@chnxthr/knowledge-mcp 0.0.0-stage → 0.3.1

package/dist/server/http.js

@@ -0,0 +1,406 @@
+/**
+ * Streamable HTTP transport (default). Express app with:
+ *   - POST/GET/DELETE /mcp — Authorization: Bearer <API key or OAuth access token>, checked on every request
+ *   - GET /health          — no auth
+ *   - OAuth 2.1 routes      — only when OAuth is configured (oauth.ts)
+ *
+ * The auth context reaches tool handlers through AsyncLocalStorage (context.ts).
+ */
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import express from 'express';
+import rateLimit from 'express-rate-limit';
+import { randomUUID, createHash } from 'crypto';
+import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from '@modelcontextprotocol/sdk/server/auth/router.js';
+import { authenticateApiKey } from '../core/auth.js';
+import { authStore } from '../core/context.js';
+import { oauthProvider, isOAuthConfigured, oauthConfigProblems, oauthAttempted, OAUTH_ISSUER_URL, OAUTH_RESOURCE, OAUTH_SCOPES, CONSENT_COOKIE, CONSENT_PATH, } from '../core/oauth.js';
+import { maskedSecretCount } from '../core/log_mask.js';
+import { getConfig, configSource } from '../core/config.js';
+import { getStore } from '../store/index.js';
+import { VERSION } from '../version.js';
+import { resolveUser } from './identity.js';
+import { createMcpServer } from './mcp.js';
+// Claude.ai 웹 커넥터는 브라우저에서 직접 /mcp 를 호출 → CORS 필요. 허용 Origin allowlist(env override).
+const MCP_CORS_ORIGINS = (process.env.MCP_CORS_ORIGINS || 'https://claude.ai,https://claude.com')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+// act-as 위임 — 이 key_id(내부 프록시 키)들에서만 X-MCP-Act-As-Email 을 신뢰해
+// "로그인 직원 권한"으로 강등/적용한다. 일반 키엔 영향 0. 헤더 role 은 신뢰하지 않고
+// app_users 에서 서버 재검증(위조 차단). 헤더 없으면 viewer 강등(fail-safe).
+const ACT_AS_ALLOWED_KEY_IDS = new Set((process.env.ACT_AS_ALLOWED_KEY_IDS || '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean));
+/** /mcp 응답에 CORS 헤더 부착(허용 Origin 일 때만). 비브라우저 클라이언트(Origin 없음)는 무영향. */
+function applyMcpCors(req, res) {
+    const origin = req.headers.origin;
+    if (origin && MCP_CORS_ORIGINS.includes(origin)) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'POST, GET, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'authorization, content-type, mcp-session-id, mcp-protocol-version, last-event-id');
+        res.setHeader('Access-Control-Expose-Headers', 'WWW-Authenticate, Mcp-Session-Id');
+        res.setHeader('Access-Control-Max-Age', '86400');
+    }
+}
+/**
+ * 고권한 secret 의 fingerprint(sha256 앞 8자)만 부팅 시 로깅 — 값은 절대 노출하지 않는다(S1).
+ * 회전 후 "새 키로 떴는지" 운영이 한눈에 확인하는 용도. fingerprint 가 그대로면 회전 미반영.
+ */
+function logSecretFingerprints() {
+    const KEYS = [
+        'SUPABASE_SERVICE_ROLE_KEY', 'OAUTH_JWT_SECRET',
+        'GITHUB_PAT', 'GITHUB_TOKEN', 'RAILWAY_MCP_TOKEN',
+        'SLACK_USER_TOKEN', 'SLACK_BOT_TOKEN', 'SLACK_TOKEN',
+    ];
+    const fp = (v) => createHash('sha256').update(v).digest('hex').slice(0, 8);
+    const parts = KEYS.filter((k) => process.env[k]).map((k) => `${k}=${fp(process.env[k])}`);
+    if (parts.length)
+        console.error(`[secrets] fingerprints(sha256/8): ${parts.join(' ')}`);
+}
+/** TRUST_PROXY env → express 'trust proxy' 값. 숫자=홉 수, true/false, 그 밖=서브넷 목록 문자열. */
+function trustProxySetting() {
+    const v = (process.env.TRUST_PROXY ?? '1').trim();
+    if (/^\d+$/.test(v))
+        return Number(v);
+    if (v === 'true')
+        return true;
+    if (v === 'false')
+        return false;
+    return v;
+}
+export async function runHttp(registry) {
+    // 어떤 플러그인이 켜졌는지(자격증명 갖춰진 것만), 어느 저장소를 쓰는지 부팅 시 1줄 로그 — ops 가시성.
+    const store = await getStore();
+    console.error(`[knowledge-mcp] config=${configSource()} · store=${store.kind} (${store.location}) · plugins · ${registry.summary()}`);
+    console.error(`[log-mask] env 시크릿 ${maskedSecretCount()}개 + 일반 패턴 마스킹 중`);
+    if (configSource() === 'defaults') {
+        console.error('[knowledge-mcp] ⚠️ no config found, running on defaults (no Drive roots, no excluded folders, no login allowlist). ' +
+            'Set MCP_CONFIG_JSON or put mcp.config.json in the working directory (/app/mcp.config.json in the container).');
+    }
+    logSecretFingerprints(); // 고권한 키 fingerprint(값 비노출) — 회전 검증용 (S1)
+    const app = express();
+    // 프록시 뒤라면 X-Forwarded-For 를 몇 홉까지 믿을지. 기본 1(Railway·Fly·Cloud Run 같은 앞단 프록시 1개).
+    // 프록시 없이 직접 노출하면 TRUST_PROXY=false 로 — 그래야 클라이언트가 보낸 헤더로 IP 를 바꿔 한도를 피하지 못한다.
+    app.set('trust proxy', trustProxySetting());
+    app.use(express.json({ limit: '4mb' }));
+    // Health check — 인증 X
+    app.get('/health', (_req, res) => {
+        res.json({ ok: true, server: 'knowledge-mcp', version: VERSION });
+    });
+    // ── OAuth 2.1 (Claude 앱 커스텀 커넥터용) — env 갖춰졌을 때만 (없으면 기존 Bearer 만) ──
+    const oauthEnabled = isOAuthConfigured();
+    let resourceMetadataUrl;
+    if (oauthEnabled) {
+        resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(new URL(OAUTH_RESOURCE));
+        // Google 로그인 콜백 — 우리 AS 가 Google(OIDC)로 브리지 후 client 로 우리 code 발급
+        app.get('/oauth/google/callback', async (req, res) => {
+            const code = typeof req.query.code === 'string' ? req.query.code : '';
+            const state = typeof req.query.state === 'string' ? req.query.state : '';
+            if (!code || !state) {
+                res.status(400).send('missing code/state');
+                return;
+            }
+            try {
+                const url = await oauthProvider.completeGoogleLogin(code, state);
+                res.redirect(url);
+            }
+            catch (e) {
+                res.status(400).send(`OAuth login error: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        });
+        // AS 엔드포인트 + .well-known(authorize·token·register·AS메타·PRM). 루트에 장착.
+        app.use(mcpAuthRouter({
+            provider: oauthProvider,
+            issuerUrl: new URL(OAUTH_ISSUER_URL),
+            scopesSupported: OAUTH_SCOPES,
+            resourceName: getConfig().branding.name,
+            resourceServerUrl: new URL(OAUTH_RESOURCE),
+        }));
+        // 동의 화면의 승인/취소 — oauth.ts consumeConsent. 쿠키(SameSite=Lax)와 폼 csrf 가 모두 맞아야 진행.
+        app.post(CONSENT_PATH, express.urlencoded({ extended: false, limit: '4kb' }), (req, res) => {
+            const body = (req.body ?? {});
+            const cookie = String(req.headers.cookie ?? '')
+                .split(';')
+                .map((c) => c.trim())
+                .find((c) => c.startsWith(`${CONSENT_COOKIE}=`));
+            const cookieCsrf = cookie ? cookie.slice(CONSENT_COOKIE.length + 1) : '';
+            res.setHeader('Cache-Control', 'no-store');
+            res.setHeader('Set-Cookie', `${CONSENT_COOKIE}=; Path=${CONSENT_PATH}; Max-Age=0; HttpOnly; SameSite=Lax`);
+            try {
+                const url = oauthProvider.consumeConsent(String(body.id ?? ''), String(body.csrf ?? ''), cookieCsrf, body.action === 'approve');
+                res.redirect(url);
+            }
+            catch (e) {
+                res.status(400).type('text').send(e instanceof Error ? e.message : String(e));
+            }
+        });
+        console.error(`[knowledge-mcp] OAuth enabled · issuer=${OAUTH_ISSUER_URL} · resource=${OAUTH_RESOURCE}`);
+    }
+    else if (oauthAttempted()) {
+        // 반쯤 설정된 상태는 조용히 끄지 않고 빠진 값을 이름으로 알린다(값은 노출 안 함).
+        console.error(`[knowledge-mcp] ⚠️ OAuth off — missing: ${oauthConfigProblems().join(', ')}`);
+    }
+    else {
+        console.error('[knowledge-mcp] OAuth 미설정 (Bearer 전용)');
+    }
+    // CORS preflight — Claude.ai 웹 커넥터 브라우저 요청용.
+    app.options('/mcp', (req, res) => {
+        applyMcpCors(req, res);
+        res.status(204).end();
+    });
+    // GET(SSE 상시 스트림)·DELETE(세션 종료) 는 아래 rate-limit 정의 후 세션 라우팅 핸들러로 등록한다
+    // (하이브리드 stateful — 활성 세션이 있을 때만 그 transport 로 처리, 없으면 405).
+    // ── /mcp rate-limit (S2) ── IP 기준(trust proxy 1 로 req.ip 정확). 한도는 env override.
+    // 목적: 잘못된 키 폭주가 validate_mcp_key RPC 를 증폭(DB 부하·비용)시키는 것 차단 + 일반 abuse 완화.
+    // 2단: ① 전체 넉넉한 한도(정상 챗봇/IDE 무영향) ② 인증 실패(401)에만 더 강한 한도.
+    const RL_WINDOW_MS = Number(process.env.MCP_RATE_LIMIT_WINDOW_MS ?? 60_000);
+    const rlHandler = (status, message) => (req, res) => {
+        applyMcpCors(req, res);
+        res.status(status).json({ jsonrpc: '2.0', error: { code: -32029, message }, id: null });
+    };
+    const mcpRateLimit = rateLimit({
+        windowMs: RL_WINDOW_MS,
+        limit: Number(process.env.MCP_RATE_LIMIT_MAX ?? 120),
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        handler: rlHandler(429, 'rate limit exceeded — slow down'),
+    });
+    const mcpAuthFailRateLimit = rateLimit({
+        windowMs: RL_WINDOW_MS,
+        limit: Number(process.env.MCP_RATE_LIMIT_FAIL_MAX ?? 20),
+        // 401 만 센다 — 재배포 뒤 세션 만료(404), 세션 없는 GET(405), 끊긴 SSE 까지 "인증 실패"로 세면
+        // 같은 출구 IP(사내 NAT 등)의 정상 사용자가 함께 429 를 받는다.
+        skipSuccessfulRequests: true,
+        requestWasSuccessful: (_req, res) => res.statusCode !== 401,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        handler: rlHandler(429, 'too many failed auth attempts — slow down'),
+    });
+    // ── 인증 해석 (POST·GET·DELETE 공용) ──
+    // 세션 방식이어도 인증은 매 요청 수행한다(권한을 세션에 묶지 않음 — 세션ID 가 유출돼도 각 요청의
+    // Bearer/OAuth 토큰으로 재인증하므로 세션 하이재킹으로 권한 상승 불가). ok:false 면 send401.
+    const extractKey = (req) => {
+        const authHeader = req.headers.authorization;
+        const key = authHeader?.startsWith('Bearer ') ? authHeader.slice(7).trim() : undefined;
+        return { key, looksJwt: !!key && key.split('.').length === 3 };
+    };
+    const resolveAuth = async (req) => {
+        const { key, looksJwt } = extractKey(req);
+        let auth;
+        // dual-auth (순서 최적화): OAuth access token 은 JWT(점 3개) → 로컬 HS256 검증을 *먼저*.
+        // 기존 mcp_key/dev key 는 JWT 형식 아니라 충돌 없음. 커넥터(OAuth) 호출이 validate_mcp_key RPC 를
+        // 헛왕복(매번 실패, 캐시 안 됨)하지 않게 한다 — 호출 지연·DB 부하 제거.
+        if (oauthEnabled && looksJwt) {
+            try {
+                const info = await oauthProvider.verifyAccessToken(key);
+                const oauthEmail = typeof info.extra?.email === 'string' ? info.extra.email : undefined;
+                // OAuth 사용자도 app_users role 반영(act-as 와 일관). email 은 Google 로그인+allowlist 검증값이라
+                // 신뢰. 없음/미등록/조회 실패 → viewer (P2 — 미등록 계정에 PII 도구 미개방).
+                let oauthRole = 'viewer';
+                let oauthScopes;
+                if (oauthEmail) {
+                    const r = await resolveUser(info.clientId ?? 'oauth', oauthEmail);
+                    oauthRole = r.role;
+                    oauthScopes = r.scopes;
+                }
+                auth = {
+                    ok: true, org_id: getConfig().orgId, role: oauthRole,
+                    email: oauthEmail, key_id: info.clientId, scopes: oauthScopes,
+                };
+            }
+            catch {
+                auth = { ok: false, reason: 'invalid oauth token' };
+            }
+        }
+        else {
+            // 기존 Bearer 경로(IDE·내부 프록시·dev key)
+            auth = await authenticateApiKey(key);
+            // 직접 키(IDE)도 직원 email 로 role+scope 를 app_users 에서 재계산(act-as·OAuth 와 통일).
+            // P1: role 도 재계산해 퇴사·강등 즉시 반영(옛 구멍: revoke 전까지 admin 유지). dev key 는 제외.
+            if (auth.ok && auth.email && auth.email !== 'dev@local') {
+                const { role, scopes } = await resolveUser(auth.key_id ?? 'direct', auth.email);
+                auth = { ...auth, role, scopes };
+            }
+        }
+        if (!auth.ok)
+            return auth;
+        // ── act-as (내부 프록시 → 로그인 직원 권한 전파) ──
+        // 위임 key_id 일 때만. 헤더 role 은 안 읽고 app_users 서버 재계산(위조 방지). 헤더 없으면 viewer.
+        if (auth.key_id && ACT_AS_ALLOWED_KEY_IDS.has(auth.key_id)) {
+            const hdr = req.headers['x-mcp-act-as-email'];
+            const actAsEmail = typeof hdr === 'string' ? hdr.trim() : '';
+            if (!actAsEmail) {
+                auth = { ...auth, role: 'viewer', email: undefined, actAs: true };
+            }
+            else {
+                const { role, scopes } = await resolveUser(auth.key_id, actAsEmail);
+                auth = { ...auth, role, email: actAsEmail, scopes, actAs: true };
+                console.error(`[act-as] key_id=${auth.key_id} email=${actAsEmail} role=${role}`);
+            }
+        }
+        return auth;
+    };
+    const send401 = (req, res, auth) => {
+        const { key, looksJwt } = extractKey(req);
+        // OAuth 진입 조건(토큰 없음 또는 JWT)에만 discovery 트리거 헤더 부착(IDE 오유입 방지).
+        if (oauthEnabled && resourceMetadataUrl && (!key || looksJwt)) {
+            res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${resourceMetadataUrl}"`);
+        }
+        res.status(401).json({
+            jsonrpc: '2.0',
+            error: { code: -32001, message: `auth failed: ${auth.reason ?? 'unauthorized'}` },
+            id: null,
+        });
+    };
+    const sessions = new Map();
+    const SESSION_IDLE_MS = Number(process.env.MCP_SESSION_IDLE_MS ?? 30 * 60_000);
+    const SESSION_MAX = Number(process.env.MCP_SESSION_MAX ?? 1000);
+    const dropSession = (sid) => {
+        const s = sessions.get(sid);
+        if (s) {
+            sessions.delete(sid);
+            s.transport.close().catch(() => { });
+        }
+    };
+    // 유휴 세션 청소 — DELETE 없이 사라진 커넥터의 세션을 만료(메모리 누수 방지). unref → 프로세스 유지 안 함.
+    const sweeper = setInterval(() => {
+        const now = Date.now();
+        for (const [sid, s] of sessions)
+            if (now - s.lastActive > SESSION_IDLE_MS)
+                dropSession(sid);
+    }, 5 * 60_000);
+    sweeper.unref();
+    // GET(SSE 상시 스트림)·DELETE(세션 종료) — 활성 세션이 있을 때만 그 transport 로 라우팅.
+    // 세션 없으면 stateless 서버엔 스트림이 없으므로 405(기존 동작 유지).
+    const handleSessionStream = async (req, res) => {
+        applyMcpCors(req, res);
+        const auth = await resolveAuth(req);
+        if (!auth.ok)
+            return send401(req, res, auth);
+        const sidHeader = req.headers['mcp-session-id'];
+        const sid = typeof sidHeader === 'string' ? sidHeader : undefined;
+        const s = sid ? sessions.get(sid) : undefined;
+        if (!s) {
+            res.setHeader('Allow', 'POST, OPTIONS');
+            res.status(405).json({
+                jsonrpc: '2.0',
+                error: { code: -32000, message: 'no active session for this stream' },
+                id: null,
+            });
+            return;
+        }
+        s.lastActive = Date.now();
+        try {
+            await authStore.run(auth, () => s.transport.handleRequest(req, res));
+        }
+        catch (e) {
+            console.error('[knowledge-mcp] GET/DELETE handler error:', e);
+            if (!res.headersSent)
+                res.status(500).end();
+        }
+    };
+    app.get('/mcp', mcpRateLimit, mcpAuthFailRateLimit, handleSessionStream);
+    app.delete('/mcp', mcpRateLimit, mcpAuthFailRateLimit, handleSessionStream);
+    // MCP endpoint (POST) — 세션 라우팅 + stateless 폴백
+    app.post('/mcp', mcpRateLimit, mcpAuthFailRateLimit, async (req, res) => {
+        applyMcpCors(req, res);
+        const auth = await resolveAuth(req);
+        if (!auth.ok)
+            return send401(req, res, auth);
+        const sidHeader = req.headers['mcp-session-id'];
+        const sid = typeof sidHeader === 'string' ? sidHeader : undefined;
+        try {
+            // 1) 기존 세션 → 그 transport 로 라우팅 (인증은 위에서 매 요청 수행)
+            if (sid) {
+                const s = sessions.get(sid);
+                if (!s) {
+                    // 만료/미지 세션 — 클라이언트가 재init 하도록 404
+                    res.status(404).json({
+                        jsonrpc: '2.0',
+                        error: { code: -32001, message: 'session not found — reinitialize' },
+                        id: null,
+                    });
+                    return;
+                }
+                s.lastActive = Date.now();
+                await authStore.run(auth, () => s.transport.handleRequest(req, res, req.body));
+                return;
+            }
+            // 2) initialize (세션ID 없음) → 새 stateful 세션 생성 (Mcp-Session-Id 발급)
+            if (isInitializeRequest(req.body)) {
+                if (sessions.size >= SESSION_MAX) {
+                    // 백스톱 — 가장 오래된 세션 정리 (무한 증가 방지)
+                    let oldestSid;
+                    let oldest = Infinity;
+                    for (const [k, v] of sessions)
+                        if (v.lastActive < oldest) {
+                            oldest = v.lastActive;
+                            oldestSid = k;
+                        }
+                    if (oldestSid)
+                        dropSession(oldestSid);
+                }
+                const transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: () => randomUUID(),
+                    onsessioninitialized: (newSid) => {
+                        sessions.set(newSid, { transport, lastActive: Date.now() });
+                    },
+                });
+                transport.onclose = () => {
+                    if (transport.sessionId)
+                        sessions.delete(transport.sessionId);
+                };
+                const server = createMcpServer(registry);
+                await server.connect(transport);
+                await authStore.run(auth, () => transport.handleRequest(req, res, req.body));
+                return;
+            }
+            // 3) stateless 폴백 (비-initialize + 세션ID 없음) — 기존 IDE·프록시 one-shot 보존.
+            const server = createMcpServer(registry);
+            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+            res.on('close', () => {
+                transport.close().catch(() => { });
+            });
+            await server.connect(transport);
+            await authStore.run(auth, () => transport.handleRequest(req, res, req.body));
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            console.error(`[knowledge-mcp] /mcp handler error:`, e);
+            if (!res.headersSent) {
+                res.status(500).json({
+                    jsonrpc: '2.0',
+                    error: { code: -32603, message: msg },
+                    id: null,
+                });
+            }
+        }
+    });
+    // PORT=0 은 빈 포트를 고른다(시험용). 실제 포트는 반환값으로 알린다.
+    const wanted = parseInt(process.env.PORT || '8080', 10);
+    const httpServer = await new Promise((resolveListen, rejectListen) => {
+        const srv = app.listen(wanted, () => resolveListen(srv));
+        srv.once('error', rejectListen);
+    });
+    const address = httpServer.address();
+    const port = typeof address === 'object' && address ? address.port : wanted;
+    console.error(`[knowledge-mcp] HTTP mode · listening on :${port} · version=${VERSION}`);
+    // 외부 연결은 포트를 연 뒤 백그라운드로 — upstream·Qdrant 가 응답하지 않아도 /health 가 먼저 뜬다
+    // (예전엔 listen 전에 기다려 healthcheck 시간 안에 포트가 안 열리고 재시작이 반복될 수 있었다).
+    // 원격 MCP 는 연결되기 전 tools/list 에서 빠져 있다가, 연결되면 다음 목록부터 나온다.
+    void registry.start();
+    return {
+        port,
+        close: () => new Promise((done) => {
+            clearInterval(sweeper);
+            for (const sid of [...sessions.keys()])
+                dropSession(sid);
+            httpServer.close(() => done());
+            httpServer.closeAllConnections?.();
+        }),
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/server/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,OAA6E,MAAM,SAAS,CAAC;AACpG,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,oCAAoC,EAAE,MAAM,iDAAiD,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAoD,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EACrE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,GAC7E,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,sCAAsC,CAAC;KAC9F,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,8DAA8D;AAC9D,uDAAuD;AACvD,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;KACvC,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AAEF,wEAAwE;AACxE,SAAS,YAAY,CAAC,GAAmB,EAAE,GAAoB;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QACrD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,kFAAkF,CACnF,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG;QACX,2BAA2B,EAAE,kBAAkB;QAC/C,YAAY,EAAE,cAAc,EAAE,mBAAmB;QACjD,kBAAkB,EAAE,iBAAiB,EAAE,aAAa;KACrD,CAAC;IACF,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,qFAAqF;AACrF,SAAS,iBAAiB;IACxB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAAkB;IAC9C,gEAAgE;IAChE,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,YAAY,EAAE,YAAY,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,iBAAiB,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtI,OAAO,CAAC,KAAK,CAAC,sBAAsB,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC1E,IAAI,YAAY,EAAE,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CACX,qHAAqH;YACnH,8GAA8G,CACjH,CAAC;IACJ,CAAC;IACD,qBAAqB,EAAE,CAAC,CAAC,yCAAyC;IAElE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,iFAAiF;IACjF,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAExC,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAC;IACzC,IAAI,mBAAuC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,mBAAmB,GAAG,oCAAoC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACpF,kEAAkE;QAClE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,GAAG,CAAC,GAAG,CACL,aAAa,CAAC;YACZ,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC;YACpC,eAAe,EAAE,YAAY;YAC7B,YAAY,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI;YACvC,iBAAiB,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;SAC3C,CAAC,CACH,CAAC;QACF,gFAAgF;QAChF,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACzF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;iBAC5C,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,cAAc,WAAW,YAAY,qCAAqC,CAAC,CAAC;YAC3G,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,CACtC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EACrB,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EACvB,UAAU,EACV,IAAI,CAAC,MAAM,KAAK,SAAS,CAC1B,CAAC;gBACF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CACX,0CAA0C,gBAAgB,eAAe,cAAc,EAAE,CAC1F,CAAC;IACJ,CAAC;SAAM,IAAI,cAAc,EAAE,EAAE,CAAC;QAC5B,kDAAkD;QAClD,OAAO,CAAC,KAAK,CAAC,2CAA2C,mBAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IAED,6CAA6C;IAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,6DAA6D;IAE7D,iFAAiF;IACjF,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,MAAM,CAAC,CAAC;IAC5E,MAAM,SAAS,GACb,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,GAAmB,EAAE,GAAoB,EAAE,EAAE;QACjF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC;IACJ,MAAM,YAAY,GAAG,SAAS,CAAC;QAC7B,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC;QACpD,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,iCAAiC,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,SAAS,CAAC;QACrC,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;QACxD,qEAAqE;QACrE,4CAA4C;QAC5C,sBAAsB,EAAE,IAAI;QAC5B,oBAAoB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG;QAC3D,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,2CAA2C,CAAC;KACrE,CAAC,CAAC;IAEH,mCAAmC;IACnC,2DAA2D;IAC3D,oEAAoE;IACpE,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAuC,EAAE;QAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,MAAM,GAAG,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,EAAE,GAAmB,EAAwB,EAAE;QACtE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAiB,CAAC;QACtB,0EAA0E;QAC1E,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,GAAI,CAAC,CAAC;gBACzD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxF,gFAAgF;gBAChF,uDAAuD;gBACvD,IAAI,SAAS,GAAS,QAAQ,CAAC;gBAC/B,IAAI,WAAuC,CAAC;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,UAAU,CAAC,CAAC;oBAClE,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;gBACzB,CAAC;gBACD,IAAI,GAAG;oBACL,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS;oBACpD,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW;iBAC9D,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACrC,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACxD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChF,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,uCAAuC;QACvC,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBACpE,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,UAAU,UAAU,SAAS,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAE,GAAoB,EAAE,IAAiB,EAAQ,EAAE;QACrF,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC1C,+DAA+D;QAC/D,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,6BAA6B,mBAAmB,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE;YACjF,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC,CAAC;IASF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,CAAC,GAAW,EAAQ,EAAE;QACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IACF,wEAAwE;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,eAAe;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;IACf,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,kEAAkE;IAClE,gDAAgD;IAChD,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAiB,EAAE;QAC7F,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE;gBACrE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;IACzE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;IAE5E,8CAA8C;IAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,IAAI,CAAC;YACH,iDAAiD;YACjD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,CAAC,CAAC,EAAE,CAAC;oBACP,kCAAkC;oBAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE;wBACpE,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YAED,iEAAiE;YACjE,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,IAAI,QAAQ,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;oBACjC,gCAAgC;oBAChC,IAAI,SAA6B,CAAC;oBAClC,IAAI,MAAM,GAAG,QAAQ,CAAC;oBACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ;wBAAE,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;4BAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC;4BAAC,SAAS,GAAG,CAAC,CAAC;wBAAC,CAAC;oBACnG,IAAI,SAAS;wBAAE,WAAW,CAAC,SAAS,CAAC,CAAC;gBACxC,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;oBACtC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;wBAC/B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC9D,CAAC;iBACF,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,IAAI,SAAS,CAAC,SAAS;wBAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAChE,CAAC,CAAC;gBACF,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE;oBACrC,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAA6B,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QAC/F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,CAAC,KAAK,CAAC,6CAA6C,IAAI,cAAc,OAAO,EAAE,CAAC,CAAC;IAExF,qEAAqE;IACrE,kEAAkE;IAClE,0DAA0D;IAC1D,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEtB,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE;YACzB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YACzD,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/B,UAAU,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACrC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/server/identity.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Effective role and scopes of a person, recomputed from app_users on every request path
+ * (direct key with an email, OAuth, act-as). Demotions and removals take effect within the cache TTL.
+ */
+import type { Role, ResourceScopes } from '../core/auth.js';
+import type { UserRecord } from '../store/types.js';
+/** app_users row → role. No row = viewer. 'admin' = admin. Anything else = member. */
+export declare function roleFromUser(row: Pick<UserRecord, 'role'> | null | undefined): Role;
+/**
+ * Role + scopes for `email`. Never trusts a role sent by the client.
+ * A failed lookup does not widen access: the result is viewer and is not cached, so a short outage
+ * does not stick for the TTL (fail-closed).
+ */
+export declare function resolveUser(keyId: string, email: string): Promise<{
+    role: Role;
+    scopes?: ResourceScopes;
+}>;

package/dist/server/identity.js

@@ -0,0 +1,47 @@
+import { getStore } from '../store/index.js';
+const ACT_AS_TTL_MS = Number(process.env.ACT_AS_CACHE_TTL_MS ?? 60_000);
+const _cache = new Map();
+/** app_users row → role. No row = viewer. 'admin' = admin. Anything else = member. */
+export function roleFromUser(row) {
+    if (!row)
+        return 'viewer';
+    return row.role === 'admin' ? 'admin' : 'member';
+}
+/**
+ * Role + scopes for `email`. Never trusts a role sent by the client.
+ * A failed lookup does not widen access: the result is viewer and is not cached, so a short outage
+ * does not stick for the TTL (fail-closed).
+ */
+export async function resolveUser(keyId, email) {
+    const cacheKey = `${keyId}:${email.toLowerCase()}`;
+    const now = Date.now();
+    const cached = _cache.get(cacheKey);
+    if (cached && cached.expiresAt > now)
+        return { role: cached.role, scopes: cached.scopes };
+    let role;
+    let scopes;
+    try {
+        const row = await (await getStore()).getUser(email);
+        role = roleFromUser(row);
+        scopes =
+            row && row.scopesKnown !== false
+                ? {
+                    slackChannels: row.allowedSlackChannels ?? null,
+                    driveFolders: row.allowedDriveFolders ?? null,
+                    tools: row.allowedTools ?? null,
+                }
+                : undefined;
+    }
+    catch (e) {
+        console.error('[identity] app_users lookup failed → viewer:', e instanceof Error ? e.message : e);
+        return { role: 'viewer' };
+    }
+    if (_cache.size > 500) {
+        for (const [k, v] of _cache)
+            if (v.expiresAt <= now)
+                _cache.delete(k);
+    }
+    _cache.set(cacheKey, { role, scopes, expiresAt: now + ACT_AS_TTL_MS });
+    return { role, scopes };
+}
+//# sourceMappingURL=identity.js.map

package/dist/server/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/server/identity.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsE,CAAC;AAE7F,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,GAAgD;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,KAAa;IAC5D,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAE1F,IAAI,IAAU,CAAC;IACf,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM;YACJ,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK;gBAC9B,CAAC,CAAC;oBACE,aAAa,EAAE,GAAG,CAAC,oBAAoB,IAAI,IAAI;oBAC/C,YAAY,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI;oBAC7C,KAAK,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;iBAChC;gBACH,CAAC,CAAC,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/dist/server/mcp.d.ts

@@ -0,0 +1,7 @@
+/**
+ * One MCP server instance (per HTTP session, or one for stdio). Lists and routes tools from the registry,
+ * filtered by the caller's permission, and logs every call.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { type Registry } from '../plugin/registry.js';
+export declare function createMcpServer(registry: Registry): Server;

package/dist/server/mcp.js

@@ -0,0 +1,55 @@
+/**
+ * One MCP server instance (per HTTP session, or one for stdio). Lists and routes tools from the registry,
+ * filtered by the caller's permission, and logs every call.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { getAuthMaybe } from '../core/context.js';
+import { isToolAllowed } from '../core/scope.js';
+import { logToolCall } from '../store/tool_log.js';
+import { VERSION } from '../version.js';
+import { PING } from '../plugin/registry.js';
+import { handlePing, pingTool } from '../plugin/ping.js';
+import { errorResult, textResult } from '../plugin/result.js';
+export function createMcpServer(registry) {
+    const server = new Server({ name: 'knowledge-mcp', version: VERSION }, { capabilities: { tools: {} }, instructions: registry.instructions() });
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        // Plugins without their credentials are already left out, so the model never tries a tool that can't work.
+        const tools = registry.listTools(pingTool);
+        const auth = getAuthMaybe();
+        if (!auth || !auth.ok)
+            return { tools: tools.filter((t) => t.name === PING) };
+        return { tools: tools.filter((t) => isToolAllowed(auth, t.name, registry.groupOf(t.name))) };
+    });
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const { name, arguments: args } = request.params;
+        const t0 = Date.now();
+        const auth = getAuthMaybe();
+        const result = await (async () => {
+            // Checked again on call, not only on list (defense in depth). No auth = deny.
+            if (!auth || !auth.ok || !isToolAllowed(auth, name, registry.groupOf(name))) {
+                return textResult(`[forbidden] 도구 '${name}' 은 현재 직원 권한으로 접근 불가입니다.`, true);
+            }
+            if (name === PING) {
+                try {
+                    return handlePing(registry, auth, args);
+                }
+                catch (e) {
+                    return errorResult(name, e);
+                }
+            }
+            return registry.call(name, args, auth);
+        })();
+        const r = result;
+        logToolCall({
+            tool: name,
+            auth,
+            ok: r.isError !== true,
+            error: r.isError === true ? (r.content?.find((c) => c.type === 'text')?.text ?? null) : null,
+            durationMs: Date.now() - t0,
+        });
+        return result;
+    });
+    return server;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/server/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/server/mcp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAC3C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE,CACvE,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,2GAA2G;QAC3G,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;YAC/B,8EAA8E;YAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5E,OAAO,UAAU,CAAC,mBAAmB,IAAI,0BAA0B,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;QAEL,MAAM,CAAC,GAAG,MAAkF,CAAC;QAC7F,WAAW,CAAC;YACV,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI;YACtB,KAAK,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC5F,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/stdio.d.ts

@@ -0,0 +1,2 @@
+import type { Registry } from '../plugin/registry.js';
+export declare function runStdio(registry: Registry): Promise<void>;

package/dist/server/stdio.js

@@ -0,0 +1,40 @@
+/**
+ * stdio transport — the MCP client starts this process and talks over stdin/stdout. One process = one user.
+ *
+ * Without MCP_API_KEY the process runs as the local admin: whoever can start it already holds every token
+ * in its env, so a key adds no boundary. With MCP_API_KEY the key is checked like on HTTP, and a key tied
+ * to an email gets that person's role and scopes from app_users.
+ *
+ * stdout carries the protocol. Log only with console.error.
+ */
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { authenticateApiKey } from '../core/auth.js';
+import { setProcessAuth } from '../core/context.js';
+import { getConfig, configSource } from '../core/config.js';
+import { resolveUser } from './identity.js';
+import { createMcpServer } from './mcp.js';
+export async function runStdio(registry) {
+    const key = process.env.MCP_API_KEY?.trim();
+    let auth;
+    if (!key) {
+        auth = { ok: true, org_id: getConfig().orgId, role: 'admin', email: 'local@stdio' };
+    }
+    else {
+        auth = await authenticateApiKey(key);
+        if (!auth.ok) {
+            console.error(`[knowledge-mcp] stdio auth failed: ${auth.reason}. Check MCP_API_KEY, or unset it to run as the local admin.`);
+            process.exit(1);
+        }
+        if (auth.email && auth.email !== 'dev@local') {
+            const { role, scopes } = await resolveUser(auth.key_id ?? 'direct', auth.email);
+            auth = { ...auth, role, scopes };
+        }
+    }
+    // Set before the transport exists — see context.ts for why AsyncLocalStorage.enterWith is not enough.
+    setProcessAuth(auth);
+    void registry.start({ jobs: false }); // remotes only — background jobs belong to the long-running HTTP server
+    const server = createMcpServer(registry);
+    await server.connect(new StdioServerTransport());
+    console.error(`[knowledge-mcp] stdio mode · ${auth.email ?? auth.org_id} (${auth.role}) · config=${configSource()} · ${registry.summary()}`);
+}
+//# sourceMappingURL=stdio.js.map

package/dist/server/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/server/stdio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAoB,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAkB;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,CAAC,MAAM,6DAA6D,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChF,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IACD,sGAAsG;IACtG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,wEAAwE;IAC9G,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CACX,gCAAgC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,cAAc,YAAY,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,CAC9H,CAAC;AACJ,CAAC"}