@ashlr/hub 3.4.0 → 3.5.1

package/dist/core/verse/mcp-mutation.js

@@ -0,0 +1,471 @@
+/**
+ * core/verse/mcp-mutation.ts — adding or editing an MCP server, deliberately
+ * made difficult.
+ *
+ * docs/VERSE-WORKSPACES.md §3: "an MCP server is arbitrary code with the
+ * agent's privileges"; "Adding or editing a server is a privileged,
+ * outward-facing change. It belongs behind the same mutation gate as the other
+ * control-plane writes, and it should show the full command and environment
+ * (redacted) before it is saved — never a one-click install of something the
+ * operator has not read."
+ *
+ * ── How "never one-click" is enforced, rather than just intended ────────────
+ *
+ * A write takes TWO requests, and the second cannot be forged from the first
+ * by a client that did not render it:
+ *
+ *   1. {@link buildVerseMcpProposal} validates the spec, resolves the target,
+ *      and returns a PROPOSAL containing the full command and args verbatim,
+ *      the env KEYS with every value redacted to '<set>', the warnings, and a
+ *      `digest` over exactly what was shown plus the target file's current
+ *      contents. Nothing is written.
+ *   2. {@link applyVerseMcpProposal} refuses unless it is handed that same
+ *      digest back AND the target file is still byte-identical to what the
+ *      digest was taken over. A stale digest is a refusal, not a merge.
+ *
+ * The digest binds the decision to the disclosure. An operator who never saw
+ * the command cannot produce it, and a file that changed underneath the
+ * proposal invalidates it.
+ *
+ * ── What this refuses to do ─────────────────────────────────────────────────
+ *
+ *   - Rewrite TOML. Codex and Grok keep their MCP servers in `config.toml`.
+ *     `src/core/integrations/editors.ts` already established the rule for
+ *     this repo — Codex "is intentionally delegated to its official CLI so
+ *     this module never attempts to parse and rewrite a user's TOML
+ *     configuration" — and a half-understood TOML rewrite of an operator's
+ *     config is a worse outcome than a refusal.
+ *   - Touch ~/.ashlr/config.json, ~/.ashlr/enrollment.json or ~/.ashlr/KILL.
+ *     Those are not MCP registries and are explicitly out of bounds.
+ *   - Write anywhere the caller names freely. Targets are an enumerated set.
+ *
+ * ── What may leave this module ──────────────────────────────────────────────
+ *
+ * Env VALUES never leave, in any form, on any path: not in the proposal, not
+ * in the apply result, not in the audit summary, not in an error message. The
+ * proposal carries `redactEnv`'d specs only. The real values live in the
+ * request body and go straight to disk.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { canonical, digest } from '../universe/artifacts.js';
+import { redactEnv } from '../mcp-registry.js';
+import { homeRelativeSourceRef, projectMcpServerView, resolveAccountStateRoots } from './mcp-seat-view.js';
+/** Files that must never be written by this module, whatever a caller asks. */
+export const VERSE_MCP_FORBIDDEN_FILES = [
+    'config.json',
+    'enrollment.json',
+    'KILL',
+];
+function hubTargetPath(home) {
+    return join(home, '.ashlr', 'settings.json');
+}
+/**
+ * Resolve a target id to a file, or explain why not.
+ *
+ * `accountsRoot` is only consulted for `account:` targets. Account state
+ * directories are private and never published — only `ref` crosses out.
+ */
+export function resolveVerseMcpTarget(id, options) {
+    const home = options.home ?? homedir();
+    if (id === 'hub') {
+        const path = hubTargetPath(home);
+        return {
+            ok: true,
+            target: { id: 'hub', path, ref: homeRelativeSourceRef(path, home), label: 'Hub gateway registry' },
+        };
+    }
+    if (!id.startsWith('account:')) {
+        return { ok: false, refusal: 'mcp-target-unknown', error: `unknown target: ${id}` };
+    }
+    const accountId = id.slice('account:'.length);
+    if (accountId.length === 0 || accountId.length > 64) {
+        return { ok: false, refusal: 'mcp-target-unknown', error: 'target account id is missing or too long' };
+    }
+    const roots = resolveAccountStateRoots(options.accountsRoot);
+    const stateRoot = roots.get(accountId);
+    if (stateRoot === undefined) {
+        return {
+            ok: false,
+            refusal: 'mcp-target-unresolved',
+            error: `no private profile is resolvable for account ${accountId}`,
+        };
+    }
+    // Only a JSON registry can be edited. A Codex or Grok account keeps TOML,
+    // and this module does not rewrite an operator's TOML.
+    if (existsSync(join(stateRoot, 'config.toml'))) {
+        return {
+            ok: false,
+            refusal: 'mcp-target-not-json',
+            error: `account ${accountId} keeps its MCP servers in config.toml. Hub does not rewrite TOML; ` +
+                'use the provider CLI\'s own mcp command for this account.',
+        };
+    }
+    const path = join(stateRoot, '.claude.json');
+    return {
+        ok: true,
+        target: {
+            id: id,
+            path,
+            // The state directory is private; name the file relative to the account.
+            ref: `${accountId}/.claude.json`,
+            label: `Account ${accountId} (private profile)`,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Spec validation — strict, because this is arbitrary code
+// ---------------------------------------------------------------------------
+const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const MAX_ARGS = 64;
+const MAX_ENV_KEYS = 64;
+const MAX_STRING_BYTES = 4096;
+const MAX_ENV_VALUE_BYTES = 8192;
+/** Printable, single-line, within a byte budget. Rejects control characters. */
+function printable(value, maxBytes) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    if (Buffer.byteLength(value) > maxBytes)
+        return false;
+    return [...value].every((character) => {
+        const code = character.charCodeAt(0);
+        return code >= 32 && (code < 127 || code > 159);
+    });
+}
+/**
+ * Validate a caller-supplied server spec.
+ *
+ * Strict by construction: unknown keys are rejected, every string is bounded
+ * and printable, and nothing is coerced. Warnings are returned rather than
+ * silently swallowed — they are part of what the operator must read.
+ */
+export function parseVerseMcpSpec(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        return { ok: false, error: 'server must be a JSON object' };
+    }
+    const raw = body;
+    for (const key of Object.keys(raw)) {
+        if (key !== 'name' && key !== 'command' && key !== 'args' && key !== 'env') {
+            return { ok: false, error: `unknown key in server: ${key}` };
+        }
+    }
+    const name = raw['name'];
+    if (typeof name !== 'string' || !NAME_RE.test(name)) {
+        return { ok: false, error: 'name must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}' };
+    }
+    const command = raw['command'];
+    if (!printable(command, MAX_STRING_BYTES)) {
+        return { ok: false, error: 'command must be a printable single-line string' };
+    }
+    const warnings = [];
+    if (!command.startsWith('/')) {
+        warnings.push(`The command "${command}" is not an absolute path, so it is resolved through PATH at ` +
+            'launch time. Whatever appears first on PATH will run with the agent\'s privileges.');
+    }
+    let args = [];
+    const rawArgs = raw['args'];
+    if (rawArgs !== undefined) {
+        if (!Array.isArray(rawArgs))
+            return { ok: false, error: 'args must be an array of strings' };
+        if (rawArgs.length > MAX_ARGS)
+            return { ok: false, error: `args may hold at most ${MAX_ARGS} entries` };
+        for (const arg of rawArgs) {
+            if (!printable(arg, MAX_STRING_BYTES)) {
+                return { ok: false, error: 'every arg must be a printable single-line string' };
+            }
+        }
+        args = [...rawArgs];
+    }
+    let env;
+    const rawEnv = raw['env'];
+    if (rawEnv !== undefined) {
+        if (rawEnv === null || typeof rawEnv !== 'object' || Array.isArray(rawEnv)) {
+            return { ok: false, error: 'env must be an object of string values' };
+        }
+        const entries = Object.entries(rawEnv);
+        if (entries.length > MAX_ENV_KEYS) {
+            return { ok: false, error: `env may hold at most ${MAX_ENV_KEYS} keys` };
+        }
+        const safe = {};
+        for (const [key, value] of entries) {
+            if (!ENV_KEY_RE.test(key))
+                return { ok: false, error: `invalid env key: ${key}` };
+            if (!printable(value, MAX_ENV_VALUE_BYTES)) {
+                // The offending VALUE is never echoed — only its key.
+                return { ok: false, error: `env value for ${key} must be a printable single-line string` };
+            }
+            safe[key] = value;
+        }
+        if (entries.length > 0) {
+            env = safe;
+            warnings.push(`${entries.length} environment variable${entries.length === 1 ? '' : 's'} ` +
+                `(${Object.keys(safe).join(', ')}) will be passed to this server. Their values are ` +
+                'redacted everywhere they are displayed, including here.');
+        }
+    }
+    const spec = { name, command, args, source: 'proposal' };
+    if (env !== undefined)
+        spec.env = env;
+    return { ok: true, spec, warnings };
+}
+export const VERSE_MCP_PROPOSAL_NOTE = 'Nothing has been written. An MCP server is arbitrary code that runs with the agent\'s ' +
+    'privileges: read the command, arguments and environment keys above, then confirm with the ' +
+    'digest shown to apply it.';
+/** Read a JSON registry's current bytes and servers. Missing file is not an error. */
+function readTarget(path) {
+    let bytes = '';
+    try {
+        if (existsSync(path))
+            bytes = readFileSync(path, 'utf8');
+    }
+    catch {
+        bytes = '';
+    }
+    let servers = {};
+    if (bytes.length > 0) {
+        try {
+            const parsed = JSON.parse(bytes);
+            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                const existing = parsed['mcpServers'];
+                if (existing !== null && typeof existing === 'object' && !Array.isArray(existing)) {
+                    servers = existing;
+                }
+            }
+        }
+        catch {
+            servers = {};
+        }
+    }
+    return { bytes, servers };
+}
+/**
+ * The digest the operator confirms against.
+ *
+ * Covers the REDACTED spec (what was shown), the target, and a hash of the
+ * target file's current bytes. Env values are deliberately outside it: the
+ * digest must be reproducible from what was displayed.
+ */
+export function verseMcpProposalDigest(input) {
+    return digest(canonical({
+        schema: 'verse-mcp-proposal/1',
+        server: input.server,
+        target: input.targetId,
+        base: digest(input.targetBytes),
+    }));
+}
+/**
+ * Validate, disclose, and hand back a digest. Writes nothing.
+ */
+export function buildVerseMcpProposal(options) {
+    const home = options.home ?? homedir();
+    const parsed = parseVerseMcpSpec(options.server);
+    if (!parsed.ok) {
+        return { ok: false, refusal: 'mcp-spec-invalid', error: parsed.error, note: VERSE_MCP_PROPOSAL_NOTE };
+    }
+    const resolved = resolveVerseMcpTarget(options.targetId, { accountsRoot: options.accountsRoot, home });
+    if (!resolved.ok) {
+        return { ok: false, refusal: resolved.refusal, error: resolved.error, note: VERSE_MCP_PROPOSAL_NOTE };
+    }
+    const target = resolved.target;
+    if (VERSE_MCP_FORBIDDEN_FILES.includes(target.path.split('/').pop() ?? '')) {
+        return {
+            ok: false,
+            refusal: 'mcp-target-forbidden',
+            error: `${target.ref} is not an MCP registry and is never written by this surface`,
+            note: VERSE_MCP_PROPOSAL_NOTE,
+        };
+    }
+    const current = readTarget(target.path);
+    const existing = current.servers[parsed.spec.name];
+    const action = existing === undefined ? 'add' : 'replace';
+    const server = projectMcpServerView({ ...parsed.spec, source: target.path }, home);
+    // `source` on the displayed spec should name the TARGET, not the literal
+    // string 'proposal' — the operator is reading where it will land.
+    server.sourceRef = target.ref;
+    let replaces = null;
+    if (existing !== null && typeof existing === 'object' && !Array.isArray(existing)) {
+        const row = existing;
+        if (typeof row['command'] === 'string') {
+            const prior = {
+                name: parsed.spec.name,
+                command: row['command'],
+                args: Array.isArray(row['args']) ? row['args'].filter((a) => typeof a === 'string') : [],
+                source: target.path,
+            };
+            if (row['env'] !== null && typeof row['env'] === 'object' && !Array.isArray(row['env'])) {
+                const priorEnv = {};
+                for (const [k, v] of Object.entries(row['env'])) {
+                    if (typeof v === 'string')
+                        priorEnv[k] = v;
+                }
+                if (Object.keys(priorEnv).length > 0)
+                    prior.env = priorEnv;
+            }
+            replaces = projectMcpServerView(redactEnv(prior), home);
+            replaces.sourceRef = target.ref;
+        }
+    }
+    const warnings = [...parsed.warnings];
+    if (action === 'replace') {
+        warnings.push(`A server named "${parsed.spec.name}" already exists in ${target.ref} and would be replaced. ` +
+            'Its current command is shown above so the change is legible.');
+    }
+    if (target.id === 'hub') {
+        warnings.push('This registry is aggregated by the hub gateway, so the server becomes reachable to every ' +
+            'agent that connects through it — not to one seat.');
+    }
+    if (target.id.startsWith('account:')) {
+        warnings.push('Verse launches Claude seats with --strict-mcp-config and an empty --mcp-config, so a server ' +
+            'written here will NOT be loaded by this account\'s Verse turns. It applies to the provider ' +
+            'CLI run outside Verse.');
+    }
+    if (!options.scope.allow) {
+        warnings.push('Locus is blocking writes in this scope; the apply step will refuse until the pin is healthy.');
+    }
+    else if (options.scope.scope.pinned && options.scope.scope.tenantRef !== null) {
+        warnings.push(`This write lands under the Locus tenant ${options.scope.scope.tenantRef}` +
+            `${options.scope.scope.aliasRef !== null ? ` (alias ${options.scope.scope.aliasRef})` : ''}.`);
+    }
+    else if (!options.scope.scope.pinned) {
+        warnings.push('Locus reports no pinned tenant, so this write is not attributable to a tenant scope.');
+    }
+    return {
+        ok: true,
+        server,
+        target: { id: target.id, ref: target.ref, label: target.label },
+        action,
+        replaces,
+        warnings,
+        scope: options.scope,
+        digest: verseMcpProposalDigest({ server, targetId: target.id, targetBytes: current.bytes }),
+        note: VERSE_MCP_PROPOSAL_NOTE,
+    };
+}
+export const VERSE_MCP_APPLIED_NOTE = 'Written. The server is listed above exactly as it was persisted, with every environment value ' +
+    'redacted. It takes effect the next time a client that reads this registry starts.';
+/**
+ * Apply a proposal the operator confirmed.
+ *
+ * Refuses unless the supplied digest reproduces from (a) the redacted spec it
+ * is about to write and (b) the target file's CURRENT bytes. That second half
+ * is what makes a stale confirmation fail instead of quietly clobbering a
+ * change made in between.
+ *
+ * The write is atomic: a sibling temp file, mode 0600, then rename.
+ */
+export function applyVerseMcpProposal(options) {
+    const proposal = buildVerseMcpProposal(options);
+    if (!proposal.ok)
+        return proposal;
+    if (!proposal.scope.allow) {
+        return {
+            ok: false,
+            refusal: 'mcp-scope-refused',
+            error: proposal.scope.blockers.join('; ') || 'Locus refused this scope',
+            note: 'Nothing was written. Locus owns scope for this surface; resolve the pin and retry.',
+        };
+    }
+    // Recomputed above against the file's CURRENT bytes. If the operator's
+    // digest does not match, either they never saw this disclosure or the file
+    // changed since they did. Both are refusals, and they are distinguishable
+    // only by re-proposing, so say so plainly rather than guessing which.
+    if (options.digest !== proposal.digest) {
+        return {
+            ok: false,
+            refusal: 'mcp-digest-mismatch',
+            error: 'the confirmation digest does not match this proposal. Either the target changed since ' +
+                'the proposal was shown, or the disclosure was not the one being confirmed.',
+            note: 'Nothing was written. Re-read the proposal and confirm the digest it returns.',
+        };
+    }
+    const home = options.home ?? homedir();
+    const resolved = resolveVerseMcpTarget(options.targetId, { accountsRoot: options.accountsRoot, home });
+    if (!resolved.ok) {
+        return { ok: false, refusal: resolved.refusal, error: resolved.error, note: 'Nothing was written.' };
+    }
+    const target = resolved.target;
+    const parsed = parseVerseMcpSpec(options.server);
+    /* c8 ignore next -- buildVerseMcpProposal already returned on an invalid spec. */
+    if (!parsed.ok) {
+        return { ok: false, refusal: 'mcp-spec-invalid', error: parsed.error, note: 'Nothing was written.' };
+    }
+    const current = readTarget(target.path);
+    let root = {};
+    if (current.bytes.length > 0) {
+        try {
+            const value = JSON.parse(current.bytes);
+            if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+                root = value;
+            }
+        }
+        catch {
+            return {
+                ok: false,
+                refusal: 'mcp-target-changed',
+                error: `${target.ref} is not readable as JSON, so it will not be rewritten`,
+                note: 'Nothing was written.',
+            };
+        }
+    }
+    const entry = { command: parsed.spec.command, args: parsed.spec.args };
+    if (parsed.spec.env !== undefined)
+        entry['env'] = parsed.spec.env;
+    const servers = root['mcpServers'] !== null && typeof root['mcpServers'] === 'object' && !Array.isArray(root['mcpServers'])
+        ? { ...root['mcpServers'] }
+        : {};
+    servers[parsed.spec.name] = entry;
+    const next = { ...root, mcpServers: servers };
+    const tmp = `${target.path}.ashlr-mcp-${process.pid}.tmp`;
+    try {
+        mkdirSync(dirname(target.path), { recursive: true, mode: 0o700 });
+        writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+        renameSync(tmp, target.path);
+    }
+    catch (error) {
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch { /* best effort */ }
+        return {
+            ok: false,
+            refusal: 'mcp-write-failed',
+            // The message is the filesystem's, which never carries an env value.
+            error: `could not write ${target.ref}: ${error instanceof Error ? error.message : 'unknown error'}`,
+            note: 'Nothing was written.',
+        };
+    }
+    // Re-read from disk so the caller sees what was actually persisted, not
+    // what we intended to persist. Same posture as the caps route.
+    const after = readTarget(target.path);
+    const persisted = after.servers[parsed.spec.name];
+    const spec = { name: parsed.spec.name, command: parsed.spec.command, args: parsed.spec.args, source: target.path };
+    if (persisted !== null && typeof persisted === 'object' && !Array.isArray(persisted)) {
+        const row = persisted;
+        if (typeof row['command'] === 'string')
+            spec.command = row['command'];
+        if (Array.isArray(row['args']))
+            spec.args = row['args'].filter((a) => typeof a === 'string');
+        if (row['env'] !== null && typeof row['env'] === 'object' && !Array.isArray(row['env'])) {
+            const env = {};
+            for (const [k, v] of Object.entries(row['env'])) {
+                if (typeof v === 'string')
+                    env[k] = v;
+            }
+            if (Object.keys(env).length > 0)
+                spec.env = env;
+        }
+    }
+    const view = projectMcpServerView(redactEnv(spec), home);
+    view.sourceRef = target.ref;
+    return {
+        ok: true,
+        action: proposal.action,
+        target: { id: target.id, ref: target.ref },
+        server: view,
+        note: VERSE_MCP_APPLIED_NOTE,
+    };
+}
+//# sourceMappingURL=mcp-mutation.js.map

package/dist/core/verse/mcp-mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-mutation.js","sourceRoot":"","sources":["../../../src/core/verse/mcp-mutation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAA2B,MAAM,oBAAoB,CAAC;AA6BpI,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,aAAa;IACb,iBAAiB;IACjB,MAAM;CACP,CAAC;AAYF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAU,EACV,OAAgD;IAEhD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAEvC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,gDAAgD,SAAS,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EACH,WAAW,SAAS,oEAAoE;gBACxF,2DAA2D;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC7C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,EAAE,EAAE,EAAsB;YAC1B,IAAI;YACJ,yEAAyE;YACzE,GAAG,EAAE,GAAG,SAAS,eAAe;YAChC,KAAK,EAAE,WAAW,SAAS,oBAAoB;SAChD;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,OAAO,GAAG,mCAAmC,CAAC;AACpD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AACpD,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,gFAAgF;AAChF,SAAS,SAAS,CAAC,KAAc,EAAE,QAAgB;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,GAAG,EAAE,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CACX,gBAAgB,OAAO,+DAA+D;YACtF,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,QAAQ,UAAU,EAAE,CAAC;QACxG,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;YAClF,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,GAAI,OAAoB,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,GAAuC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,YAAY,OAAO,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,EAAE,EAAE,CAAC;YAClF,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAC3C,sDAAsD;gBACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,GAAG,yCAAyC,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,GAAG,IAAI,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,MAAM,wBAAwB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;gBAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;gBACpF,yDAAyD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAkCD,MAAM,CAAC,MAAM,uBAAuB,GAClC,wFAAwF;IACxF,4FAA4F;IAC5F,2BAA2B,CAAC;AAE9B,sFAAsF;AACtF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IACD,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;YAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,QAAQ,GAAI,MAAkC,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClF,OAAO,GAAG,QAAmC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,OAAO,MAAM,CACX,SAAS,CAAC;QACR,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,QAAQ;QACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;KAChC,CAAC,CACH,CAAC;AACJ,CAAC;AAUD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAEvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACxG,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,sBAAsB;YAC/B,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,8DAA8D;YAClF,IAAI,EAAE,uBAAuB;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAsB,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACnF,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;IAE9B,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,QAAmC,CAAC;QAChD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,KAAK,GAAkB;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBACtB,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;gBACvB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;gBACpH,MAAM,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC;YACF,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxF,MAAM,QAAQ,GAA2B,EAAE,CAAC;gBAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAA4B,CAAC,EAAE,CAAC;oBAC3E,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC;YAC7D,CAAC;YACD,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;YACxD,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,uBAAuB,MAAM,CAAC,GAAG,0BAA0B;YAC9F,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,2FAA2F;YAC3F,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,8FAA8F;YAC9F,6FAA6F;YAC7F,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,8FAA8F,CAC/F,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CACX,2CAA2C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1E,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC9F,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CACX,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;QAC/D,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3F,IAAI,EAAE,uBAAuB;KAC9B,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,MAAM,sBAAsB,GACjC,gGAAgG;IAChG,mFAAmF,CAAC;AAOtF;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA6B;IAE7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,mBAAmB;YAC5B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B;YACvE,IAAI,EAAE,oFAAoF;SAC3F,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EACH,wFAAwF;gBACxF,4EAA4E;YAC9E,IAAI,EAAE,8EAA8E;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,kFAAkF;IAClF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACvG,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAY,CAAC;YACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,IAAI,GAAG,KAAgC,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,uDAAuD;gBAC3E,IAAI,EAAE,sBAAsB;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IAElE,MAAM,OAAO,GACX,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,YAAY,CAA6B,EAAE;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,cAAc,OAAO,CAAC,GAAG,MAAM,CAAC;IAC1D,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACzE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,kBAAkB;YAC3B,qEAAqE;YACrE,KAAK,EAAE,mBAAmB,MAAM,CAAC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACnG,IAAI,EAAE,sBAAsB;SAC7B,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClI,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,SAAoC,CAAC;QACjD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,GAAI,GAAG,CAAC,MAAM,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzH,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAA4B,CAAC,EAAE,CAAC;gBAC3E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QAClD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;IAE5B,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QAC1C,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,sBAAsB;KAC7B,CAAC;AACJ,CAAC"}

package/dist/core/verse/mcp-scope.d.ts

@@ -0,0 +1,114 @@
+/**
+ * core/verse/mcp-scope.ts — MCP scope, as reported by Locus.
+ *
+ * docs/VERSE-WORKSPACES.md §3: "a server appropriate for a personal account
+ * may be wrong for a client's. Locus already models exactly this — principal,
+ * tenant, sealed session — so scope should be asked of Locus rather than
+ * reinvented in the hub, and the hub should hold opaque references rather
+ * than copies of anything sensitive."
+ *
+ * So this module OWNS NO SCOPE. It asks `src/core/integrations/locus.ts` and
+ * projects the answer onto a transport shape. Two rules follow from that:
+ *
+ *   1. Every field here is an OPAQUE REFERENCE Locus already publishes in its
+ *      own `agent report --json` (alias, tenant, binding_id, principal). None
+ *      of them is a credential, and none of them is derived, inferred or
+ *      cached by the hub. When Locus says nothing, this says nothing — it
+ *      never substitutes a hub-local notion of "which account is this".
+ *   2. Mutation admission is NOT decided here either. It is decided by the
+ *      repo's existing pre-mutate gate (`assertLocusPreMutate`), whose mode
+ *      ladder (off | warn | enforce) is already the contract every other
+ *      spawn site in this repo obeys — see src/core/run/engines.ts:662. A new
+ *      surface inventing a stricter or looser rule than the dispatch path is
+ *      exactly the "reinvented in the hub" failure this file exists to avoid.
+ *
+ * Pure projection + one shell-out through locus.ts. Never throws.
+ */
+import { type LocusEnforceConfigInput, type LocusEnforceMode, type LocusProbeResult } from '../integrations/locus.js';
+/**
+ * Why scope is what it is. Machine-readable and verbatim — prose belongs in
+ * the web UI, the same split `VerseAccountRecord.reason` already uses.
+ */
+export type VerseMcpScopeReason = 
+/** `locus` is not installed or not on PATH. */
+'mcp-scope-locus-unavailable'
+/** Locus answered but reports no pin, so there is no tenant to scope to. */
+ | 'mcp-scope-unpinned'
+/** Pinned, but the seal did not verify. */
+ | 'mcp-scope-seal-unverified'
+/** Pinned, but the pin has expired. */
+ | 'mcp-scope-expired'
+/** Pinned and sealed. */
+ | 'mcp-scope-pinned';
+/**
+ * Locus's pin, projected for transport.
+ *
+ * Every `*Ref` is Locus's own opaque identifier, carried through unchanged so
+ * the operator can match it against `locus status` — never a hub-side copy of
+ * anything that authenticates.
+ */
+export interface VerseMcpScope {
+    /** False when the locus binary could not be run at all. */
+    available: boolean;
+    pinned: boolean;
+    /** Opaque Locus references. Null whenever Locus did not publish one. */
+    aliasRef: string | null;
+    tenantRef: string | null;
+    principalRef: string | null;
+    bindingRef: string | null;
+    sealOk: boolean | null;
+    expired: boolean | null;
+    frozen: boolean | null;
+    expiresAt: string | null;
+    /** Locus's own `status` and `status --oneline`, verbatim. */
+    status: string | null;
+    statusOneline: string | null;
+    reason: VerseMcpScopeReason;
+}
+/** The scope a mutation would be written under, plus whether it may proceed. */
+export interface VerseMcpScopeGate {
+    scope: VerseMcpScope;
+    /** The repo-wide pre-mutate mode: off | warn | enforce. */
+    mode: LocusEnforceMode;
+    /**
+     * False only when mode is `enforce` and Locus blocks. Mirrors
+     * `assertLocusPreMutate` exactly — this surface does not get its own rule.
+     */
+    allow: boolean;
+    /** Human-readable blockers from Locus. Never secrets. */
+    blockers: string[];
+}
+/**
+ * Project one `locus agent report --json` probe onto {@link VerseMcpScope}.
+ *
+ * Pure: pass a canned {@link LocusProbeResult} in tests rather than shelling
+ * out. An unavailable probe, a null report and a null pin are three different
+ * facts and each gets its own reason.
+ */
+export declare function projectVerseMcpScope(probe: LocusProbeResult): VerseMcpScope;
+/**
+ * Ask Locus for the current scope.
+ *
+ * `read` is the injection seam: production passes nothing and gets the real
+ * `locusAgentReport()` shell-out; tests pass a function returning a canned
+ * probe and never spawn anything. Never throws — locusAgentReport() already
+ * reports failure as `{available: false}` rather than raising.
+ */
+export declare function readVerseMcpScope(read?: () => LocusProbeResult): VerseMcpScope;
+/**
+ * The scope a write would land under, plus the repo's existing admission
+ * decision for it.
+ *
+ * `decide` and `read` are injection seams for tests. In production both shell
+ * out to Locus once each.
+ */
+export declare function readVerseMcpScopeGate(options?: {
+    read?: () => LocusProbeResult;
+    decide?: () => {
+        allow: boolean;
+        mode: LocusEnforceMode;
+        blockers: string[];
+    };
+    env?: NodeJS.ProcessEnv;
+    config?: LocusEnforceConfigInput;
+}): VerseMcpScopeGate;