@bjorntech/key-ferry 0.0.0-stage → 0.1.0

package/dist/options.js

@@ -0,0 +1,260 @@
+import { resolve } from "node:path";
+import { projectDirectory as brandProjectDirectory } from "./contracts.js";
+const DEFAULT_STARTUP_TIMEOUT_MS = 30_000;
+const DEFAULT_COMMAND_TIMEOUT_MS = 10_000;
+const DEFAULT_RELOAD_TIMEOUT_MS = 30_000;
+const DEFAULT_POLL_INTERVAL_MS = 100;
+const MAX_TIMEOUT_MS = 10 * 60 * 1_000;
+const MAX_RELOAD_TIMEOUT_MS = 15 * 60 * 1_000;
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "host",
+    "content-length",
+]);
+const MCP_PROTOCOL_HEADERS = new Set([
+    "accept",
+    "content-type",
+    "mcp-session-id",
+    "mcp-protocol-version",
+    "last-event-id",
+    "origin",
+]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const positiveInteger = (value, name, maximum) => {
+    if (typeof value !== "number" ||
+        !Number.isSafeInteger(value) ||
+        value < 1 ||
+        (maximum !== undefined && value > maximum))
+        throw new TypeError(`${name} must be a positive integer${maximum === undefined ? "" : ` no greater than ${maximum}`}`);
+    return value;
+};
+const stringArray = (value, name) => {
+    if (!Array.isArray(value) ||
+        value.length === 0 ||
+        value.some((item) => typeof item !== "string" || item.length === 0))
+        throw new TypeError(`${name} must be a non-empty array of non-empty strings`);
+    return [...value];
+};
+const unsafeName = (value) => value === "__proto__" || value === "prototype" || value === "constructor";
+const environmentName = (value, name) => {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 256 ||
+        unsafeName(value) ||
+        !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+        throw new TypeError(`${name} must be a valid environment name`);
+    }
+    return value;
+};
+function normalizeServer(name, value) {
+    if (!isRecord(value))
+        throw new TypeError(`servers.${name} must be an object`);
+    if ("remote" in value) {
+        if ("env" in value)
+            throw new TypeError(`servers.${name} cannot mix env and remote protection`);
+        return normalizeRemoteServer(name, value);
+    }
+    const env = value.env;
+    if (Array.isArray(env)) {
+        const keys = stringArray(env, `servers.${name}.env`).map((key) => environmentName(key, `servers.${name}.env`));
+        const result = Object.create(null);
+        for (const key of keys)
+            result[key] = key;
+        return result;
+    }
+    if (!isRecord(env))
+        throw new TypeError(`servers.${name}.env must be an array or object`);
+    const result = Object.create(null);
+    for (const [outputName, sourceName] of Object.entries(env)) {
+        const output = environmentName(outputName, `servers.${name}.env output`);
+        result[output] = environmentName(sourceName, `servers.${name}.env source`);
+    }
+    if (Object.keys(result).length === 0)
+        throw new TypeError(`servers.${name}.env must not be empty`);
+    return result;
+}
+function cleanHeaderPart(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length > 256 || /[\r\n\0]/.test(value)) {
+        throw new TypeError(`${field} must be a bounded string without control characters`);
+    }
+    return value;
+}
+function normalizeRemoteServer(name, value) {
+    const remote = value.remote;
+    if (!isRecord(remote) || !isRecord(remote.headers)) {
+        throw new TypeError(`servers.${name}.remote.headers must be a non-empty object`);
+    }
+    const result = Object.create(null);
+    const seen = new Set();
+    for (const [header, rawMapping] of Object.entries(remote.headers)) {
+        const lower = header.toLowerCase();
+        if (!HEADER_NAME.test(header) ||
+            unsafeName(header) ||
+            HOP_BY_HOP_HEADERS.has(lower) ||
+            MCP_PROTOCOL_HEADERS.has(lower) ||
+            lower === "set-cookie" ||
+            seen.has(lower)) {
+            throw new TypeError(`servers.${name}.remote.headers contains an invalid or duplicate header`);
+        }
+        seen.add(lower);
+        if (typeof rawMapping === "string") {
+            result[header] = environmentName(rawMapping, `servers.${name}.remote.headers.${header}`);
+            continue;
+        }
+        if (!isRecord(rawMapping))
+            throw new TypeError(`servers.${name}.remote.headers.${header} must name an environment key`);
+        const env = environmentName(rawMapping.env, `servers.${name}.remote.headers.${header}.env`);
+        const prefix = cleanHeaderPart(rawMapping.prefix, `servers.${name}.remote.headers.${header}.prefix`);
+        const suffix = cleanHeaderPart(rawMapping.suffix, `servers.${name}.remote.headers.${header}.suffix`);
+        result[header] = {
+            env,
+            ...(prefix === undefined ? {} : { prefix }),
+            ...(suffix === undefined ? {} : { suffix }),
+        };
+    }
+    if (Object.keys(result).length === 0)
+        throw new TypeError(`servers.${name}.remote.headers must not be empty`);
+    return { remote: { headers: result } };
+}
+/**
+ * Decode untrusted OpenCode plugin options without touching process.env.
+ * `enabled: false` explicitly means no manager layer, MCP transform, or RPC
+ * is installed and existing MCP configuration is left untouched.
+ */
+export function parseOptions(raw, directory) {
+    const input = isRecord(raw) ? raw : {};
+    if ("failClosed" in input)
+        throw new TypeError("failClosed is not supported; protection is always fail-closed");
+    const enabled = input.enabled === undefined
+        ? true
+        : typeof input.enabled === "boolean"
+            ? input.enabled
+            : (() => {
+                throw new TypeError("enabled must be a boolean");
+            })();
+    const resolvedProjectDirectory = input.projectDirectory === undefined
+        ? directory === undefined
+            ? undefined
+            : brandProjectDirectory(directory)
+        : (() => {
+            if (typeof input.projectDirectory !== "string" ||
+                input.projectDirectory.trim().length === 0) {
+                throw new TypeError("projectDirectory must be a non-empty path");
+            }
+            return brandProjectDirectory(resolve(directory ?? process.cwd(), input.projectDirectory));
+        })();
+    const command = input.command === undefined ? ["varlock"] : stringArray(input.command, "command");
+    const startupTimeoutMs = input.startupTimeoutMs === undefined
+        ? DEFAULT_STARTUP_TIMEOUT_MS
+        : positiveInteger(input.startupTimeoutMs, "startupTimeoutMs");
+    const commandTimeoutMs = input.commandTimeoutMs === undefined
+        ? DEFAULT_COMMAND_TIMEOUT_MS
+        : positiveInteger(input.commandTimeoutMs, "commandTimeoutMs", MAX_TIMEOUT_MS);
+    // Accept the old spelling while emitting only the manager's canonical
+    // reloadTimeoutMs option. This avoids silently turning a refresh timeout
+    // into a startup timeout for existing configurations.
+    const usesLegacyReloadName = input.reloadTimeoutMs === undefined && input.refreshTimeoutMs !== undefined;
+    const reloadInput = input.reloadTimeoutMs ?? input.refreshTimeoutMs;
+    const reloadTimeoutMs = reloadInput === undefined
+        ? DEFAULT_RELOAD_TIMEOUT_MS
+        : positiveInteger(reloadInput, "reloadTimeoutMs", usesLegacyReloadName ? 900_000 : MAX_RELOAD_TIMEOUT_MS);
+    const pollIntervalMs = input.pollIntervalMs === undefined
+        ? DEFAULT_POLL_INTERVAL_MS
+        : positiveInteger(input.pollIntervalMs, "pollIntervalMs", 10_000);
+    const requireStrictEgress = input.requireStrictEgress === undefined
+        ? true
+        : typeof input.requireStrictEgress === "boolean"
+            ? input.requireStrictEgress
+            : (() => {
+                throw new TypeError("requireStrictEgress must be a boolean");
+            })();
+    const allowPrivateNetwork = input.allowPrivateNetwork === undefined
+        ? false
+        : typeof input.allowPrivateNetwork === "boolean"
+            ? input.allowPrivateNetwork
+            : (() => {
+                throw new TypeError("allowPrivateNetwork must be a boolean");
+            })();
+    const servers = Object.create(null);
+    if (input.servers !== undefined) {
+        if (!isRecord(input.servers))
+            throw new TypeError("servers must be an object");
+        for (const [name, value] of Object.entries(input.servers)) {
+            if (!name || unsafeName(name))
+                throw new TypeError("server names must be safe non-empty names");
+            servers[name] = normalizeServer(name, value);
+        }
+    }
+    const adapter = {
+        command,
+        startupTimeoutMs,
+        commandTimeoutMs,
+        reloadTimeoutMs,
+        pollIntervalMs,
+        requireStrictEgress,
+        allowPrivateNetwork,
+        servers,
+    };
+    // Existing consumers read this property directly. It is deliberately not
+    // enumerable so managerOptions can pass an exact canonical adapter shape.
+    Object.defineProperty(adapter, "refreshTimeoutMs", {
+        value: input.refreshTimeoutMs === undefined ? 900_000 : reloadTimeoutMs,
+        enumerable: false,
+        configurable: false,
+    });
+    const manager = {
+        enabled,
+        ...(resolvedProjectDirectory === undefined
+            ? {}
+            : { projectDirectory: resolvedProjectDirectory }),
+        adapter,
+    };
+    return {
+        enabled,
+        ...(resolvedProjectDirectory === undefined
+            ? {}
+            : { projectDirectory: resolvedProjectDirectory }),
+        adapter,
+        manager,
+    };
+}
+export function managerOptions(options, directory) {
+    const environmentKeys = [
+        ...new Set(Object.values(options.adapter.servers).flatMap((mapping) => {
+            if (isRemoteProtectionValue(mapping)) {
+                return Object.values(mapping.remote.headers).map((header) => typeof header === "string" ? header : header.env);
+            }
+            return Object.values(mapping);
+        })),
+    ];
+    return {
+        projectDirectory: options.projectDirectory ?? brandProjectDirectory(directory),
+        owner: "key-ferry",
+        // Keep this object in lockstep with the manager adapter contract. In
+        // particular, server mappings are plugin concerns and must not leak into
+        // the Varlock process adapter.
+        adapter: {
+            command: [...options.adapter.command],
+            environmentKeys,
+            startupTimeoutMs: options.adapter.startupTimeoutMs,
+            commandTimeoutMs: options.adapter.commandTimeoutMs,
+            reloadTimeoutMs: options.adapter.reloadTimeoutMs,
+            pollIntervalMs: options.adapter.pollIntervalMs,
+            requireStrictEgress: options.adapter.requireStrictEgress,
+        },
+    };
+}
+function isRemoteProtectionValue(value) {
+    return isRecord(value) && isRecord(value.remote) && isRecord(value.remote.headers);
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAAE,gBAAgB,IAAI,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA2C3E,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACvC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAC9C,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,sBAAsB;IACtB,eAAe;IACf,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,eAAe,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,OAAgB,EAAE,EAAE;IACzE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,GAAG,OAAO,CAAC;QAE1C,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,8BAA8B,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,OAAO,EAAE,EAAE,CAClG,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,EAAE;IACnD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAEnE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,iDAAiD,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CACnC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,CAAC;AAC5E,MAAM,eAAe,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;IAC/D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,UAAU,CAAC,KAAK,CAAC;QACjB,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,SAAS,eAAe,CAAC,IAAY,EAAE,KAAc;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IAC/E,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,KAAK,IAAI,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,uCAAuC,CAAC,CAAC;QAChG,OAAO,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/D,eAAe,CAAC,GAAG,EAAE,WAAW,IAAI,MAAM,CAAC,CAC5C,CAAC;QACF,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;QACrF,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IACrF,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAiD,MAAM,CAAC,MAAM,CAAC,IAAI,CAG9E,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACzB,UAAU,CAAC,MAAM,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,KAAK,KAAK,YAAY;YACtB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EACf,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,yDAAyD,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,EAAE,WAAW,IAAI,mBAAmB,MAAM,EAAE,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,mBAAmB,MAAM,+BAA+B,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,IAAI,mBAAmB,MAAM,MAAM,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,eAAe,CAC5B,UAAU,CAAC,MAAM,EACjB,WAAW,IAAI,mBAAmB,MAAM,SAAS,CAClD,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAC5B,UAAU,CAAC,MAAM,EACjB,WAAW,IAAI,mBAAmB,MAAM,SAAS,CAClD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,GAAG;YACf,GAAG;YACH,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,mCAAmC,CAAC,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,SAAkB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,IAAI,YAAY,IAAI,KAAK;QACvB,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACvF,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,CAAC;IACb,MAAM,wBAAwB,GAC5B,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAClC,CAAC,CAAC,SAAS,KAAK,SAAS;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC;QACpC,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IACE,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;gBAC1C,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,EAAE,CAAC;IAEX,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClG,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAClC,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAClC,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAClF,sEAAsE;IACtE,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,oBAAoB,GACxB,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC;IAC9E,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,CAAC;IACpE,MAAM,eAAe,GACnB,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,eAAe,CACb,WAAW,EACX,iBAAiB,EACjB,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CACvD,CAAC;IACR,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,KAAK,SAAS;QAChC,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,mBAAmB,GACvB,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACrC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,KAAK,CAAC,mBAAmB,KAAK,SAAS;YAC9C,CAAC,CAAC,KAAK,CAAC,mBAAmB;YAC3B,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAC/D,CAAC,CAAC,EAAE,CAAC;IACb,MAAM,mBAAmB,GACvB,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACrC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,CAAC,mBAAmB,KAAK,SAAS;YAC9C,CAAC,CAAC,KAAK,CAAC,mBAAmB;YAC3B,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAC/D,CAAC,CAAC,EAAE,CAAC;IAEb,MAAM,OAAO,GAAqC,MAAM,CAAC,MAAM,CAAC,IAAI,CAGnE,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC;gBAC3B,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO;QACP,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,mBAAmB;QACnB,mBAAmB;QACnB,OAAO;KAC4B,CAAC;IACtC,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE;QACjD,KAAK,EAAE,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;QACvE,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,MAAM,OAAO,GAAgC;QAC3C,OAAO;QACP,GAAG,CAAC,wBAAwB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;QACnD,OAAO;KACR,CAAC;IACF,OAAO;QACL,OAAO;QACP,GAAG,CAAC,wBAAwB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;QACnD,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,SAAiB;IAEjB,MAAM,eAAe,GAAG;QACtB,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACzD,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1D,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,CACH;KACF,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,SAAS,CAAC;QAC9E,KAAK,EAAE,WAAW;QAClB,qEAAqE;QACrE,yEAAyE;QACzE,+BAA+B;QAC/B,OAAO,EAAE;YACP,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;YACrC,eAAe;YACf,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB;YAClD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB;YAClD,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;YAC9C,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB;SACzD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAuB;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,24 @@
+import { Mcp, Plugin } from "@opencode/plugin/effect";
+import { Types } from "effect";
+import type { ProjectKeyFerryManagerFactory, ResolvedEnvironment } from "./contracts.js";
+import { type ValidatedOptions } from "./options.js";
+import { type RemoteRelayFactory, type RemoteRelayHandle } from "./remote.js";
+export interface McpEditor {
+    list(): readonly [string, Types.DeepMutable<Mcp.ServerConfig>][];
+    get(name: string): Types.DeepMutable<Mcp.ServerConfig> | undefined;
+    update(name: string, update: (config: Types.DeepMutable<Mcp.ServerConfig>) => void): void;
+}
+export interface ProtectionState {
+    readonly ready: boolean;
+    readonly environment: ResolvedEnvironment;
+    readonly remoteHandles?: ReadonlyMap<string, RemoteRelayHandle>;
+}
+/**
+ * Apply only explicitly configured local protections. A selected remote
+ * server, missing key, or unavailable manager is disabled rather than falling
+ * back to direct transport.
+ */
+export declare function applyProtection(editor: McpEditor, options: ValidatedOptions["adapter"], state: ProtectionState): void;
+/** Construct the native OpenCode V2 plugin. The real manager is injected later. */
+export declare function makePlugin(factory: ProjectKeyFerryManagerFactory, relayFactory?: RemoteRelayFactory): Plugin.Plugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAiB,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EACV,6BAA6B,EAE7B,mBAAmB,EAEpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EAEvB,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,SAAS;IACxB,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;IACjE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IACnE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC;CAC3F;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,EACpC,KAAK,EAAE,eAAe,GACrB,IAAI,CAoDN;AAwCD,mFAAmF;AACnF,wBAAgB,UAAU,CACxB,OAAO,EAAE,6BAA6B,EACtC,YAAY,CAAC,EAAE,kBAAkB,GAChC,MAAM,CAAC,MAAM,CAqKf"}

package/dist/plugin.js

@@ -0,0 +1,215 @@
+import { Mcp, Plugin } from "@opencode/plugin/effect";
+import { Effect, Scope, Types } from "effect";
+import { ProjectKeyFerryManager } from "./contracts.js";
+import { managerOptions, parseOptions, } from "./options.js";
+import { makeRemoteRelayCoordinator, RELAY_AUTH_HEADER, safeForwardHeaders, isRemoteProtection, } from "./remote.js";
+import { KeyFerryRpc, publicMessage, rpcError, sanitizeStatus } from "./rpc.js";
+/**
+ * Apply only explicitly configured local protections. A selected remote
+ * server, missing key, or unavailable manager is disabled rather than falling
+ * back to direct transport.
+ */
+export function applyProtection(editor, options, state) {
+    for (const [name, mapping] of Object.entries(options.servers)) {
+        const server = editor.get(name);
+        if (!server)
+            continue;
+        if (isRemoteProtection(mapping)) {
+            const handle = state.remoteHandles?.get(name);
+            editor.update(name, (config) => {
+                if (config.type !== "remote" || config.oauth !== false || !state.ready || !handle) {
+                    config.disabled = true;
+                    return;
+                }
+                const headers = safeForwardHeaders(config.headers, mapping);
+                if (headers === undefined) {
+                    config.disabled = true;
+                    return;
+                }
+                config.url = handle.localUrl;
+                config.headers = { ...headers, [RELAY_AUTH_HEADER]: handle.downstreamToken };
+                // Preserve an intentional user disablement. The transformed config is
+                // never allowed to enable a server disabled in project configuration.
+                if (server.disabled !== true)
+                    config.disabled = false;
+            });
+            continue;
+        }
+        if (server.type !== "local") {
+            editor.update(name, (config) => {
+                config.disabled = true;
+            });
+            continue;
+        }
+        const resolved = Object.create(null);
+        let complete = state.ready;
+        for (const [outputName, sourceName] of Object.entries(mapping)) {
+            const value = state.environment[sourceName];
+            if (value === undefined)
+                complete = false;
+            else
+                resolved[outputName] = value;
+        }
+        editor.update(name, (config) => {
+            if (config.type !== "local") {
+                config.disabled = true;
+                return;
+            }
+            if (!complete) {
+                config.disabled = true;
+                return;
+            }
+            config.environment = { ...(config.environment ?? {}), ...resolved };
+            // Preserve an intentional user disablement. Protection never enables a
+            // server that was explicitly disabled in project configuration.
+            if (server.disabled !== true)
+                config.disabled = false;
+        });
+    }
+}
+const ensureState = (manager) => manager
+    .withExclusive(Effect.gen(function* () {
+    const status = yield* manager.ensureStarted;
+    const environment = yield* manager.environment;
+    return { status: sanitizeStatus(status), environment };
+}))
+    .pipe(Effect.catch((error) => manager.status.pipe(Effect.map((status) => ({
+    status: sanitizeStatus({ ...status, error }),
+    environment: {},
+})))));
+function snapshotServers(editor) {
+    const result = new Map();
+    for (const [name, config] of editor.list()) {
+        if (config.type !== "remote")
+            continue;
+        result.set(name, {
+            type: "remote",
+            url: config.url,
+            ...(config.headers === undefined ? {} : { headers: { ...config.headers } }),
+            ...(config.oauth === undefined ? {} : { oauth: config.oauth }),
+            ...(config.disabled === undefined ? {} : { disabled: config.disabled }),
+            ...(config.codemode === undefined ? {} : { codemode: config.codemode }),
+            ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
+            ...(config.protocol === undefined ? {} : { protocol: config.protocol }),
+        });
+    }
+    return result;
+}
+/** Construct the native OpenCode V2 plugin. The real manager is injected later. */
+export function makePlugin(factory, relayFactory) {
+    return Plugin.define({
+        id: "key-ferry",
+        effect: (ctx) => {
+            const parsed = parseOptions(ctx.options, ctx.location.project.directory);
+            if (!parsed.enabled)
+                return Effect.void;
+            const program = Effect.gen(function* () {
+                const pluginScope = yield* Effect.scope;
+                const manager = yield* ProjectKeyFerryManager;
+                let state = { ready: false, environment: {} };
+                let observedGeneration = -1;
+                let remoteDiagnostics = [];
+                let serverSnapshots = new Map();
+                const remote = makeRemoteRelayCoordinator(relayFactory, parsed.adapter.allowPrivateNetwork);
+                const setState = (next) => {
+                    state = next;
+                };
+                const publicStatus = (status) => sanitizeStatus({
+                    ...status,
+                    ...(remoteDiagnostics.length === 0 ? {} : { diagnostics: remoteDiagnostics }),
+                });
+                const reconcileRemote = (status, environment) => Effect.gen(function* () {
+                    // A health failure may have stopped and removed the current handles.
+                    // Reconcile from the manager capability again during doctor, rather
+                    // than treating doctor as a metadata-only operation.
+                    if (status.phase === "ready") {
+                        if (!(yield* remote.health))
+                            yield* remote.stopAll;
+                        yield* Effect.provideService(remote.reconcile(serverSnapshots, parsed.adapter.servers, environment, status.generation), Scope.Scope, pluginScope);
+                    }
+                    else {
+                        yield* remote.stopAll;
+                    }
+                    remoteDiagnostics = remote.diagnostics;
+                    const next = {
+                        ready: status.phase === "ready",
+                        environment,
+                        remoteHandles: remote.handles,
+                    };
+                    setState(next);
+                    return next;
+                });
+                yield* ctx.mcp.transform((editor) => {
+                    serverSnapshots = snapshotServers(editor);
+                    applyProtection(editor, parsed.adapter, { ...state, remoteHandles: remote.handles });
+                });
+                const initial = yield* ensureState(manager);
+                yield* reconcileRemote(initial.status, initial.environment);
+                observedGeneration = initial.status.generation;
+                yield* ctx.mcp.reload();
+                yield* ctx.rpc.register(KeyFerryRpc, {
+                    status: () => manager.status.pipe(Effect.map(publicStatus)),
+                    refresh: (_, context) => manager.withExclusive(Effect.gen(function* () {
+                        yield* remote.stopAll;
+                        setState({ ready: false, environment: {}, remoteHandles: remote.handles });
+                        yield* ctx.mcp.reload();
+                        const status = yield* manager.refresh;
+                        const environment = yield* manager.environment;
+                        yield* reconcileRemote(status, environment);
+                        yield* ctx.mcp.reload();
+                        return publicStatus(status);
+                    }).pipe(Effect.catch((error) => Effect.sync(() => {
+                        remoteDiagnostics = remote.diagnostics;
+                        setState({ ready: false, environment: {}, remoteHandles: remote.handles });
+                    }).pipe(Effect.andThen(ctx.mcp.reload()), Effect.andThen(Effect.fail(context.error("unavailable", publicMessage(error), rpcError(error)))))))),
+                    doctor: (_, context) => manager.withExclusive(Effect.gen(function* () {
+                        const next = yield* ensureState(manager);
+                        yield* reconcileRemote(next.status, next.environment);
+                        yield* ctx.mcp.reload();
+                        return publicStatus(next.status);
+                    }).pipe(Effect.catch((error) => Effect.fail(context.error("unavailable", publicMessage(error), rpcError(error)))))),
+                });
+                // The manager owns process health. Poll only safe metadata and disable
+                // protected servers immediately if the owned process dies. A changed
+                // generation gets a fresh, allowlisted environment before reconnecting.
+                yield* Effect.forkScoped(Effect.forever(Effect.gen(function* () {
+                    yield* Effect.sleep("30 seconds");
+                    const status = yield* manager.status;
+                    if (status.phase !== "ready") {
+                        if (state.ready || remote.handles.size > 0) {
+                            yield* remote.stopAll;
+                            setState({ ready: false, environment: {}, remoteHandles: remote.handles });
+                            yield* ctx.mcp.reload();
+                        }
+                        return;
+                    }
+                    const relayHealthy = yield* remote.health;
+                    if (!relayHealthy) {
+                        yield* remote.stopAll;
+                        setState({ ready: false, environment: {}, remoteHandles: remote.handles });
+                        yield* ctx.mcp.reload();
+                        return;
+                    }
+                    if (status.generation === observedGeneration && state.ready)
+                        return;
+                    yield* remote.stopAll;
+                    const next = yield* ensureState(manager);
+                    observedGeneration = next.status.generation;
+                    if (next.status.phase === "ready") {
+                        yield* Effect.provideService(remote.reconcile(serverSnapshots, parsed.adapter.servers, next.environment, next.status.generation), Scope.Scope, pluginScope);
+                        remoteDiagnostics = remote.diagnostics;
+                    }
+                    setState({
+                        ready: next.status.phase === "ready",
+                        environment: next.environment,
+                        remoteHandles: remote.handles,
+                    });
+                    yield* ctx.mcp.reload();
+                })).pipe(Effect.catch(() => Effect.void)));
+                yield* Effect.addFinalizer(() => remote.stopAll);
+            });
+            return Effect.provide(program, factory.layer(managerOptions(parsed, ctx.location.project.directory))).pipe(Effect.catch(() => Effect.void));
+        },
+    });
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAO9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,YAAY,GAGb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAchF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAiB,EACjB,OAAoC,EACpC,KAAsB;IAEtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBAClF,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACvB,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACvB,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC7E,sEAAsE;gBACtE,sEAAsE;gBACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;oBAAE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;QACvF,IAAI,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS;gBAAE,QAAQ,GAAG,KAAK,CAAC;;gBACrC,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,OAAsC,EAAE,EAAE,CAC7D,OAAO;KACJ,aAAa,CACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;AACzD,CAAC,CAAC,CACH;KACA,IAAI,CACH,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,WAAW,EAAE,EAAE;CAChB,CAAC,CAAC,CACJ,CACF,CACF,CAAC;AAEN,SAAS,eAAe,CAAC,MAAiB;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;YACf,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CACxB,OAAsC,EACtC,YAAiC;IAEjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;gBAC9C,IAAI,KAAK,GAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;gBAC/D,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC;gBAC5B,IAAI,iBAAiB,GAAgC,EAAE,CAAC;gBACxD,IAAI,eAAe,GAA8C,IAAI,GAAG,EAAE,CAAC;gBAC3E,MAAM,MAAM,GAAG,0BAA0B,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,CAAC,IAAqB,EAAE,EAAE;oBACzC,KAAK,GAAG,IAAI,CAAC;gBACf,CAAC,CAAC;gBACF,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAc,EAAE,CACtD,cAAc,CAAC;oBACb,GAAG,MAAM;oBACT,GAAG,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;iBAC9E,CAAC,CAAC;gBACL,MAAM,eAAe,GAAG,CACtB,MAAkB,EAClB,WAA6C,EAC7C,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClB,qEAAqE;oBACrE,oEAAoE;oBACpE,qDAAqD;oBACrD,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBAC7B,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;4BAAE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACnD,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,SAAS,CACd,eAAe,EACf,MAAM,CAAC,OAAO,CAAC,OAAO,EACtB,WAAW,EACX,MAAM,CAAC,UAAU,CAClB,EACD,KAAK,CAAC,KAAK,EACX,WAAW,CACZ,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACxB,CAAC;oBACD,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC;oBACvC,MAAM,IAAI,GAAG;wBACX,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,OAAO;wBAC/B,WAAW;wBACX,aAAa,EAAE,MAAM,CAAC,OAAO;qBAC9B,CAAC;oBACF,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACf,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,CAAC;gBACL,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE;oBAClC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;oBAC1C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvF,CAAC,CAAC,CAAC;gBAEH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC5C,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC5D,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC/C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAExB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;oBACnC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBAC3D,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CACtB,OAAO,CAAC,aAAa,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAClB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtB,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3E,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;wBACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;wBAC/C,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;wBAC5C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACxB,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;oBAC9B,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;wBACf,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC;wBACvC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC7E,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAChC,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,IAAI,CACT,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CACpE,CACF,CACF,CACF,CACF,CACF;oBACH,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,aAAa,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;wBACzC,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACtD,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACxB,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACnC,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CACjF,CACF,CACF;iBACJ,CAAC,CAAC;gBAEH,uEAAuE;gBACvE,qEAAqE;gBACrE,wEAAwE;gBACxE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClB,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;oBAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;oBACrC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBAC7B,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC3C,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;4BACtB,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;4BAC3E,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBAC1B,CAAC;wBACD,OAAO;oBACT,CAAC;oBACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtB,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3E,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACxB,OAAO;oBACT,CAAC;oBACD,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB,IAAI,KAAK,CAAC,KAAK;wBAAE,OAAO;oBACpE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBACzC,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBAClC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,SAAS,CACd,eAAe,EACf,MAAM,CAAC,OAAO,CAAC,OAAO,EACtB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,CAAC,UAAU,CACvB,EACD,KAAK,CAAC,KAAK,EACX,WAAW,CACZ,CAAC;wBACF,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC;oBACzC,CAAC;oBACD,QAAQ,CAAC;wBACP,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;wBACpC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,aAAa,EAAE,MAAM,CAAC,OAAO;qBAC9B,CAAC,CAAC;oBACH,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1B,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CACxC,CAAC;gBACF,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CACnB,OAAO,EACP,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/relay/index.d.ts

@@ -0,0 +1,37 @@
+import { Effect } from "effect";
+export declare const RELAY_AUTH_HEADER = "x-varlock-relay-token";
+export type RelayErrorCode = "invalid-config" | "bind-failed" | "unauthorized" | "path-denied" | "body-too-large" | "upstream-connect-failed" | "upstream-tls-failed" | "timeout" | "closed" | "unsupported" | "io";
+declare const RelayError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "RelayError";
+} & Readonly<A>;
+export declare class RelayError extends RelayError_base<{
+    readonly code: RelayErrorCode;
+    readonly message: string;
+}> {
+}
+export interface RelayConfig {
+    readonly upstreamUrl: string;
+    readonly proxyUrl: string;
+    readonly managerCaPem: string;
+    readonly placeholderHeaders: Readonly<Record<string, string>>;
+    readonly oauth: false;
+    readonly maxRequestBytes?: number;
+    readonly connectTimeoutMs?: number;
+    readonly idleTimeoutMs?: number;
+    readonly maxConnections?: number;
+}
+export interface RelayHealth {
+    readonly listening: boolean;
+    readonly activeRequests: number;
+    readonly localUrl: string;
+}
+export interface RelayHandle {
+    readonly localUrl: string;
+    /** Internal capability. Never include this in public RPC, logs, or status. */
+    readonly downstreamToken: string;
+    readonly health: Effect.Effect<RelayHealth>;
+    readonly stop: Effect.Effect<void, RelayError>;
+}
+export declare const startRelay: (config: RelayConfig) => Effect.Effect<RelayHandle, RelayError, import("effect/Scope").Scope>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/relay/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/relay/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,MAAM,MAAM,cAAc,GACtB,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,SAAS,GACT,QAAQ,GACR,aAAa,GACb,IAAI,CAAC;;;;AAET,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;CAChD;AA8gBD,eAAO,MAAM,UAAU,WAtOb,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,cAAc,EAAE,KAAK,CAqOvC,CAAC"}