAAC;IAClC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAweD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAI1B"}