@chances-ai/engine 24.0.0

package/dist/mcp/host.js

@@ -0,0 +1,530 @@
+import { AppError, ErrorCode } from "@chances-ai/runtime";
+import { McpClient } from "./client.js";
+import { bridgeMcpTool, sanitizeMcpName } from "./bridge.js";
+import { expandServerEnv } from "./env.js";
+import { buildRedactor, collectSecrets } from "./redact.js";
+import { ChancesOAuthClientProvider } from "./oauth/provider.js";
+import { LoopbackCallbackServer } from "./oauth/callback-server.js";
+/**
+ * Lifecycle orchestrator for one or more MCP servers. Connects them in
+ * parallel on `start()`, surfaces per-server failures as `failed` status
+ * instead of crashing the whole boot, and registers each server's discovered
+ * tools into the host `ToolRegistry`.
+ *
+ * Not a Plugin — MCP integration lives at the runtime layer because the
+ * engine consumes tools, not plugin hooks. Slash commands and CLI glue talk
+ * to the host directly.
+ *
+ * **Lifecycle serialization.** Every method that mutates host state
+ * (`startServer` / `restart` / `remove` / `dispose`) is chained behind a
+ * single `opsLock` promise so concurrent calls observe a consistent state
+ * machine. Two concurrent `restart(x)` calls run sequentially; a
+ * `dispose()` interleaved with a `restart()` always wins (because each
+ * step re-checks `disposed`). This guards against the codex-flagged race
+ * where a floating `/mcp restart` could resurrect a server after global
+ * teardown.
+ */
+export class McpHost {
+    opts;
+    states = new Map();
+    disposed = false;
+    opsLock = Promise.resolve();
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * Constructs and starts the host. Returns once every server has either
+     * connected (and its tools are in the registry) or failed (status
+     * `failed`, error message logged). Always resolves — never throws — so a
+     * misconfigured MCP server can't take down the agent.
+     */
+    static async start(opts) {
+        const host = new McpHost(opts);
+        const entries = Object.entries(opts.servers);
+        if (entries.length === 0)
+            return host;
+        await Promise.allSettled(entries.map(([id, cfg]) => host.runOp(() => host.startServer(id, cfg))));
+        return host;
+    }
+    status() {
+        return [...this.states.values()].map((s) => ({ ...s.status }));
+    }
+    /**
+     * Tears down the named server (if any), wipes its registered tools, then
+     * reconnects from its current config. Surfaces the new status. Caller is
+     * the `/mcp restart` slash command.
+     */
+    async restart(id) {
+        return this.runOp(async () => {
+            const state = this.states.get(id);
+            if (!state) {
+                throw new AppError(ErrorCode.Config, `mcp: unknown server '${id}'`);
+            }
+            if (this.disposed) {
+                throw new AppError(ErrorCode.Config, `mcp: host is disposed; cannot restart '${id}'`);
+            }
+            await this.disposeServer(state);
+            // dispose() may have flipped `disposed` while we were awaiting; bail
+            // before we resurrect the server.
+            if (this.disposed) {
+                throw new AppError(ErrorCode.Config, `mcp: host was disposed during restart of '${id}'`);
+            }
+            await this.startServer(id, state.config);
+            return this.states.get(id).status;
+        });
+    }
+    /**
+     * Tears down the named server and unregisters its tools, but leaves no
+     * trace in host state — callers (typically `/mcp remove`) own the config
+     * mutation. Throws if no such server is known.
+     */
+    async remove(id) {
+        return this.runOp(async () => {
+            const state = this.states.get(id);
+            if (!state) {
+                throw new AppError(ErrorCode.Config, `mcp: unknown server '${id}'`);
+            }
+            await this.disposeServer(state);
+            this.states.delete(id);
+        });
+    }
+    /**
+     * One-shot validation: connect, list tools, dispose. Doesn't register any
+     * tools or mutate host state. Caller is `/mcp test`.
+     */
+    async test(id) {
+        const cfg = this.opts.servers[id];
+        if (!cfg)
+            return { ok: false, output: `unknown server '${id}'` };
+        const expanded = safeExpandEnv(cfg, this.opts.env ?? process.env, id);
+        if (expanded instanceof AppError)
+            return { ok: false, output: expanded.message };
+        const redact = buildRedactor(secretsFor(expanded));
+        let client;
+        try {
+            client = await McpClient.connect(id, expanded, {
+                connectTimeoutMs: this.opts.connectTimeoutMs,
+                clientIdentity: this.opts.clientIdentity,
+                redact,
+            });
+            const tools = await client.listTools();
+            const names = tools.map((t) => t.name).join(", ") || "(no tools advertised)";
+            return { ok: true, output: `connected — ${tools.length} tool(s): ${names}` };
+        }
+        catch (e) {
+            return { ok: false, output: redact(e.message) };
+        }
+        finally {
+            if (client) {
+                try {
+                    await client.dispose();
+                }
+                catch (e) {
+                    this.opts.logger.warn(`mcp '${id}': test dispose failed: ${redact(e.message)}`);
+                }
+            }
+        }
+    }
+    /**
+     * Tears down every server and unregisters their tools. Safe to call
+     * repeatedly; subsequent calls are no-ops.
+     */
+    async dispose() {
+        return this.runOp(async () => {
+            if (this.disposed)
+                return;
+            this.disposed = true;
+            await Promise.allSettled([...this.states.values()].map((s) => this.disposeServer(s)));
+            this.states.clear();
+        });
+    }
+    /**
+     * Serializes a lifecycle operation behind `opsLock` so concurrent
+     * `restart`/`remove`/`dispose` calls run one at a time. The lock is a
+     * promise chain — every new op `.then`s itself onto the previous one.
+     */
+    runOp(op) {
+        const next = this.opsLock.then(op, op);
+        // Replace the lock with a never-rejected continuation so a rejected
+        // op doesn't poison the chain. The caller still sees the rejection.
+        this.opsLock = next.catch(() => undefined);
+        return next;
+    }
+    async startServer(id, config) {
+        // Preserve OAuth provider/redactor/coalescer across restart so a
+        // refresh in flight when the user runs /mcp restart can still be
+        // aborted, and so token scrubs from the previous connect still hold.
+        const prior = this.states.get(id);
+        const state = {
+            config,
+            status: { id, state: "starting" },
+            registeredToolNames: [],
+            oauth: prior?.oauth,
+            redactor: (m) => m,
+            resources: [],
+            prompts: [],
+            generation: (prior?.generation ?? 0) + 1,
+        };
+        this.states.set(id, state);
+        if (config.enabled === false) {
+            state.status = { id, state: "disabled" };
+            return;
+        }
+        const expanded = safeExpandEnv(config, this.opts.env ?? process.env, id);
+        if (expanded instanceof AppError) {
+            state.status = { id, state: "failed", error: expanded.message };
+            this.opts.logger.warn(`mcp '${id}': ${expanded.message}`);
+            return;
+        }
+        const redact = state.oauth?.redactor ?? buildRedactor(secretsFor(expanded));
+        // (5.4) Keep the redactor on state so resource/prompt reads scrub the same
+        // secret bag the bridge does (codex R1 S1).
+        state.redactor = redact;
+        // (3.7) Build / reuse the OAuth provider for this server when
+        // `auth.kind === "oauth"`. The provider survives across restarts
+        // (refresh coalescer must persist so an in-flight refresh can be
+        // aborted by /mcp logout); only the callback server is per-flow.
+        let authProvider;
+        if (isOAuthHttp(expanded)) {
+            if (!this.opts.vault) {
+                const message = `mcp '${id}': OAuth configured but local-vault unavailable — ` +
+                    `install '../local-vault/index.js' or remove the 'auth' block`;
+                state.status = { id, state: "failed", error: message };
+                this.opts.logger.warn(message);
+                return;
+            }
+            // (codex Round-2 MUST-FIX #3) Always create a FRESH provider +
+            // callback server on startServer. The provider captures its
+            // vault-generation snapshot at construction and drops every later
+            // save when `current.generation > snapshotGen`; reusing the same
+            // instance across logout/restart leaves the snapshot stale and the
+            // next /mcp login can never persist tokens. The redactor is the
+            // only thing we preserve so secrets discovered before restart
+            // still scrub from errors after.
+            const callbackServer = new LoopbackCallbackServer();
+            const provider = await ChancesOAuthClientProvider.create({
+                serverName: id,
+                serverConfig: expanded,
+                vault: this.opts.vault,
+                callbackServer,
+                redactor: redact,
+                logger: this.opts.logger,
+                openBrowser: this.opts.openBrowser ?? (async () => undefined),
+            });
+            // Close the previous flow's callback server if one was still bound
+            // (e.g. user Ctrl-C'd a previous /mcp login mid-flow before restart).
+            if (state.oauth?.callbackServer) {
+                try {
+                    await state.oauth.callbackServer.close();
+                }
+                catch {
+                    // best-effort
+                }
+            }
+            state.oauth = {
+                provider,
+                callbackServer,
+                redactor: redact,
+                config: expanded,
+            };
+            authProvider = state.oauth.provider;
+        }
+        let client;
+        try {
+            client = await McpClient.connect(id, expanded, {
+                connectTimeoutMs: this.opts.connectTimeoutMs,
+                clientIdentity: this.opts.clientIdentity,
+                redact,
+                authProvider,
+                workspaceRoot: this.opts.workspaceRoot,
+                advertiseRoots: this.opts.advertiseRoots,
+            });
+        }
+        catch (e) {
+            const message = redact(e.message);
+            state.status = { id, state: "failed", error: message };
+            this.opts.logger.warn(`mcp '${id}': connect failed: ${message}`);
+            return;
+        }
+        // Host may have been disposed while we were connecting. Drop the new
+        // client cleanly instead of registering tools that will never be torn
+        // down by `dispose()` (it already drained `states`).
+        if (this.disposed) {
+            try {
+                await client.dispose();
+            }
+            catch {
+                // best-effort
+            }
+            this.states.delete(id);
+            return;
+        }
+        state.client = client;
+        let descriptors;
+        try {
+            descriptors = await client.listTools();
+        }
+        catch (e) {
+            const message = `listTools failed: ${redact(e.message)}`;
+            state.status = { id, state: "failed", error: message };
+            this.opts.logger.warn(`mcp '${id}': ${message}`);
+            try {
+                await client.dispose();
+            }
+            catch {
+                // best-effort
+            }
+            state.client = undefined;
+            return;
+        }
+        // Detect sanitization collisions BEFORE registering anything. Two MCP
+        // tool names that sanitize to the same `mcp__<srv>__<tool>` would let
+        // a later descriptor silently overwrite an earlier one in the shared
+        // `ToolRegistry` — and the per-tool permission rule key would be
+        // ambiguous between them. Fail the server instead.
+        const seen = new Map();
+        for (const d of descriptors) {
+            const final = `mcp__${sanitizeMcpName(id)}__${sanitizeMcpName(d.name)}`;
+            const prior = seen.get(final);
+            if (prior !== undefined) {
+                const message = `tool name collision: '${prior}' and '${d.name}' both sanitize to '${final}'`;
+                state.status = { id, state: "failed", error: message };
+                this.opts.logger.warn(`mcp '${id}': ${message}`);
+                try {
+                    await client.dispose();
+                }
+                catch {
+                    // best-effort
+                }
+                state.client = undefined;
+                return;
+            }
+            seen.set(final, d.name);
+        }
+        // Also catch collisions with existing registry entries (built-in tools
+        // or tools from another already-running MCP server). Registering over
+        // them would silently replace a previously-approved tool.
+        for (const finalName of seen.keys()) {
+            if (this.opts.registry.get(finalName)) {
+                const message = `tool name '${finalName}' is already registered (built-in or another MCP server)`;
+                state.status = { id, state: "failed", error: message };
+                this.opts.logger.warn(`mcp '${id}': ${message}`);
+                try {
+                    await client.dispose();
+                }
+                catch {
+                    // best-effort
+                }
+                state.client = undefined;
+                return;
+            }
+        }
+        const tools = descriptors.map((d) => bridgeMcpTool(id, d, client, { defaultTimeoutMs: config.timeoutMs, redact }));
+        for (const tool of tools) {
+            this.opts.registry.register(tool);
+            state.registeredToolNames.push(tool.name);
+        }
+        // (5.4 D9′) Best-effort resources + prompts discovery. A server that lacks
+        // the capability (rejects with -32601) or errors yields an empty list — we
+        // NEVER fail the server for it: its tools are already registered and useful.
+        state.resources = await this.discoverResources(id, client, redact);
+        state.prompts = await this.discoverPrompts(id, client, redact);
+        state.status = {
+            id,
+            state: "ready",
+            toolCount: tools.length,
+            toolNames: state.registeredToolNames.slice(),
+        };
+    }
+    async discoverResources(id, client, redact) {
+        try {
+            const list = await client.listResources();
+            return list.map((r) => ({ ...r, server: id }));
+        }
+        catch (e) {
+            this.opts.logger.debug(`mcp '${id}': resources/list unavailable: ${redact(e.message)}`);
+            return [];
+        }
+    }
+    async discoverPrompts(id, client, redact) {
+        try {
+            const list = await client.listPrompts();
+            return list.map((p) => ({ ...p, server: id }));
+        }
+        catch (e) {
+            this.opts.logger.debug(`mcp '${id}': prompts/list unavailable: ${redact(e.message)}`);
+            return [];
+        }
+    }
+    async disposeServer(state) {
+        for (const name of state.registeredToolNames) {
+            this.opts.registry.unregister(name);
+        }
+        state.registeredToolNames = [];
+        // (5.4) Drop cached resources/prompts. Prompt SLASH commands are owned by
+        // the CLI (rebuilt per respawn from `host.prompts()` — codex R1 M1), so
+        // there's nothing to unregister here.
+        state.resources = [];
+        state.prompts = [];
+        // (5.4 R2 S3) Detach the client + bump the generation BEFORE awaiting
+        // dispose. A concurrent `readResource`/`getPrompt` snapshots client+gen
+        // synchronously, then awaits; clearing here means its post-await
+        // `assertSameGeneration` sees `client !== captured` (and a higher gen) and
+        // fails cleanly instead of returning content from a server mid-teardown.
+        const client = state.client;
+        state.client = undefined;
+        state.generation += 1;
+        if (client) {
+            try {
+                await client.dispose();
+            }
+            catch (e) {
+                this.opts.logger.warn(`mcp '${state.status.id}': dispose failed: ${e.message}`);
+            }
+        }
+        state.status = { id: state.status.id, state: "disposed" };
+    }
+    // ─── 5.4 resources + prompts accessors ───────────────────────────────
+    // Implements `McpResourceProvider` (resources + readResource); the CLI uses
+    // `prompts`/`getPrompt` directly to build slash commands. Reads run OUTSIDE
+    // `opsLock`; each snapshots the client + generation so a concurrent
+    // `/mcp restart` that swaps the client mid-read fails cleanly (codex R1 S3).
+    /** Cached `resources/list` snapshot across servers (optional filter). */
+    resources(server) {
+        const all = [...this.states.values()].flatMap((s) => s.resources);
+        return server ? all.filter((r) => r.server === server) : all;
+    }
+    /** Cached `prompts/list` snapshot across servers (optional filter). */
+    prompts(server) {
+        const all = [...this.states.values()].flatMap((s) => s.prompts);
+        return server ? all.filter((p) => p.server === server) : all;
+    }
+    async readResource(server, uri, signal) {
+        const state = this.states.get(server);
+        if (!state?.client) {
+            throw new AppError(ErrorCode.Config, `mcp: server '${server}' is not connected`);
+        }
+        const client = state.client;
+        const gen = state.generation;
+        const redact = state.redactor;
+        let contents;
+        try {
+            contents = await client.readResource(uri, { signal });
+        }
+        catch (e) {
+            if (e instanceof AppError && e.code === ErrorCode.Cancelled)
+                throw e;
+            throw new AppError(ErrorCode.Provider, redact(e.message));
+        }
+        this.assertSameGeneration(server, client, gen, "read");
+        return { contents, redact };
+    }
+    async getPrompt(server, name, args, signal) {
+        const state = this.states.get(server);
+        if (!state?.client) {
+            throw new AppError(ErrorCode.Config, `mcp: server '${server}' is not connected`);
+        }
+        const client = state.client;
+        const gen = state.generation;
+        const redact = state.redactor;
+        let result;
+        try {
+            result = await client.getPrompt(name, args, { signal });
+        }
+        catch (e) {
+            if (e instanceof AppError && e.code === ErrorCode.Cancelled)
+                throw e;
+            throw new AppError(ErrorCode.Provider, redact(e.message));
+        }
+        this.assertSameGeneration(server, client, gen, "prompt fetch");
+        return { ...result, redact };
+    }
+    /** (5.4 S3) Throw if the server's client was swapped/disposed during an await. */
+    assertSameGeneration(server, client, gen, op) {
+        const after = this.states.get(server);
+        if (!after || after.generation !== gen || after.client !== client) {
+            throw new AppError(ErrorCode.Provider, `mcp: server '${server}' restarted during ${op}; retry`);
+        }
+    }
+    // ─── 3.7 OAuth surface ─────────────────────────────────────────────
+    /**
+     * Test/slash seam — returns the per-server OAuth bag (provider,
+     * callback server, coalescer, redactor). Returns undefined when the
+     * server isn't OAuth-configured or hasn't been started yet.
+     */
+    getOAuthState(id) {
+        return this.states.get(id)?.oauth;
+    }
+    /**
+     * (3.7) Logs out a single OAuth-configured server:
+     *  1. Bumps the vault payload's generation (via `invalidateCredentials("all")`)
+     *     so late-arriving `saveTokens` from a refresh that escaped the
+     *     teardown drops on the generation guard inside `mergeMutate`
+     *     (codex Round-1 MUST-FIX #5).
+     *  2. Restarts the server. **(codex Round-2 MUST-FIX #3)** `startServer`
+     *     constructs a FRESH `ChancesOAuthClientProvider` with the new
+     *     generation snapshot, so the next `/mcp login` can persist tokens
+     *     and the old provider's cached state can't resurface.
+     *
+     * No-op when the server isn't OAuth-configured.
+     */
+    async logout(id) {
+        return this.runOp(async () => {
+            const state = this.states.get(id);
+            if (!state?.oauth) {
+                // Either unknown server or non-OAuth. Neither is an error — slash
+                // commands surface their own messaging.
+                return;
+            }
+            await state.oauth.provider.invalidateCredentials("all");
+            // disposeServer + startServer together rebuild the OAuth state with
+            // a fresh provider (gen snapshot reads the just-bumped generation)
+            // and a fresh callback server. The previous callback server gets
+            // closed in startServer before assignment.
+            await this.disposeServer(state);
+            if (!this.disposed) {
+                await this.startServer(id, state.config);
+            }
+        });
+    }
+    /** (3.7) Logs out every OAuth-configured server. Per-server failures
+     *  don't abort the loop. */
+    async logoutAll() {
+        const oauthIds = [...this.states.entries()]
+            .filter(([, s]) => s.oauth !== undefined)
+            .map(([id]) => id);
+        for (const id of oauthIds) {
+            try {
+                await this.logout(id);
+            }
+            catch (e) {
+                this.opts.logger.warn(`mcp '${id}': logout failed: ${e.message}`);
+            }
+        }
+    }
+}
+/**
+ * (3.7) Discriminator — is this config an HTTP MCP server with OAuth?
+ * Used by `startServer` to decide whether to construct a provider.
+ */
+function isOAuthHttp(c) {
+    return c.type === "http" && c.auth?.kind === "oauth";
+}
+function safeExpandEnv(config, env, id) {
+    try {
+        return expandServerEnv(config, env);
+    }
+    catch (e) {
+        if (e instanceof AppError) {
+            return new AppError(ErrorCode.Config, `mcp '${id}': ${e.message}`);
+        }
+        return new AppError(ErrorCode.Config, `mcp '${id}': env expansion failed: ${e.message}`);
+    }
+}
+function secretsFor(config) {
+    if (config.type === "stdio") {
+        return collectSecrets({ env: config.env });
+    }
+    return collectSecrets({ headers: config.headers, url: config.url });
+}
+//# sourceMappingURL=host.js.map

package/dist/mcp/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/mcp/host.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAuB,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAC;AAYlF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAgHpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,OAAO;IAKmB;IAJpB,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,QAAQ,GAAG,KAAK,CAAC;IACjB,OAAO,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YAAqC,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;IAAG,CAAC;IAE7D;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAoB;QACrC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,0CAA0C,EAAE,GAAG,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,qEAAqE;YACrE,kCAAkC;YAClC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC5C,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;gBACxC,MAAM;aACP,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,KAAK,CAAC,MAAM,aAAa,KAAK,EAAE,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,OAAO,CAAC,UAAU,CACtB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAC5D,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAI,EAAoB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,MAAuB;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,qEAAqE;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,KAAK,GAAgB;YACzB,MAAM;YACN,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;YACjC,mBAAmB,EAAE,EAAE;YACvB,KAAK,EAAE,KAAK,EAAE,KAAK;YACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC;SACzC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAE3B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,2EAA2E;QAC3E,4CAA4C;QAC5C,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC;QAExB,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,YAAoD,CAAC;QACzD,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,OAAO,GACX,QAAQ,EAAE,oDAAoD;oBAC9D,8DAA8D,CAAC;gBACjE,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,4DAA4D;YAC5D,kEAAkE;YAClE,iEAAiE;YACjE,mEAAmE;YACnE,gEAAgE;YAChE,8DAA8D;YAC9D,iCAAiC;YACjC,MAAM,cAAc,GAAG,IAAI,sBAAsB,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC;gBACvD,UAAU,EAAE,EAAE;gBACd,YAAY,EAAE,QAAQ;gBACtB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,cAAc;gBACd,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;aAC9D,CAAC,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;YACH,CAAC;YACD,KAAK,CAAC,KAAK,GAAG;gBACZ,QAAQ;gBACR,cAAc;gBACd,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,QAAsC;aAC/C,CAAC;YACF,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QACtC,CAAC;QAED,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC5C,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;gBACxC,MAAM;gBACN,YAAY;gBACZ,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;gBACtC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC7C,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,OAAO,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAEtB,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,qBAAqB,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YACzB,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,mDAAmD;QACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,QAAQ,eAAe,CAAC,EAAE,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,yBAAyB,KAAK,UAAU,CAAC,CAAC,IAAI,uBAAuB,KAAK,GAAG,CAAC;gBAC9F,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,0DAA0D;QAC1D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,cAAc,SAAS,0DAA0D,CAAC;gBAClG,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;gBACzB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAW,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAC7E,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,KAAK,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,KAAK,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/D,KAAK,CAAC,MAAM,GAAG;YACb,EAAE;YACF,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE;SAC7C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,EAAU,EACV,MAAiB,EACjB,MAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,kCAAkC,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,EAAU,EACV,MAAiB,EACjB,MAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gCAAgC,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAkB;QAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,wEAAwE;QACxE,sCAAsC;QACtC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACnB,sEAAsE;QACtE,wEAAwE;QACxE,iEAAiE;QACjE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,6EAA6E;IAE7E,yEAAyE;IACzE,SAAS,CAAC,MAAe;QACvB,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,OAAO,CAAC,MAAe;QACrB,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,GAAW,EACX,MAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,MAAM,oBAAoB,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9B,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS;gBAAE,MAAM,CAAC,CAAC;YACrE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAc,EACd,IAAY,EACZ,IAA4B,EAC5B,MAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,MAAM,oBAAoB,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9B,IAAI,MAA8D,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS;gBAAE,MAAM,CAAC,CAAC;YACrE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,kFAAkF;IAC1E,oBAAoB,CAAC,MAAc,EAAE,MAAiB,EAAE,GAAW,EAAE,EAAU;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,MAAM,sBAAsB,EAAE,SAAS,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,sEAAsE;IAEtE;;;;OAIG;IACH,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;gBAClB,kEAAkE;gBAClE,wCAAwC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACxD,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,2CAA2C;YAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;gCAC4B;IAC5B,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACrB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,QAAQ,EAAE,qBAAsB,CAAW,CAAC,OAAO,EAAE,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,CAAkB;IACrC,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,GAAuC,EACvC,EAAU;IAEV,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,4BAA6B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAuB;IACzC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,18 @@
+export type { HttpMcpConfig, McpPrompt, McpPromptArgument, McpPromptMessage, McpResource, McpResourceContent, McpServerConfig, McpServerStatus, McpTestResult, OAuthMcpAuth, StdioMcpConfig, } from "./types.js";
+export { type McpContentPart, type RenderOptions, type FormatResourceOptions, renderMcpContentParts, capUtf8, formatResourceContents, persistResourceBlob, safeBlobExt, } from "./content.js";
+export { parsePromptArgs, renderPromptMessages } from "./prompts.js";
+export { type McpResolvedResource, type McpResourceProvider, type ResourceMention, type ResourceToolOptions, extractResourceMentions, makeResourceTools, resolveMcpMentions, } from "./resources.js";
+export { type BridgeOptions, type McpCallToolClient, type McpCallToolResult, type McpToolDescriptor, bridgeMcpTool, sanitizeMcpName, } from "./bridge.js";
+export { type ToolAnnotations, categoryFromAnnotations } from "./category.js";
+export { expandEnv, expandServerEnv } from "./env.js";
+export { type ClientIdentity, type LoadedSdk, type SdkLikeClient, type SdkLikeTransport, McpClient, __resetAuthFnForTest, __resetSdkLoaderForTest, __setAuthFnForTest, __setSdkLoaderForTest, loadSdkAuth, } from "./client.js";
+export { type LocalVaultLike, type McpHostOptions, McpHost } from "./host.js";
+export { type ParseFailure, parseServerConfig, parseServerMap } from "./parse.js";
+export { type RuntimeRedactor, buildRedactor, collectSecrets, stripTerminalControls, } from "./redact.js";
+export { loadMcpHost } from "./load-mcp-host.js";
+export { ChancesOAuthClientProvider, type VaultPayload, type OAuthDiscoveryStateInput, type OAuthDiscoveryStateOutput, } from "./oauth/provider.js";
+export { LoopbackCallbackServer } from "./oauth/callback-server.js";
+export { RefreshCoalescer } from "./oauth/refresh-coalescer.js";
+export { makeConfigHash, makeVaultKey } from "./oauth/config-hash.js";
+export { classifyOAuthResponse, isDefinitiveOAuthError, type NormalisedOAuthError, } from "./oauth/error-normalize.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,OAAO,EACP,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,aAAa,EACb,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,SAAS,EACT,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,KAAK,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EACL,KAAK,eAAe,EACpB,aAAa,EACb,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,0BAA0B,EAC1B,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC"}

package/dist/mcp/index.js

@@ -0,0 +1,17 @@
+export { renderMcpContentParts, capUtf8, formatResourceContents, persistResourceBlob, safeBlobExt, } from "./content.js";
+export { parsePromptArgs, renderPromptMessages } from "./prompts.js";
+export { extractResourceMentions, makeResourceTools, resolveMcpMentions, } from "./resources.js";
+export { bridgeMcpTool, sanitizeMcpName, } from "./bridge.js";
+export { categoryFromAnnotations } from "./category.js";
+export { expandEnv, expandServerEnv } from "./env.js";
+export { McpClient, __resetAuthFnForTest, __resetSdkLoaderForTest, __setAuthFnForTest, __setSdkLoaderForTest, loadSdkAuth, } from "./client.js";
+export { McpHost } from "./host.js";
+export { parseServerConfig, parseServerMap } from "./parse.js";
+export { buildRedactor, collectSecrets, stripTerminalControls, } from "./redact.js";
+export { loadMcpHost } from "./load-mcp-host.js";
+export { ChancesOAuthClientProvider, } from "./oauth/provider.js";
+export { LoopbackCallbackServer } from "./oauth/callback-server.js";
+export { RefreshCoalescer } from "./oauth/refresh-coalescer.js";
+export { makeConfigHash, makeVaultKey } from "./oauth/config-hash.js";
+export { classifyOAuthResponse, isDefinitiveOAuthError, } from "./oauth/error-normalize.js";
+//# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,qBAAqB,EACrB,OAAO,EACP,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAKL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,aAAa,EACb,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAwB,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAKL,SAAS,EACT,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAA4C,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAqB,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EAEL,aAAa,EACb,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,0BAA0B,GAI3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,4BAA4B,CAAC"}

package/dist/mcp/load-mcp-host.d.ts

@@ -0,0 +1,32 @@
+/**
+ * (3.7) `loadMcpHost({withVault})` — boot-time factory for `McpHost` that
+ * lazily resolves `@chances-ai/local-vault` ONLY when the caller asks for
+ * a vault. Keeps the cold-start budget intact when no OAuth-configured
+ * MCP server is present (`apps/cli/src/boot/load-runtime.ts` passes
+ * `withVault: needsOAuth`).
+ *
+ * **Boundary decision (codex Round-1 NICE).** `apps/cli` MUST NOT import
+ * `@chances-ai/local-vault` directly — the only `app → local-vault` edge
+ * would force dependency-cruiser to permit a new boundary rule. Routing
+ * vault creation through this factory keeps the graph clean: only
+ * `@chances-ai/mcp` reaches into the vault package.
+ *
+ * **`bun build --compile` story.** The vault specifier is COMPUTED
+ * (`["@chances-ai", "local-vault"].join("/")`) so Bun's bundler doesn't
+ * statically resolve it. A binary built without `@chances-ai/local-vault`
+ * in node_modules still compiles cleanly — at runtime, the dynamic
+ * import fails, we log a clear diagnostic, and OAuth-configured MCP
+ * servers individually fail with the same diagnostic (the non-OAuth
+ * servers keep working). § 13.4 / § 16 of `docs/3.7-design.md` cover
+ * the five-permutation smoke gate that pins this property.
+ */
+import { McpHost, type LocalVaultLike, type McpHostOptions } from "./host.js";
+export interface LoadMcpHostOptions extends Omit<McpHostOptions, "vault"> {
+    /** Set to `true` when at least one configured server has OAuth — see
+     *  `apps/cli/src/boot/load-runtime.ts` for the determinant. */
+    withVault: boolean;
+    /** Override the vault loader for tests. */
+    vaultLoader?: () => Promise<LocalVaultLike>;
+}
+export declare function loadMcpHost(opts: LoadMcpHostOptions): Promise<McpHost>;
+//# sourceMappingURL=load-mcp-host.d.ts.map

package/dist/mcp/load-mcp-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-mcp-host.d.ts","sourceRoot":"","sources":["../../src/mcp/load-mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAE9E,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;IACvE;mEAC+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7C;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB5E"}