@axtary/mcp 0.0.1 → 0.2.0

package/dist/oauth.js

@@ -0,0 +1,449 @@
+import { createHash, randomBytes } from "node:crypto";
+import { z } from "zod";
+// Remote-MCP OAuth discovery and request building (provider-neutral).
+//
+// This module implements the protocol half of the MCP authorization spec
+// (2025-06-18): given a remote MCP endpoint, discover its authorization server
+// from RFC 9728 Protected Resource Metadata, then RFC 8414 Authorization Server
+// Metadata; build OAuth 2.1 Authorization-Code + PKCE (RFC 7636) requests that
+// carry the RFC 8707 `resource` parameter binding the token to this exact MCP
+// server; optionally register a public client via RFC 7591 Dynamic Client
+// Registration. It performs no browser/loopback I/O and stores no secrets — the
+// CLI drives the loopback consent and persists the bearer in the local
+// credential broker. Every function takes an injectable `fetch` so the whole
+// flow is deterministically testable against a mock AS + RS.
+//
+// References (verified against primary docs 2026-06-23):
+//   - MCP Authorization, spec 2025-06-18
+//   - RFC 9728 OAuth 2.0 Protected Resource Metadata
+//   - RFC 8414 OAuth 2.0 Authorization Server Metadata
+//   - RFC 8707 Resource Indicators for OAuth 2.0
+//   - RFC 7636 PKCE
+//   - RFC 7591 OAuth 2.0 Dynamic Client Registration
+export const PROTECTED_RESOURCE_WELL_KNOWN = "/.well-known/oauth-protected-resource";
+export const AUTHORIZATION_SERVER_WELL_KNOWN = "/.well-known/oauth-authorization-server";
+export const OPENID_CONFIGURATION_WELL_KNOWN = "/.well-known/openid-configuration";
+/**
+ * The canonical resource identifier for an MCP server, per RFC 8707 §2 and the
+ * MCP spec's "Canonical Server URI" rules: lowercase scheme + host, no fragment,
+ * no trailing slash (unless the path is just "/"). This exact string is the
+ * `resource` parameter and must match the `resource` field of the Protected
+ * Resource Metadata document.
+ */
+export function canonicalResourceUri(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("mcp_oauth_invalid_resource_url");
+    }
+    if (url.hash) {
+        throw new Error("mcp_oauth_resource_uri_has_fragment");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error(`mcp_oauth_resource_uri_unsupported_scheme:${url.protocol}`);
+    }
+    const scheme = url.protocol.toLowerCase();
+    const host = url.host.toLowerCase();
+    let path = url.pathname;
+    if (path === "/") {
+        path = "";
+    }
+    else if (path.endsWith("/")) {
+        path = path.slice(0, -1);
+    }
+    // Query and fragment are intentionally dropped: the canonical identifier is
+    // scheme + authority + path only.
+    return `${scheme}//${host}${path}`;
+}
+/**
+ * Allow `https://` always; allow `http://` only for loopback hosts. The MCP
+ * authorization spec requires all authorization-server endpoints to be served
+ * over HTTPS — we never send a bearer, code, or verifier in cleartext to a
+ * remote host. Loopback stays permitted for local conformance servers.
+ */
+export function assertSafeOAuthEndpoint(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("mcp_oauth_invalid_endpoint_url");
+    }
+    if (url.protocol === "https:") {
+        return url;
+    }
+    if (url.protocol === "http:") {
+        const host = url.hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]") {
+            return url;
+        }
+        throw new Error("mcp_oauth_insecure_endpoint:http_allowed_only_for_localhost");
+    }
+    throw new Error(`mcp_oauth_unsupported_scheme:${url.protocol}`);
+}
+/**
+ * Parse an RFC 7235 `WWW-Authenticate` header far enough to recover the RFC 9728
+ * `resource_metadata` and (optionally) `scope` from a Bearer challenge. We only
+ * need quoted/unquoted token68-free `key=value` auth params, which is what real
+ * MCP resource servers emit.
+ */
+export function parseWwwAuthenticate(header) {
+    const trimmed = header.trim();
+    if (trimmed.length === 0) {
+        return null;
+    }
+    const spaceIndex = trimmed.indexOf(" ");
+    const scheme = spaceIndex === -1 ? trimmed : trimmed.slice(0, spaceIndex);
+    const remainder = spaceIndex === -1 ? "" : trimmed.slice(spaceIndex + 1);
+    const params = {};
+    const paramPattern = /([a-zA-Z0-9_-]+)\s*=\s*(?:"([^"]*)"|([^\s,]+))/g;
+    let match;
+    while ((match = paramPattern.exec(remainder)) !== null) {
+        const key = match[1].toLowerCase();
+        const value = match[2] !== undefined ? match[2] : (match[3] ?? "");
+        params[key] = value;
+    }
+    return { scheme: scheme.toLowerCase(), params };
+}
+const ProtectedResourceMetadataSchema = z.object({
+    resource: z.string().min(1),
+    authorization_servers: z.array(z.string().min(1)).optional(),
+    scopes_supported: z.array(z.string()).optional(),
+    resource_name: z.string().optional(),
+});
+const AuthorizationServerMetadataSchema = z.object({
+    issuer: z.string().min(1),
+    authorization_endpoint: z.string().min(1),
+    token_endpoint: z.string().min(1),
+    registration_endpoint: z.string().min(1).optional(),
+    response_types_supported: z.array(z.string()).optional(),
+    grant_types_supported: z.array(z.string()).optional(),
+    code_challenge_methods_supported: z.array(z.string()).optional(),
+    scopes_supported: z.array(z.string()).optional(),
+    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+});
+/**
+ * Build the RFC 9728 Protected Resource Metadata URL from an MCP server URL. The
+ * well-known segment is inserted between host and path (path-aware), matching
+ * RFC 9728 §3.1, so `https://h/mcp` → `https://h/.well-known/oauth-protected-resource/mcp`.
+ */
+export function protectedResourceMetadataUrl(mcpUrl) {
+    const url = new URL(mcpUrl);
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return `${url.protocol}//${url.host}${PROTECTED_RESOURCE_WELL_KNOWN}${path}`;
+}
+/**
+ * Candidate RFC 8414 Authorization Server Metadata URLs for an issuer, tried in
+ * order. RFC 8414 inserts the well-known segment between host and path; we also
+ * fall back to the OpenID Connect discovery document, which many real
+ * authorization servers (including ones fronting MCP) serve instead.
+ */
+export function authorizationServerMetadataUrls(issuer) {
+    const url = new URL(issuer);
+    const hasPath = url.pathname !== "/" && url.pathname !== "";
+    const path = hasPath ? url.pathname.replace(/\/$/, "") : "";
+    const base = `${url.protocol}//${url.host}`;
+    if (!hasPath) {
+        return [
+            `${base}${AUTHORIZATION_SERVER_WELL_KNOWN}`,
+            `${base}${OPENID_CONFIGURATION_WELL_KNOWN}`,
+        ];
+    }
+    return [
+        `${base}${AUTHORIZATION_SERVER_WELL_KNOWN}${path}`,
+        `${base}${path}${AUTHORIZATION_SERVER_WELL_KNOWN}`,
+        `${base}${OPENID_CONFIGURATION_WELL_KNOWN}${path}`,
+        `${base}${path}${OPENID_CONFIGURATION_WELL_KNOWN}`,
+    ];
+}
+/**
+ * Discover Protected Resource Metadata for an MCP server. Prefers the
+ * `resource_metadata` URL advertised in a 401 `WWW-Authenticate` header (RFC
+ * 9728 §5.1); otherwise derives the well-known URL from the MCP endpoint. The
+ * returned `resource` must equal the canonical MCP URI or we fail closed rather
+ * than request a token for the wrong audience.
+ */
+export async function discoverProtectedResourceMetadata(input) {
+    const fetchImpl = input.fetch ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error("mcp_oauth_fetch_required");
+    }
+    const advertised = input.wwwAuthenticate
+        ? parseWwwAuthenticate(input.wwwAuthenticate)?.params.resource_metadata
+        : undefined;
+    const metadataUrl = advertised ?? protectedResourceMetadataUrl(input.mcpUrl);
+    assertSafeOAuthEndpoint(metadataUrl);
+    const response = await fetchJson(fetchImpl, metadataUrl, input.timeoutMs);
+    const parsed = ProtectedResourceMetadataSchema.safeParse(response);
+    if (!parsed.success) {
+        throw new Error("mcp_oauth_invalid_protected_resource_metadata");
+    }
+    const servers = parsed.data.authorization_servers ?? [];
+    if (servers.length === 0) {
+        throw new Error("mcp_oauth_no_authorization_servers");
+    }
+    for (const server of servers) {
+        assertSafeOAuthEndpoint(server);
+    }
+    const expectedResource = canonicalResourceUri(input.mcpUrl);
+    const advertisedResource = canonicalResourceUri(parsed.data.resource);
+    if (advertisedResource !== expectedResource) {
+        throw new Error(`mcp_oauth_resource_mismatch:${advertisedResource}!=${expectedResource}`);
+    }
+    return {
+        resource: advertisedResource,
+        authorizationServers: servers,
+        scopesSupported: parsed.data.scopes_supported ?? [],
+        resourceName: parsed.data.resource_name ?? null,
+        metadataUrl,
+    };
+}
+/**
+ * Discover RFC 8414 Authorization Server Metadata for an issuer, trying the
+ * path-aware well-known URLs and the OpenID fallback in order. The metadata's
+ * `issuer` must equal the requested issuer (RFC 8414 §3.3), and the
+ * authorization/token endpoints must be HTTPS (or loopback) or we fail closed.
+ */
+export async function discoverAuthorizationServerMetadata(input) {
+    const fetchImpl = input.fetch ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error("mcp_oauth_fetch_required");
+    }
+    assertSafeOAuthEndpoint(input.issuer);
+    const candidates = authorizationServerMetadataUrls(input.issuer);
+    let lastError = null;
+    for (const candidate of candidates) {
+        let response;
+        try {
+            response = await fetchJson(fetchImpl, candidate, input.timeoutMs);
+        }
+        catch (error) {
+            lastError = error;
+            continue;
+        }
+        const parsed = AuthorizationServerMetadataSchema.safeParse(response);
+        if (!parsed.success) {
+            lastError = new Error("mcp_oauth_invalid_authorization_server_metadata");
+            continue;
+        }
+        if (normalizeIssuer(parsed.data.issuer) !== normalizeIssuer(input.issuer)) {
+            throw new Error(`mcp_oauth_issuer_mismatch:${parsed.data.issuer}!=${input.issuer}`);
+        }
+        assertSafeOAuthEndpoint(parsed.data.authorization_endpoint);
+        assertSafeOAuthEndpoint(parsed.data.token_endpoint);
+        if (parsed.data.registration_endpoint) {
+            assertSafeOAuthEndpoint(parsed.data.registration_endpoint);
+        }
+        return {
+            issuer: parsed.data.issuer,
+            authorizationEndpoint: parsed.data.authorization_endpoint,
+            tokenEndpoint: parsed.data.token_endpoint,
+            registrationEndpoint: parsed.data.registration_endpoint ?? null,
+            codeChallengeMethodsSupported: parsed.data.code_challenge_methods_supported ?? [],
+            scopesSupported: parsed.data.scopes_supported ?? [],
+            grantTypesSupported: parsed.data.grant_types_supported ?? [],
+            metadataUrl: candidate,
+        };
+    }
+    throw new Error(`mcp_oauth_authorization_server_metadata_unreachable:${lastError instanceof Error ? lastError.message : "unknown"}`);
+}
+/** Create an RFC 7636 PKCE verifier/challenge pair (S256). */
+export function createPkcePair(randomVerifier) {
+    const verifier = (randomVerifier ?? (() => base64Url(randomBytes(32))))();
+    const challenge = base64Url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge, method: "S256" };
+}
+/** Create an anti-CSRF `state` value for the authorization request. */
+export function createOAuthState(randomState) {
+    return (randomState ?? (() => base64Url(randomBytes(24))))();
+}
+/**
+ * Build the OAuth 2.1 authorization-request URL. The RFC 8707 `resource`
+ * parameter is always included and set to the canonical MCP URI (MUST per the
+ * MCP spec, regardless of AS support), alongside PKCE `code_challenge` and the
+ * anti-CSRF `state`.
+ */
+export function buildAuthorizationUrl(input) {
+    const url = new URL(input.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("state", input.state);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("resource", input.resource);
+    if (input.scopes.length > 0) {
+        url.searchParams.set("scope", input.scopes.join(" "));
+    }
+    for (const [key, value] of Object.entries(input.extraParams ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    return url.toString();
+}
+const TokenResponseSchema = z.object({
+    access_token: z.string().min(1),
+    token_type: z.string().optional(),
+    refresh_token: z.string().min(1).optional(),
+    scope: z.string().optional(),
+    expires_in: z.number().optional(),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+});
+/**
+ * Exchange an authorization code for tokens at the token endpoint. Sends the
+ * RFC 7636 `code_verifier` and the RFC 8707 `resource` parameter so the issued
+ * token is audience-bound to this MCP server. Public-client form (no secret) is
+ * the default; a confidential client secret is included only when supplied.
+ */
+export async function exchangeAuthorizationCode(input) {
+    const values = {
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        client_id: input.clientId,
+        code_verifier: input.codeVerifier,
+        resource: input.resource,
+    };
+    if (input.clientSecret) {
+        values.client_secret = input.clientSecret;
+    }
+    return postTokenRequest({
+        tokenEndpoint: input.tokenEndpoint,
+        values,
+        fetch: input.fetch,
+        timeoutMs: input.timeoutMs,
+    });
+}
+/**
+ * Refresh an access token. Per OAuth 2.1 the `resource` parameter is repeated so
+ * the refreshed token keeps the same audience; the requested `scope` is narrowed
+ * to what was originally granted (never broadened).
+ */
+export async function refreshAccessToken(input) {
+    const values = {
+        grant_type: "refresh_token",
+        refresh_token: input.refreshToken,
+        client_id: input.clientId,
+        resource: input.resource,
+    };
+    if (input.clientSecret) {
+        values.client_secret = input.clientSecret;
+    }
+    if (input.scopes && input.scopes.length > 0) {
+        values.scope = input.scopes.join(" ");
+    }
+    return postTokenRequest({
+        tokenEndpoint: input.tokenEndpoint,
+        values,
+        fetch: input.fetch,
+        timeoutMs: input.timeoutMs,
+    });
+}
+const RegistrationResponseSchema = z.object({
+    client_id: z.string().min(1),
+    client_secret: z.string().min(1).optional(),
+    client_id_issued_at: z.number().optional(),
+    client_secret_expires_at: z.number().optional(),
+});
+/**
+ * Register a public OAuth client via RFC 7591 Dynamic Client Registration. We
+ * register as a public client using PKCE (`token_endpoint_auth_method: none`)
+ * with the loopback redirect and the authorization-code grant, so no client
+ * secret is needed or stored. Returns the issued client id.
+ */
+export async function registerOAuthClient(input) {
+    const fetchImpl = input.fetch ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error("mcp_oauth_fetch_required");
+    }
+    assertSafeOAuthEndpoint(input.registrationEndpoint);
+    const body = {
+        client_name: input.clientName,
+        redirect_uris: input.redirectUris,
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+    };
+    if (input.scopes && input.scopes.length > 0) {
+        body.scope = input.scopes.join(" ");
+    }
+    const response = await fetchImpl(input.registrationEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        signal: timeoutSignal(input.timeoutMs),
+    });
+    const json = (await response.json());
+    if (!response.ok) {
+        throw new Error(`mcp_oauth_registration_failed:${response.status}`);
+    }
+    const parsed = RegistrationResponseSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new Error("mcp_oauth_invalid_registration_response");
+    }
+    return {
+        clientId: parsed.data.client_id,
+        clientSecret: parsed.data.client_secret ?? null,
+    };
+}
+async function postTokenRequest(input) {
+    const fetchImpl = input.fetch ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error("mcp_oauth_fetch_required");
+    }
+    assertSafeOAuthEndpoint(input.tokenEndpoint);
+    const response = await fetchImpl(input.tokenEndpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body: new URLSearchParams(input.values).toString(),
+        signal: timeoutSignal(input.timeoutMs),
+    });
+    const json = (await response.json().catch(() => null));
+    const parsed = TokenResponseSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new Error(`mcp_oauth_token_request_failed:${response.status}`);
+    }
+    if (parsed.data.error) {
+        throw new Error(`mcp_oauth_token_error:${parsed.data.error}`);
+    }
+    if (!response.ok) {
+        throw new Error(`mcp_oauth_token_request_failed:${response.status}`);
+    }
+    const scopeRaw = parsed.data.scope ?? "";
+    return {
+        accessToken: parsed.data.access_token,
+        refreshToken: parsed.data.refresh_token ?? null,
+        tokenType: parsed.data.token_type ?? "Bearer",
+        scope: scopeRaw ? scopeRaw.split(/\s+/).filter(Boolean) : [],
+        expiresIn: parsed.data.expires_in ?? null,
+    };
+}
+async function fetchJson(fetchImpl, url, timeoutMs) {
+    const response = await fetchImpl(url, {
+        headers: { accept: "application/json" },
+        signal: timeoutSignal(timeoutMs),
+    });
+    if (!response.ok) {
+        throw new Error(`mcp_oauth_metadata_status:${response.status}`);
+    }
+    return (await response.json());
+}
+function timeoutSignal(timeoutMs) {
+    return AbortSignal.timeout(timeoutMs ?? 15_000);
+}
+function normalizeIssuer(issuer) {
+    return issuer.replace(/\/$/, "");
+}
+function base64Url(buffer) {
+    return buffer
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,yDAAyD;AACzD,yCAAyC;AACzC,qDAAqD;AACrD,uDAAuD;AACvD,iDAAiD;AACjD,oBAAoB;AACpB,qDAAqD;AAErD,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAAC;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,yCAAyC,CAAC;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG,mCAAmC,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAExB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,kCAAkC;IAClC,OAAO,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACvF,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,iDAAiD,CAAC;IACvE,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAUH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,gCAAgC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,qCAAqC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC;AAaH;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzE,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,6BAA6B,GAAG,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,GAAG,IAAI,GAAG,+BAA+B,EAAE;YAC3C,GAAG,IAAI,GAAG,+BAA+B,EAAE;SAC5C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI,GAAG,+BAA+B,GAAG,IAAI,EAAE;QAClD,GAAG,IAAI,GAAG,IAAI,GAAG,+BAA+B,EAAE;QAClD,GAAG,IAAI,GAAG,+BAA+B,GAAG,IAAI,EAAE;QAClD,GAAG,IAAI,GAAG,IAAI,GAAG,+BAA+B,EAAE;KACnD,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAoB;IAEpB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAElD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe;QACtC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,iBAAiB;QACvE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,WAAW,GAAG,UAAU,IAAI,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE7E,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAExD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEtE,IAAI,kBAAkB,KAAK,gBAAgB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+BAA+B,kBAAkB,KAAK,gBAAgB,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,oBAAoB,EAAE,OAAO;QAC7B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE;QACnD,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI;QAC/C,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAIzD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAElD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,UAAU,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,GAAY,IAAI,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,QAAiB,CAAC;QAEtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,iCAAiC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,SAAS,GAAG,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC5D,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEpD,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB;YACzD,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc;YACzC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,IAAI;YAC/D,6BAA6B,EAC3B,MAAM,CAAC,IAAI,CAAC,gCAAgC,IAAI,EAAE;YACpD,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE;YACnD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE;YAC5D,WAAW,EAAE,SAAS;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uDACE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SACnD,EAAE,CACH,CAAC;AACJ,CAAC;AAID,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,cAA6B;IAC1D,MAAM,QAAQ,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KASrC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAUD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAU/C;IACC,MAAM,MAAM,GAA2B;QACrC,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IAC5C,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KASxC;IACC,MAAM,MAAM,GAA2B;QACrC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAOH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAElD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAuB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAEpD,MAAM,IAAI,GAA4B;QACpC,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,MAAM;KACnC,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,oBAAoB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IAEhD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAE1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QAC/B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI;KAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAK/B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAElD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QAClD,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC;IAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAEzC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI;QAC/C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ;QAC7C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,SAAuB,EACvB,GAAW,EACX,SAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB;IACvC,OAAO,WAAW,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM;SACV,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC"}

package/dist/pins.d.ts

@@ -0,0 +1,179 @@
+import { z } from "zod";
+import type { McpToolDefinitionRecord } from "./core.js";
+export declare const MCP_PINS_SCHEMA_VERSION = "axtary.mcp_pins.v1";
+/** Legacy hash-only manifest; still loadable and upgraded in place. */
+export declare const MCP_PINS_SCHEMA_VERSION_V0 = "axtary.mcp_pins.v0";
+/**
+ * A pin is the human-reviewed, persisted identity of an MCP tool: the exact
+ * `definitionHash` that was approved for governance. Provenance enforcement is
+ * only meaningful if it survives across sessions — otherwise a server that
+ * poisons a tool definition between launches is silently re-trusted. The pin
+ * manifest is that durable record; the `description` is kept solely so a human
+ * can diff old vs new at review time.
+ *
+ * v1 adds publisher provenance (`publisher`/`kid`/`semver`) and the version
+ * chain link (`priorDefinitionHash`): the hash of the version this pin
+ * supersedes. The chain is what makes a silent re-definition (rug pull)
+ * detectable — a new signed version must reference the version it replaces and
+ * bump its semver. These fields are nullable so a hash-only (unsigned) pin and
+ * a legacy v0 manifest remain valid.
+ */
+export declare const McpToolPinSchema: z.ZodObject<{
+    toolName: z.ZodString;
+    definitionHash: z.ZodString;
+    schemaVersion: z.ZodString;
+    description: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    pinnedAt: z.ZodString;
+    publisher: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    kid: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    semver: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    priorDefinitionHash: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type McpToolPin = z.infer<typeof McpToolPinSchema>;
+/** Provenance carried from a verified signed definition into a new pin. */
+export type McpPinProvenance = {
+    publisher: string;
+    kid: string;
+    semver: string;
+    priorDefinitionHash: string | null;
+};
+export declare const McpServerPinsSchema: z.ZodObject<{
+    serverIdentity: z.ZodString;
+    serverVersion: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        toolName: z.ZodString;
+        definitionHash: z.ZodString;
+        schemaVersion: z.ZodString;
+        description: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        pinnedAt: z.ZodString;
+        publisher: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        kid: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        semver: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        priorDefinitionHash: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type McpServerPins = z.infer<typeof McpServerPinsSchema>;
+export declare const McpPinManifestSchema: z.ZodPipe<z.ZodObject<{
+    schemaVersion: z.ZodUnion<readonly [z.ZodLiteral<"axtary.mcp_pins.v1">, z.ZodLiteral<"axtary.mcp_pins.v0">]>;
+    servers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        serverIdentity: z.ZodString;
+        serverVersion: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            toolName: z.ZodString;
+            definitionHash: z.ZodString;
+            schemaVersion: z.ZodString;
+            description: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            pinnedAt: z.ZodString;
+            publisher: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            kid: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            semver: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            priorDefinitionHash: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodTransform<{
+    schemaVersion: string;
+    servers: {
+        serverIdentity: string;
+        serverVersion: string | null;
+        tools: {
+            toolName: string;
+            definitionHash: string;
+            schemaVersion: string;
+            description: string | null;
+            pinnedAt: string;
+            publisher: string | null;
+            kid: string | null;
+            semver: string | null;
+            priorDefinitionHash: string | null;
+        }[];
+    }[];
+}, {
+    schemaVersion: "axtary.mcp_pins.v1" | "axtary.mcp_pins.v0";
+    servers: {
+        serverIdentity: string;
+        serverVersion: string | null;
+        tools: {
+            toolName: string;
+            definitionHash: string;
+            schemaVersion: string;
+            description: string | null;
+            pinnedAt: string;
+            publisher: string | null;
+            kid: string | null;
+            semver: string | null;
+            priorDefinitionHash: string | null;
+        }[];
+    }[];
+}>>;
+export type McpPinManifest = z.infer<typeof McpPinManifestSchema>;
+export type McpPinStatus = "pinned" | "new" | "drifted";
+export type McpPinReconcileEntry = {
+    status: McpPinStatus;
+    serverIdentity: string;
+    toolName: string;
+    /** Hash the upstream is advertising right now. */
+    discoveredHash: string;
+    discoveredDescription: string | null;
+    /** Hash that was previously pinned, when one exists (pinned/drifted). */
+    pinnedHash: string | null;
+    pinnedDescription: string | null;
+};
+export declare function emptyMcpPinManifest(): McpPinManifest;
+export declare function parseMcpPinManifest(input: unknown): McpPinManifest;
+/**
+ * Load the pin manifest. A missing file is the legitimate first-use state and
+ * yields an empty manifest; a present-but-corrupt file fails loud (we never
+ * silently fall back to "trust everything").
+ */
+export declare function loadMcpPinManifest(path: string): Promise<McpPinManifest>;
+export declare function saveMcpPinManifest(path: string, manifest: McpPinManifest): Promise<void>;
+export declare function findMcpToolPin(manifest: McpPinManifest, serverIdentity: string, toolName: string): McpToolPin | undefined;
+/**
+ * Compare what the upstream advertises now against the persisted pins. Pure:
+ * no IO, no mutation. This is the heart of cross-session drift detection.
+ */
+export declare function reconcileMcpPins(manifest: McpPinManifest, definitions: McpToolDefinitionRecord[]): McpPinReconcileEntry[];
+/**
+ * Return a new manifest with the given definitions pinned at their current
+ * hash. Used both for trust-on-first-use (new tools) and for the explicit
+ * `mcp review --accept` path (drifted tools). Never mutates the input.
+ */
+export declare function pinMcpDefinitions(manifest: McpPinManifest, definitions: McpToolDefinitionRecord[], options?: {
+    now?: () => string;
+    /**
+     * Provenance for a definition being pinned, keyed by `definitionHash`.
+     * When present, the pin records the publisher identity and version chain;
+     * when absent, the pin is hash-only (unsigned), exactly as in v0.
+     */
+    provenance?: (definition: McpToolDefinitionRecord) => McpPinProvenance | undefined;
+}): McpPinManifest;
+/**
+ * The verdict for a candidate (signed) definition against the pinned history.
+ * This is the rug-pull defense at the chain level: a new signed version is
+ * only "continuous" if it both references the version it supersedes and bumps
+ * its semver. Anything else is surfaced, never silently accepted.
+ */
+export type McpChainVerdict = "first_pin" | "unchanged" | "continuous" | "version_not_incremented" | "broken_chain";
+export type McpChainEvaluation = {
+    verdict: McpChainVerdict;
+    /** Stable reason code when the chain does not advance cleanly. */
+    reason: string | null;
+};
+/**
+ * Pure: compare a verified candidate against the current pin. No IO. Used by
+ * the review/accept path to decide whether a drifted-but-signed definition is
+ * a legitimate next version or a broken/regressed chain that needs a human.
+ */
+export declare function evaluateMcpVersionChain(input: {
+    pin: McpToolPin | undefined;
+    candidateHash: string;
+    candidateSemver: string | null;
+    candidatePriorHash: string | null;
+}): McpChainEvaluation;
+/**
+ * Deterministic semver ordering: numeric major.minor.patch, then prerelease
+ * (a build *with* a prerelease tag is lower than the same release without).
+ * Returns <0, 0, or >0.
+ */
+export declare function compareSemver(left: string, right: string): number;
+//# sourceMappingURL=pins.d.ts.map

package/dist/pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pins.d.ts","sourceRoot":"","sources":["../src/pins.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAc3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAa5B,CAAC;AACN,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAExD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,yEAAyE;IACzE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAElE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAc9E;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC,CAMf;AASD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,GACf,UAAU,GAAG,SAAS,CAIxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,uBAAuB,EAAE,GACrC,oBAAoB,EAAE,CAkCxB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,uBAAuB,EAAE,EACtC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,uBAAuB,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAC/E,GACL,cAAc,CA4ChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,WAAW,GACX,YAAY,GACZ,yBAAyB,GACzB,cAAc,CAAC;AAEnB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,GAAG,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,GAAG,kBAAkB,CA0BrB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWjE"}