@axtary/mcp 0.1.0 → 0.2.0

package/dist/signing.js

@@ -0,0 +1,429 @@
+import { generateKeyPairSync, createPrivateKey, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { decodeProtectedHeader, importJWK, jwtVerify, SignJWT, } from "jose";
+import { z } from "zod";
+import { createMcpToolHandler, hashMcpToolDefinition, mcpToolResource, } from "./core.js";
+/**
+ * A signed MCP tool definition gives a tool a *publisher identity* and an
+ * immutable, versioned lineage on top of the content hash that
+ * `@axtary/mcp` already computes. This is the Axtary profile of the ETDI idea
+ * (arXiv:2506.01333): the publisher signs the exact `definitionHash`, a
+ * semantic version, the required scopes, and a pointer to the prior version's
+ * hash. A client rejects any definition that is unsigned, signed by an
+ * unknown key, mis-signed, or whose on-the-wire bytes no longer hash to the
+ * signed `definitionHash` — and it rejects it *before* the tool is invoked.
+ *
+ * We stay on the JOSE/ES256 profile already used by the ActionPass issuer
+ * keyring; the signature is a compact JWT (`statement+jwt`).
+ */
+export const MCP_SIGNED_DEFINITION_PROFILE = "axtary.mcp_signed_definition.v1";
+export const MCP_SIGNED_DEFINITION_TYP = "axtary-mcp-tool-definition+jwt";
+export const MCP_PUBLISHER_KEYRING_VERSION = "axtary.mcp_publisher_keyring.v0";
+export const MCP_PUBLISHER_TRUST_VERSION = "axtary.mcp_publisher_trust.v0";
+export const MCP_SIGNED_DEFINITION_REGISTRY_VERSION = "axtary.mcp_signed_definition_registry.v0";
+const SemverSchema = z
+    .string()
+    .regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/, "mcp_semver_invalid");
+/**
+ * The claims the publisher signs. `definitionHash` binds the signature to the
+ * exact tool definition; `priorDefinitionHash` links this version to the one
+ * it supersedes so a rug-pull (silent re-definition) is visible as a chain.
+ */
+export const McpSignedDefinitionClaimsSchema = z.object({
+    iss: z.string().min(1),
+    sub: z.string().min(1),
+    iat: z.number().int().positive(),
+    axtary_mcp_profile: z.literal(MCP_SIGNED_DEFINITION_PROFILE),
+    serverIdentity: z.string().min(1),
+    toolName: z.string().min(1),
+    schemaVersion: z.string().min(1),
+    definitionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    semver: SemverSchema,
+    requiredScopes: z.array(z.string().min(1)).default([]),
+    priorDefinitionHash: z
+        .string()
+        .regex(/^sha256:[a-f0-9]{64}$/)
+        .nullable()
+        .default(null),
+});
+/** A public publisher key, JWKS-shaped, resolvable by `kid`. */
+export const McpPublisherKeySchema = z.object({
+    kid: z.string().min(1),
+    kty: z.string().min(1),
+    crv: z.string().min(1),
+    x: z.string().min(1),
+    y: z.string().min(1),
+    alg: z.literal("ES256").default("ES256"),
+    use: z.literal("sig").default("sig"),
+});
+const McpPublisherKeyRecordSchema = McpPublisherKeySchema.extend({
+    privateKeyPem: z.string().min(1),
+    createdAt: z.string().min(1),
+});
+export const McpPublisherKeyringSchema = z.object({
+    schemaVersion: z.literal(MCP_PUBLISHER_KEYRING_VERSION),
+    publisher: z.string().min(1),
+    activeKid: z.string().min(1),
+    keys: z.array(McpPublisherKeyRecordSchema).min(1),
+});
+/**
+ * The verifier-side trust anchor: a configured map of publisher identity to
+ * the public keys we will accept signatures from. A signature whose `kid` is
+ * not in this store is rejected — there is no trust-on-first-use for
+ * *signatures* (that would defeat publisher identity); TOFU stays at the pin
+ * layer, which is a deliberate, separate, human-reviewed decision.
+ */
+export const McpPublisherTrustEntrySchema = z.object({
+    publisher: z.string().min(1),
+    keys: z.array(McpPublisherKeySchema).min(1),
+});
+export const McpPublisherTrustStoreSchema = z.object({
+    schemaVersion: z.literal(MCP_PUBLISHER_TRUST_VERSION),
+    publishers: z.array(McpPublisherTrustEntrySchema).default([]),
+});
+export const McpSignedDefinitionRegistryEntrySchema = z.object({
+    serverIdentity: z.string().min(1),
+    toolName: z.string().min(1),
+    publisher: z.string().min(1),
+    statement: z.string().min(1),
+});
+export const McpSignedDefinitionRegistrySchema = z.object({
+    schemaVersion: z.literal(MCP_SIGNED_DEFINITION_REGISTRY_VERSION),
+    statements: z.array(McpSignedDefinitionRegistryEntrySchema).default([]),
+});
+/**
+ * Publisher-side: sign a tool definition. The signature commits to the exact
+ * `definitionHash`, so a later byte-level change to the definition cannot be
+ * presented under this signature.
+ */
+export async function signMcpToolDefinition(input) {
+    const semver = SemverSchema.parse(input.semver);
+    const definitionHash = hashMcpToolDefinition(input.definition);
+    const serverIdentity = input.definition.serverIdentity;
+    const toolName = input.definition.name;
+    const issuedAt = Math.floor((input.now ?? new Date()).getTime() / 1000);
+    const claims = McpSignedDefinitionClaimsSchema.parse({
+        iss: input.publisher,
+        sub: mcpToolResource(serverIdentity, toolName),
+        iat: issuedAt,
+        axtary_mcp_profile: MCP_SIGNED_DEFINITION_PROFILE,
+        serverIdentity,
+        toolName,
+        schemaVersion: input.definition.schemaVersion,
+        definitionHash,
+        semver,
+        requiredScopes: input.requiredScopes ?? [],
+        priorDefinitionHash: input.priorDefinitionHash ?? null,
+    });
+    const statement = await new SignJWT({
+        axtary_mcp_profile: claims.axtary_mcp_profile,
+        serverIdentity: claims.serverIdentity,
+        toolName: claims.toolName,
+        schemaVersion: claims.schemaVersion,
+        definitionHash: claims.definitionHash,
+        semver: claims.semver,
+        requiredScopes: claims.requiredScopes,
+        priorDefinitionHash: claims.priorDefinitionHash,
+    })
+        .setProtectedHeader({
+        alg: "ES256",
+        kid: input.keyId,
+        typ: MCP_SIGNED_DEFINITION_TYP,
+    })
+        .setIssuer(claims.iss)
+        .setSubject(claims.sub)
+        .setIssuedAt(issuedAt)
+        .sign(input.signingKey);
+    return { statement, claims };
+}
+/**
+ * Verifier-side: verify a signed definition against a known publisher key and
+ * the *actual* tool definition presented now. Fails closed on every distinct
+ * failure with a stable reason. The `definitionHash` recomputed from the live
+ * definition must equal the signed hash — that is the altered-definition /
+ * tool-poisoning rejection.
+ */
+export async function verifyMcpSignedDefinition(input) {
+    let header;
+    try {
+        header = decodeProtectedHeader(input.statement);
+    }
+    catch {
+        throw new Error("mcp_signature_malformed");
+    }
+    if (header.typ !== MCP_SIGNED_DEFINITION_TYP) {
+        throw new Error("mcp_signature_type_invalid");
+    }
+    if (!header.kid) {
+        throw new Error("mcp_signature_key_id_required");
+    }
+    const key = await input.verificationKeys(header.kid);
+    if (!key) {
+        throw new Error(`mcp_publisher_key_not_found:${header.kid}`);
+    }
+    const expectedSubject = mcpToolResource(input.definition.serverIdentity, input.definition.name);
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(input.statement, key, {
+            algorithms: ["ES256"],
+            issuer: input.expectedPublisher,
+            subject: expectedSubject,
+        }));
+    }
+    catch {
+        throw new Error("mcp_signature_invalid");
+    }
+    const parsed = McpSignedDefinitionClaimsSchema.safeParse(payload);
+    if (!parsed.success) {
+        throw new Error("mcp_signed_claims_invalid");
+    }
+    const claims = parsed.data;
+    if (claims.axtary_mcp_profile !== MCP_SIGNED_DEFINITION_PROFILE) {
+        throw new Error("mcp_signed_profile_invalid");
+    }
+    if (claims.serverIdentity !== input.definition.serverIdentity) {
+        throw new Error(`mcp_signed_server_identity_mismatch:${input.definition.serverIdentity}`);
+    }
+    if (claims.toolName !== input.definition.name) {
+        throw new Error(`mcp_signed_tool_name_mismatch:${input.definition.name}`);
+    }
+    if (claims.schemaVersion !== input.definition.schemaVersion) {
+        throw new Error(`mcp_signed_schema_version_mismatch:${input.definition.schemaVersion}`);
+    }
+    const liveHash = hashMcpToolDefinition(input.definition);
+    if (claims.definitionHash !== liveHash) {
+        throw new Error(`mcp_signed_definition_hash_mismatch:${liveHash}`);
+    }
+    return {
+        claims,
+        publisher: claims.iss,
+        kid: header.kid,
+        semver: claims.semver,
+        requiredScopes: claims.requiredScopes,
+        definitionHash: claims.definitionHash,
+        priorDefinitionHash: claims.priorDefinitionHash,
+    };
+}
+/**
+ * Wrap a tool invoker so the publisher signature is verified against the live
+ * definition *before* the tool runs. Any failure — unsigned (no statement
+ * configured is simply not this handler), mis-signed, unknown key, or an
+ * altered definition whose bytes no longer hash to the signed value — throws
+ * and the tool is never invoked. When the action carries bound provenance, it
+ * must also agree with the verified signature.
+ */
+export function createSignedMcpToolHandler(input) {
+    const baseHandler = createMcpToolHandler({
+        definition: input.definition,
+        invoke: input.invoke,
+    });
+    return async (request) => {
+        const verification = await verifyMcpSignedDefinition({
+            statement: input.statement,
+            definition: input.definition,
+            verificationKeys: input.verificationKeys,
+            expectedPublisher: input.expectedPublisher,
+        });
+        assertActionProvenanceMatches(request.action, verification);
+        return baseHandler(request);
+    };
+}
+/**
+ * If an action was built with bound signed provenance, it must match the
+ * signature we just verified. A hash-only action (no bound provenance) is
+ * allowed through a signed handler — the signature check above already gates
+ * it — but mismatched bound provenance is a fail-closed rejection.
+ */
+function assertActionProvenanceMatches(action, verification) {
+    const bound = action.toolDefinition;
+    if (!bound)
+        return;
+    if (bound.definitionHash !== verification.definitionHash) {
+        throw new Error(`mcp_signed_definition_hash_mismatch:${verification.definitionHash}`);
+    }
+    if (bound.publisher && bound.publisher !== verification.publisher) {
+        throw new Error(`mcp_signed_publisher_mismatch:${verification.publisher}`);
+    }
+    if (bound.publisherKeyId && bound.publisherKeyId !== verification.kid) {
+        throw new Error(`mcp_signed_publisher_key_mismatch:${verification.kid}`);
+    }
+    if (bound.semver && bound.semver !== verification.semver) {
+        throw new Error(`mcp_signed_semver_mismatch:${verification.semver}`);
+    }
+}
+/**
+ * Build a key resolver from a configured trust store. A `kid` that is not
+ * present (optionally scoped to `expectedPublisher`) resolves to `undefined`,
+ * which makes verification fail closed.
+ */
+export function mcpPublisherKeyResolver(store, options = {}) {
+    const parsed = McpPublisherTrustStoreSchema.parse(store);
+    return async (kid) => {
+        if (!kid)
+            return undefined;
+        for (const entry of parsed.publishers) {
+            if (options.publisher && entry.publisher !== options.publisher) {
+                continue;
+            }
+            const jwk = entry.keys.find((key) => key.kid === kid);
+            if (jwk) {
+                return importJWK(jwk, "ES256");
+            }
+        }
+        return undefined;
+    };
+}
+export function emptyMcpPublisherTrustStore() {
+    return { schemaVersion: MCP_PUBLISHER_TRUST_VERSION, publishers: [] };
+}
+export function parseMcpPublisherTrustStore(input) {
+    return McpPublisherTrustStoreSchema.parse(input);
+}
+export async function loadMcpPublisherTrustStore(path) {
+    try {
+        return parseMcpPublisherTrustStore(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return emptyMcpPublisherTrustStore();
+        }
+        throw error;
+    }
+}
+export async function saveMcpPublisherTrustStore(path, store) {
+    await writePrivateJson(path, McpPublisherTrustStoreSchema.parse(store));
+}
+export async function loadMcpSignedDefinitionRegistry(path) {
+    try {
+        return McpSignedDefinitionRegistrySchema.parse(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return {
+                schemaVersion: MCP_SIGNED_DEFINITION_REGISTRY_VERSION,
+                statements: [],
+            };
+        }
+        throw error;
+    }
+}
+export function findMcpSignedDefinition(registry, serverIdentity, toolName) {
+    const parsed = McpSignedDefinitionRegistrySchema.parse(registry);
+    return parsed.statements.find((entry) => entry.serverIdentity === serverIdentity && entry.toolName === toolName);
+}
+/**
+ * Add (or replace) a publisher's public keys in the trust store. Pure: never
+ * mutates the input. Used to register a publisher's JWKS for verification.
+ */
+export function trustMcpPublisher(store, publisher, keys) {
+    const parsed = McpPublisherTrustStoreSchema.parse(store);
+    const entry = McpPublisherTrustEntrySchema.parse({
+        publisher,
+        keys: keys.map((key) => McpPublisherKeySchema.parse(key)),
+    });
+    const others = parsed.publishers.filter((p) => p.publisher !== publisher);
+    return {
+        schemaVersion: MCP_PUBLISHER_TRUST_VERSION,
+        publishers: [...others, entry].sort((left, right) => left.publisher < right.publisher ? -1 : left.publisher > right.publisher ? 1 : 0),
+    };
+}
+/** Public JWKS for a publisher keyring, suitable for distribution. */
+export function mcpPublisherJwks(keyring) {
+    const parsed = McpPublisherKeyringSchema.parse(keyring);
+    return {
+        keys: parsed.keys.map((key) => McpPublisherKeySchema.parse(stripPrivate(key))),
+    };
+}
+/** The active signing key for a publisher keyring. */
+export function mcpPublisherSigningKey(keyring) {
+    const parsed = McpPublisherKeyringSchema.parse(keyring);
+    const active = parsed.keys.find((key) => key.kid === parsed.activeKid);
+    if (!active) {
+        throw new Error("mcp_publisher_active_key_missing");
+    }
+    return {
+        kid: active.kid,
+        privateKey: createPrivateKey(active.privateKeyPem),
+        publicJwk: McpPublisherKeySchema.parse(stripPrivate(active)),
+    };
+}
+/**
+ * Load or create a publisher keyring. The private keys are written `0600` via
+ * an atomic rename; a missing file is first-use, a corrupt file fails loud.
+ */
+export async function loadOrCreateMcpPublisherKeyring(input) {
+    try {
+        const data = McpPublisherKeyringSchema.parse(JSON.parse(await readFile(input.filePath, "utf8")));
+        if (data.publisher !== input.publisher) {
+            throw new Error("mcp_publisher_keyring_identity_mismatch");
+        }
+        return data;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            throw error;
+        }
+    }
+    const key = createMcpPublisherKeyRecord(input.now ?? new Date());
+    const keyring = {
+        schemaVersion: MCP_PUBLISHER_KEYRING_VERSION,
+        publisher: input.publisher,
+        activeKid: key.kid,
+        keys: [key],
+    };
+    await writePrivateJson(input.filePath, keyring);
+    return keyring;
+}
+function createMcpPublisherKeyRecord(now) {
+    const { privateKey, publicKey } = generateKeyPairSync("ec", {
+        namedCurve: "P-256",
+    });
+    const kid = `mcp-publisher-${randomUUID().slice(0, 12)}`;
+    const jwk = publicKey.export({ format: "jwk" });
+    return McpPublisherKeyRecordSchema.parse({
+        kid,
+        kty: jwk.kty,
+        crv: jwk.crv,
+        x: jwk.x,
+        y: jwk.y,
+        alg: "ES256",
+        use: "sig",
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        createdAt: now.toISOString(),
+    });
+}
+function stripPrivate(key) {
+    return {
+        kid: key.kid,
+        kty: key.kty,
+        crv: key.crv,
+        x: key.x,
+        y: key.y,
+        alg: key.alg,
+        use: key.use,
+    };
+}
+async function writePrivateJson(filePath, value) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    let renamed = false;
+    try {
+        const handle = await open(tmpPath, "wx", 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(tmpPath, filePath);
+        renamed = true;
+    }
+    finally {
+        if (!renamed) {
+            await rm(tmpPath, { force: true });
+        }
+    }
+}
+//# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,OAAO,GAIR,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,GAIhB,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iCAAiC,CAAC;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,iCAAiC,CAAC;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAC3E,MAAM,CAAC,MAAM,sCAAsC,GACjD,0CAA0C,CAAC;AAE7C,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,EAAE;KACR,KAAK,CACJ,qCAAqC,EACrC,oBAAoB,CACrB,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzD,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,mBAAmB,EAAE,CAAC;SACnB,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,CAAC;SAC9B,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;CACjB,CAAC,CAAC;AAKH,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAGH,MAAM,2BAA2B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AA8BH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC;QACnD,GAAG,EAAE,KAAK,CAAC,SAAS;QACpB,GAAG,EAAE,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC9C,GAAG,EAAE,QAAQ;QACb,kBAAkB,EAAE,6BAA6B;QACjD,cAAc;QACd,QAAQ;QACR,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;QAC7C,cAAc;QACd,MAAM;QACN,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;QAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,IAAI;KACvD,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC;QAClC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC;SACC,kBAAkB,CAAC;QAClB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK,CAAC,KAAK;QAChB,GAAG,EAAE,yBAAyB;KAC/B,CAAC;SACD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;SACrB,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;SACtB,WAAW,CAAC,QAAQ,CAAC;SACrB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE1B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,yBAAyB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CACrC,KAAK,CAAC,UAAU,CAAC,cAAc,EAC/B,KAAK,CAAC,UAAU,CAAC,IAAI,CACtB,CAAC;IAEF,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE;YACnD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,KAAK,CAAC,iBAAiB;YAC/B,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAE3B,IAAI,MAAM,CAAC,kBAAkB,KAAK,6BAA6B,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAM1C;IACC,MAAM,WAAW,GAAG,oBAAoB,CAAC;QACvC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC;YACnD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;QACH,6BAA6B,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5D,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CACpC,MAAwB,EACxB,YAA6C;IAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,YAAY,CAAC,cAAc,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA6B,EAC7B,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YACtD,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,SAAS,CAAC,GAAU,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,OAAO,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,2BAA2B,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAY,EACZ,KAA6B;IAE7B,MAAM,gBAAgB,CAAC,IAAI,EAAE,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,iCAAiC,CAAC,KAAK,CAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO;gBACL,aAAa,EAAE,sCAAsC;gBACrD,UAAU,EAAE,EAAE;aACf,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAqC,EACrC,cAAsB,EACtB,QAAgB;IAEhB,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CACzE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA6B,EAC7B,SAAiB,EACjB,IAAuB;IAEvB,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC;QAC/C,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC1E,OAAO;QACL,aAAa,EAAE,2BAA2B;QAC1C,UAAU,EAAE,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACjF;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,OAA4B;IAG3D,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,OAA4B;IAKjE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC;QAClD,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAC1C,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CACnD,CAAC;QACF,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAwB;QACnC,aAAa,EAAE,6BAA6B;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,GAAG,CAAC,GAAG;QAClB,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC;IACF,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAS;IAC5C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,iBAAiB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;IACvD,OAAO,2BAA2B,CAAC,KAAK,CAAC;QACvC,GAAG;QACH,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7E,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAA0B;IAC9C,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,KAAc;IAC9D,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axtary/mcp",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
   "description": "MCP tool provenance helpers and fail-closed handler wrappers for Axtary.",
   "type": "module",
@@ -39,8 +39,9 @@
   },
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@axtary/actionpass": "^0.1.0",
-    "@axtary/proxy": "^0.1.0",
+    "@axtary/actionpass": "^0.2.0",
+    "@axtary/proxy": "^0.2.0",
+    "jose": "^6.2.3",
     "zod": "^4.4.3"
   }
 }