@chrischall/mcp-utils 2.15.0 → 3.0.0

package/dist/netguard/index.js

@@ -0,0 +1,365 @@
+/**
+ * SSRF guard for fetching a URL somebody else chose — a link from a tool
+ * argument, an email click-tracker, an `images_url`, every redirect any of
+ * them issue — so it can only reach the public internet.
+ *
+ * Fleet audit 2026-09-24 (chrischall/fleet-audit#1150). Three repos had grown
+ * three copies of the same table and none closed the gap the audit named:
+ *
+ *  - accessoticketing-mcp `src/netguard.ts` resolved the name, checked every
+ *    address, then let `fetch` resolve it AGAIN — so a DNS-rebinding name
+ *    could answer public at check time and `169.254.169.254` at connect time
+ *    (its own header comment said so) — and its redirect loop ran
+ *    `hops <= MAX_REDIRECTS`, i.e. eleven requests for a limit of ten;
+ *  - gemini-mcp `src/fetch-image.ts` judged only IP LITERALS ("closing
+ *    [rebinding] needs resolve-then-pin, which neither Node's nor workerd's
+ *    fetch exposes"), so any name pointing inward passed;
+ *  - mcp-host `packages/core/src/egress.ts` had the most complete table, and
+ *    the pin, but inside its own CONNECT proxy.
+ *
+ * This module is the one table and the pin:
+ *
+ *  - {@link isPublicAddress} — one IPv4 + IPv6 block table (private,
+ *    loopback, link-local / cloud metadata, CGNAT, ULA, multicast, reserved,
+ *    documentation, and the forms that EMBED an IPv4 judged by that IPv4).
+ *    Hand-parsed rather than `node:net`, and FAILS CLOSED on anything it
+ *    cannot parse.
+ *  - {@link createPublicOnlyDispatcher} — an undici `Agent` whose connector
+ *    resolves the name itself (injectable resolver), refuses the connection
+ *    with `UrlNotAllowedError` when ANY address is not public, and hands the
+ *    socket exactly the addresses it vetted. There is no second resolution,
+ *    so there is no lookup-to-connect window to rebind in. An IP-literal host
+ *    (which Node never looks up) is judged directly.
+ *  - {@link fetchPublic} — `fetch` through that dispatcher with MANUAL
+ *    redirects: `assertAllowedUrl` on the first URL and on every hop, at most
+ *    `maxRedirects` follow-up requests (so `maxRedirects + 1` requests in
+ *    all), credential headers dropped on a cross-origin hop, one deadline
+ *    over the whole exchange, and an optional byte cap.
+ *
+ * A SUBPATH (`@chrischall/mcp-utils/netguard`), never the root barrel: it
+ * imports `undici` (an optional peer), and only the few servers that fetch
+ * third-party URLs should have to install it.
+ *
+ * TLS still validates the certificate against the NAME (undici sets SNI /
+ * `servername` from the URL host), so pinning the address costs no
+ * certificate checking.
+ */
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { Agent, buildConnector, fetch as undiciFetch, Headers } from 'undici';
+import { McpToolError } from '../errors/index.js';
+import { assertAllowedUrl, RedirectRefusedError, RequestTimeoutError, UrlNotAllowedError, } from '../http/index.js';
+import { readBytesCapped } from '../http/body-limit.js';
+// ---------------------------------------------------------------------------
+// isPublicAddress
+// ---------------------------------------------------------------------------
+/**
+ * Is this textual IP address one the public internet routes?
+ *
+ * `false` for everything else — and for anything that is not a well-formed
+ * IPv4 dotted quad or IPv6 literal (a bracketed `[::1]`, a zone id
+ * `fe80::1%eth0`, the `127.1` shorthand): a guard that admits what it does not
+ * understand is the wrong default for this control.
+ *
+ * The ranges:
+ *
+ *   IPv4  0/8 this-network, 10/8 + 172.16/12 + 192.168/16 RFC 1918,
+ *         100.64/10 CGNAT, 127/8 loopback, 169.254/16 link-local (the cloud
+ *         metadata service), 192.0.0/24 protocol assignments, 192.0.2/24 +
+ *         198.51.100/24 + 203.0.113/24 TEST-NET, 192.88.99/24 6to4 relay
+ *         anycast, 198.18/15 benchmarking, 224/4 multicast, 240/4 reserved
+ *         including broadcast.
+ *   IPv6  ::/96 (unspecified, loopback, and the deprecated IPv4-compatible
+ *         form — refused WHOLE, even around a public IPv4), 64:ff9b:1::/48
+ *         local-use NAT64, 100::/64 discard, 2001::/32 Teredo, 2001:2::/48
+ *         benchmarking, 2001:10::/28 + 2001:20::/28 ORCHID, 2001:db8::/32 +
+ *         3fff::/20 documentation, 5f00::/16 SRv6, fc00::/7 ULA (Fly's 6PN
+ *         `fdaa::/16` lives here), fe80::/10 link-local, fec0::/10
+ *         site-local, ff00::/8 multicast.
+ *   Embedded IPv4 — `::ffff:a.b.c.d` (mapped, what a dual-stack resolver
+ *         returns for an A record), `::ffff:0:a.b.c.d` (SIIT), 64:ff9b::/96
+ *         (NAT64) and 2002::/16 (6to4) — judged by the IPv4 they carry, so
+ *         `::ffff:7f00:1` is loopback and `::ffff:8.8.8.8` is public.
+ *
+ * Consolidates accessoticketing-mcp `isPrivateAddress`, gemini-mcp
+ * `isPrivateIpv4`/`isPrivateIpv6` and mcp-host `isPublicAddress`.
+ */
+export function isPublicAddress(ip) {
+    const v4 = parseIPv4(ip);
+    if (v4)
+        return isPublicIPv4(v4);
+    const v6 = parseIPv6(ip);
+    if (v6)
+        return isPublicIPv6(v6);
+    return false;
+}
+/** Four octets for a canonical dotted quad, else `undefined`. */
+function parseIPv4(text) {
+    if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(text))
+        return undefined;
+    const octets = text.split('.').map(Number);
+    return octets.every((o) => o <= 255) ? octets : undefined;
+}
+/** 16 bytes, or `undefined` for anything that is not a well-formed IPv6 literal. */
+function parseIPv6(text) {
+    if (!/^[0-9a-fA-F:.]+$/.test(text) || !text.includes(':'))
+        return undefined;
+    const halves = text.split('::');
+    if (halves.length > 2)
+        return undefined;
+    const groups = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        const pieces = part.split(':');
+        for (const [i, piece] of pieces.entries()) {
+            if (i === pieces.length - 1 && piece.includes('.')) {
+                const v4 = parseIPv4(piece);
+                if (!v4)
+                    return undefined;
+                const [a = 0, b = 0, c = 0, d = 0] = v4;
+                out.push((a << 8) | b, (c << 8) | d);
+                continue;
+            }
+            if (!/^[0-9a-fA-F]{1,4}$/.test(piece))
+                return undefined;
+            out.push(parseInt(piece, 16));
+        }
+        return out;
+    };
+    const head = groups(halves[0] ?? '');
+    const tail = halves.length === 2 ? groups(halves[1] ?? '') : [];
+    if (!head || !tail)
+        return undefined;
+    const fill = 8 - head.length - tail.length;
+    if (halves.length === 2 ? fill < 1 : fill !== 0)
+        return undefined;
+    const words = [...head, ...new Array(fill).fill(0), ...tail];
+    const bytes = [];
+    for (const w of words)
+        bytes.push(w >> 8, w & 0xff);
+    return bytes;
+}
+function inRange(bytes, prefix, bits) {
+    for (let i = 0; i < bits; i += 1) {
+        const byte = i >> 3;
+        const mask = 0x80 >> (i & 7);
+        if (((bytes[byte] ?? 0) & mask) !== ((prefix[byte] ?? 0) & mask))
+            return false;
+    }
+    return true;
+}
+const BLOCKED_V4 = [
+    [[0, 0, 0, 0], 8], // this network
+    [[10, 0, 0, 0], 8], // RFC 1918
+    [[100, 64, 0, 0], 10], // CGNAT
+    [[127, 0, 0, 0], 8], // loopback
+    [[169, 254, 0, 0], 16], // link-local, incl. cloud metadata
+    [[172, 16, 0, 0], 12], // RFC 1918
+    [[192, 0, 0, 0], 24], // IETF protocol assignments
+    [[192, 0, 2, 0], 24], // TEST-NET-1
+    [[192, 88, 99, 0], 24], // 6to4 relay anycast (deprecated)
+    [[192, 168, 0, 0], 16], // RFC 1918
+    [[198, 18, 0, 0], 15], // benchmarking
+    [[198, 51, 100, 0], 24], // TEST-NET-2
+    [[203, 0, 113, 0], 24], // TEST-NET-3
+    [[224, 0, 0, 0], 4], // multicast
+    [[240, 0, 0, 0], 4], // reserved + broadcast
+];
+function isPublicIPv4(octets) {
+    return !BLOCKED_V4.some(([prefix, bits]) => inRange(octets, prefix, bits));
+}
+const V6 = (hex) => parseIPv6(hex);
+const BLOCKED_V6 = [
+    [V6('::'), 96], // ::, ::1 and the deprecated IPv4-compatible form, refused whole
+    [V6('64:ff9b:1::'), 48], // local-use NAT64 (RFC 8215)
+    [V6('100::'), 64], // discard-only
+    [V6('2001::'), 32], // Teredo
+    [V6('2001:2::'), 48], // benchmarking
+    [V6('2001:10::'), 28], // ORCHID (deprecated)
+    [V6('2001:20::'), 28], // ORCHIDv2
+    [V6('2001:db8::'), 32], // documentation
+    [V6('3fff::'), 20], // documentation (RFC 9637)
+    [V6('5f00::'), 16], // SRv6 SIDs
+    [V6('fc00::'), 7], // unique local
+    [V6('fe80::'), 10], // link-local
+    [V6('fec0::'), 10], // site-local (deprecated)
+    [V6('ff00::'), 8], // multicast
+];
+const MAPPED_V4 = V6('::ffff:0:0');
+const SIIT_V4 = V6('::ffff:0:0:0');
+const NAT64 = V6('64:ff9b::');
+const SIX_TO_FOUR = V6('2002::');
+function isPublicIPv6(bytes) {
+    if (inRange(bytes, MAPPED_V4, 96) || inRange(bytes, SIIT_V4, 96) || inRange(bytes, NAT64, 96)) {
+        return isPublicIPv4(bytes.slice(12, 16));
+    }
+    if (inRange(bytes, SIX_TO_FOUR, 16))
+        return isPublicIPv4(bytes.slice(2, 6));
+    return !BLOCKED_V6.some(([prefix, bits]) => inRange(bytes, prefix, bits));
+}
+/** The default {@link Resolver}: the OS resolver, every address, in resolver order. */
+export const systemResolver = async (hostname) => (await dnsLookup(hostname, { all: true, verbatim: true })).map((a) => a.address);
+function refuseHost(hostname) {
+    return new UrlNotAllowedError(`Refusing to connect to ${hostname}: it is, or resolves to, a private, loopback, link-local or reserved address.`, 'host');
+}
+/**
+ * An undici `Agent` that can only connect to public addresses.
+ *
+ * Its connector resolves each new connection's host with `resolve`, refuses
+ * the connection with `UrlNotAllowedError` (reason `'host'`, naming the host —
+ * never the address it resolved to) when the name resolves to nothing or ANY
+ * address fails `isAllowedAddress`, and gives the socket exactly the addresses
+ * it checked. Node never resolves the name a second time, which closes the
+ * lookup-to-connect DNS-rebinding window a check-then-`fetch` guard leaves
+ * open. An IP-literal host is judged as itself and never resolved.
+ *
+ * Use it as the `dispatcher` of undici's `fetch`/`request` (or via
+ * {@link fetchPublic}). Close it (`await agent.close()`) when done.
+ */
+export function createPublicOnlyDispatcher(opts = {}) {
+    const resolve = opts.resolve ?? systemResolver;
+    const allowed = opts.isAllowedAddress ?? isPublicAddress;
+    const lookup = (hostname, options, callback) => {
+        resolve(hostname).then((addresses) => {
+            if (addresses.length === 0 || !addresses.every(allowed)) {
+                callback(refuseHost(hostname), '', 0);
+                return;
+            }
+            const entries = addresses.map((address) => ({ address, family: isIP(address) }));
+            if (options.all) {
+                callback(null, entries);
+                return;
+            }
+            const wanted = options.family === 4 || options.family === 6 ? options.family : 0;
+            const pick = entries.find((e) => wanted === 0 || e.family === wanted) ?? entries[0];
+            callback(null, pick.address, pick.family);
+        }, (err) => callback(err, '', 0));
+    };
+    const inner = buildConnector({ ...opts.connect, lookup });
+    const connect = (options, callback) => {
+        const host = options.hostname.replace(/^\[|\]$/g, '');
+        if (isIP(host) !== 0 && !allowed(host)) {
+            callback(refuseHost(options.hostname), null);
+            return;
+        }
+        inner(options, callback);
+    };
+    return new Agent({ ...opts.agent, connect });
+}
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const CROSS_ORIGIN_DROPPED = ['authorization', 'cookie', 'proxy-authorization'];
+function findUrlRefusal(err) {
+    let e = err;
+    for (let i = 0; i < 8 && e; i += 1) {
+        if (e instanceof UrlNotAllowedError)
+            return e;
+        e = e.cause;
+    }
+    return undefined;
+}
+export async function fetchPublic(url, opts = {}) {
+    const { maxRedirects = 10, timeoutMs, maxBytes, signal: callerSignal, dispatcher: given, requireHttps, allowHosts, stopBefore, resolve, isAllowedAddress, headers: initHeaders, method: initMethod, body: initBody, ...init } = opts;
+    if (!Number.isInteger(maxRedirects) || maxRedirects < 0) {
+        throw new TypeError('fetchPublic: maxRedirects must be a non-negative integer.');
+    }
+    const check = (target) => assertAllowedUrl(target, {
+        allowHosts: allowHosts ?? [/(?:)/],
+        ...(requireHttps !== undefined ? { requireHttps } : {}),
+    });
+    let current = check(url);
+    const origin = current.origin;
+    if (stopBefore?.(current))
+        return { stopped: true, url: current.href, hops: 0 };
+    const timeout = timeoutMs !== undefined ? AbortSignal.timeout(timeoutMs) : undefined;
+    const signals = [callerSignal, timeout].filter((s) => s !== undefined);
+    const signal = signals.length > 0 ? AbortSignal.any(signals) : undefined;
+    const owned = given === undefined
+        ? createPublicOnlyDispatcher({
+            ...(resolve ? { resolve } : {}),
+            ...(isAllowedAddress ? { isAllowedAddress } : {}),
+        })
+        : undefined;
+    const dispatcher = given ?? owned;
+    let method = (initMethod ?? 'GET').toUpperCase();
+    let body = initBody;
+    const headers = new Headers(initHeaders);
+    const fail = (err) => {
+        if (callerSignal?.aborted)
+            throw callerSignal.reason;
+        if (timeout?.aborted)
+            throw new RequestTimeoutError(current.host, timeoutMs);
+        const refused = findUrlRefusal(err);
+        if (refused)
+            throw refused;
+        if (err instanceof McpToolError)
+            throw err;
+        throw new McpToolError(`Could not reach ${current.host}.`, {
+            kind: 'transport',
+            hint: 'Check the link is reachable from the server.',
+            cause: err,
+        });
+    };
+    try {
+        for (let hops = 0;;) {
+            let res;
+            try {
+                res = await undiciFetch(current, {
+                    ...init,
+                    method,
+                    headers,
+                    ...(body !== undefined && body !== null ? { body } : {}),
+                    redirect: 'manual',
+                    dispatcher,
+                    ...(signal ? { signal } : {}),
+                });
+            }
+            catch (err) {
+                return fail(err);
+            }
+            const location = REDIRECT_STATUSES.has(res.status) ? res.headers.get('location') : null;
+            if (location === null) {
+                let bytes;
+                try {
+                    bytes = await readBytesCapped(res, maxBytes, current.host, (p) => p);
+                }
+                catch (err) {
+                    return fail(err);
+                }
+                return { stopped: false, url: current.href, hops, status: res.status, headers: res.headers, body: bytes };
+            }
+            await res.body?.cancel().catch(() => { });
+            if (hops >= maxRedirects) {
+                throw new RedirectRefusedError(`Refusing to follow more than ${maxRedirects} redirects (last from ${current.host}).`);
+            }
+            let next;
+            try {
+                next = new URL(location, current);
+            }
+            catch {
+                throw new UrlNotAllowedError('The redirect target is not a valid URL.', 'invalid');
+            }
+            next = check(next);
+            hops += 1;
+            if (res.status === 303 || ((res.status === 301 || res.status === 302) && method === 'POST')) {
+                if (method !== 'HEAD')
+                    method = 'GET';
+                body = undefined;
+                for (const h of ['content-type', 'content-length', 'content-encoding', 'content-language', 'content-location']) {
+                    headers.delete(h);
+                }
+            }
+            if (next.origin !== origin)
+                for (const h of CROSS_ORIGIN_DROPPED)
+                    headers.delete(h);
+            current = next;
+            if (stopBefore?.(current))
+                return { stopped: true, url: current.href, hops };
+        }
+    }
+    finally {
+        if (owned)
+            await owned.destroy().catch(() => { });
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/netguard/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/netguard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAwB,EAAE;QACpD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,EAAE;oBAAE,OAAO,SAAS,CAAC;gBAC1B,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB,EAAE,MAAyB,EAAE,IAAY;IAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAwD;IACtE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe;IAClC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW;IAC/B,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ;IAC/B,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW;IAChC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,mCAAmC;IAC3D,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW;IAClC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAClD,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa;IACnC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,kCAAkC;IAC1D,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW;IACnC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,eAAe;IACtC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa;IACtC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa;IACrC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY;IACjC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,uBAAuB;CAC7C,CAAC;AAEF,SAAS,YAAY,CAAC,MAAyB;IAC7C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,SAAS,CAAC,GAAG,CAAa,CAAC;AACjE,MAAM,UAAU,GAAwD;IACtE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,iEAAiE;IACjF,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,6BAA6B;IACtD,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,eAAe;IAClC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS;IAC7B,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,eAAe;IACrC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,sBAAsB;IAC7C,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW;IAClC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACxC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,2BAA2B;IAC/C,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,YAAY;IAChC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe;IAClC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa;IACjC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,0BAA0B;IAC9C,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY;CAChC,CAAC;AACF,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AACnC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;AAC9B,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAEjC,SAAS,YAAY,CAAC,KAAwB;IAC5C,IAAI,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;QAC9F,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAYD,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAa,KAAK,EAAE,QAAQ,EAAE,EAAE,CACzD,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAkBnF,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,kBAAkB,CAC3B,0BAA0B,QAAQ,+EAA+E,EACjH,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAI,GAAgC,EAAE;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,eAAe,CAAC;IAEzD,MAAM,MAAM,GAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7D,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE;YACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACf,QAAgE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC;YACrF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC,EACD,CAAC,GAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAA4B,EAAE,EAAE,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAiC,CAAC,CAAC;IACzF,MAAM,OAAO,GAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,OAAO,IAAI,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAgED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AAEhF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAY,GAAG,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,kBAAkB;YAAE,OAAO,CAAC,CAAC;QAC9C,CAAC,GAAI,CAAyB,CAAC,KAAK,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA2BD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,IAAI,GAAuB,EAAE;IAE7B,MAAM,EACJ,YAAY,GAAG,EAAE,EACjB,SAAS,EACT,QAAQ,EACR,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,KAAK,EACjB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,EACP,gBAAgB,EAChB,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,QAAQ,EACd,GAAG,IAAI,EACR,GAAG,IAAI,CAAC;IACT,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAoB,EAAO,EAAE,CAC1C,gBAAgB,CAAC,MAAM,EAAE;QACvB,UAAU,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC;QAClC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IAEL,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,UAAU,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAEhF,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzE,MAAM,KAAK,GACT,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,0BAA0B,CAAC;YACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,KAAK,IAAI,KAAM,CAAC;IAEnC,IAAI,MAAM,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,CAAC,GAAY,EAAS,EAAE;QACnC,IAAI,YAAY,EAAE,OAAO;YAAE,MAAM,YAAY,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,EAAE,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,SAAU,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,GAAG,YAAY,YAAY;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,IAAI,YAAY,CAAC,mBAAmB,OAAO,CAAC,IAAI,GAAG,EAAE;YACzD,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,8CAA8C;YACpD,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,KAAK,IAAI,IAAI,GAAG,CAAC,IAAM,CAAC;YACtB,IAAI,GAA4C,CAAC;YACjD,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE;oBAC/B,GAAG,IAAI;oBACP,MAAM;oBACN,OAAO;oBACP,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,QAAQ,EAAE,QAAQ;oBAClB,UAAU;oBACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,KAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,eAAe,CAAC,GAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9F,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC5G,CAAC;YAED,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,YAAY,yBAAyB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;YACxH,CAAC;YACD,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,EAAE,SAAS,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,CAAC;YAEV,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC5F,IAAI,MAAM,KAAK,MAAM;oBAAE,MAAM,GAAG,KAAK,CAAC;gBACtC,IAAI,GAAG,SAAS,CAAC;gBACjB,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBAC/G,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,oBAAoB;oBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEpF,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,UAAU,EAAE,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/server/confirm-env.d.ts

@@ -35,8 +35,13 @@ export declare const CONFIRM_TOKEN_AUTO_INSTRUCTION: string;
 export interface ConfirmationFromEnvOptions extends RequireConfirmationOptions {
     /** The tool name the token is bound to. */
     tool: string;
-    /** The account the action runs as. */
-    account?: string;
+    /**
+     * The account / principal the action runs as — bound into BOTH rails (the
+     * token's claims and the elicitation acceptance), so an approval for one
+     * account never acts as another. REQUIRED as a key since 3.0: pass
+     * `undefined` explicitly on a single-account server, as with `confirmWrite`.
+     */
+    account: string | undefined;
     /** The phase-2 token from the tool's input, or undefined on phase 1. */
     confirmToken?: string;
     /** Builds the subject from a FRESH read; see {@link ConfirmTokenFallback.subject}. */
@@ -48,17 +53,21 @@ export interface ConfirmationFromEnvOptions extends RequireConfirmationOptions {
     /** Environment to read; defaults to `process.env`. */
     env?: EnvSource;
     /**
-     * The tool's validated arguments. Pass them: both rails are then bound to
-     * them without per-tool judgement (fleet audit 2026-09-24 SEC-2).
+     * The tool's validated arguments — REQUIRED since 3.0 (`undefined`/`null`
+     * throws). Both rails are bound to them without per-tool judgement (fleet
+     * audit 2026-09-24 SEC-2; fleet-audit#979 and siblings were all a token
+     * minted without them).
      * - Elicitation: sets {@link RequireConfirmationOptions.binding} (unless one
-     *   is given) with the env key and TTL, so an acceptance minted for one call
-     *   cannot be replayed on a call with different arguments.
+     *   is given) to `{ account, args }` with the env key and TTL, so an
+     *   acceptance minted for one call cannot be replayed on a call with
+     *   different arguments or as a different account.
      * - Token: the token binds `{ payload: subject().payload, args }`, so a
      *   `subject()` whose payload covers only some arguments (say `{ id }` while
      *   the body is a separate argument) still cannot authorise a different body.
      * A `confirmToken` key is dropped first: it differs between the two phases.
+     * A tool with no arguments passes `{}`.
      */
-    args?: unknown;
+    args: object;
 }
 /**
  * Turn the fleet env settings into {@link requireConfirmationWithFallback}
@@ -67,7 +76,7 @@ export interface ConfirmationFromEnvOptions extends RequireConfirmationOptions {
  * ```ts
  * const gate = await requireConfirmationWithFallback(ctx, confirmationFromEnv({
  *   action: 'thing.delete', message: 'Review and confirm this deletion.', details: { id },
- *   tool: 'thing_delete', confirmToken, args,
+ *   tool: 'thing_delete', account: undefined, confirmToken, args,
  *   subject: () => ({ target: id, payload: { id }, preview: { id } }),
  * }));
  * if (gate) return gate;

package/dist/server/confirm-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-env.d.ts","sourceRoot":"","sources":["../../src/server/confirm-env.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,sCAAsC,EAC3C,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,6BAA6B;AAC7B,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAMzD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,GAAG,GAAE,SAAuB,GAAG,WAAW,CAWzE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,SAAuB,GAAG,IAAI,GAAG,KAAK,CAUjF;AAwBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,SAAuB,GAAG,MAAM,CAEtE;AAgBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,SAAuB,GAAG,UAAU,CAK1E;AAID;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,SAAuB,GAAG,eAAe,GAAG,SAAS,CAUhG;AAED,2DAA2D;AAC3D,eAAO,MAAM,8BAA8B,QAE6E,CAAC;AAezH,+FAA+F;AAC/F,MAAM,WAAW,0BAA2B,SAAQ,0BAA0B;IAC5E,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sDAAsD;IACtD,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,sCAAsC,CA0C/G"}
+{"version":3,"file":"confirm-env.d.ts","sourceRoot":"","sources":["../../src/server/confirm-env.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,sCAAsC,EAC3C,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,6BAA6B;AAC7B,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAMzD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,GAAG,GAAE,SAAuB,GAAG,WAAW,CAWzE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,SAAuB,GAAG,IAAI,GAAG,KAAK,CAUjF;AAwBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,SAAuB,GAAG,MAAM,CAEtE;AAgBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,SAAuB,GAAG,UAAU,CAK1E;AAID;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,SAAuB,GAAG,eAAe,GAAG,SAAS,CAUhG;AAED,2DAA2D;AAC3D,eAAO,MAAM,8BAA8B,QAE6E,CAAC;AAezH,+FAA+F;AAC/F,MAAM,WAAW,0BAA2B,SAAQ,0BAA0B;IAC5E,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sDAAsD;IACtD,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,sCAAsC,CAqD/G"}

package/dist/server/confirm-env.js

@@ -171,7 +171,7 @@ function boundArgs(args) {
  * ```ts
  * const gate = await requireConfirmationWithFallback(ctx, confirmationFromEnv({
  *   action: 'thing.delete', message: 'Review and confirm this deletion.', details: { id },
- *   tool: 'thing_delete', confirmToken, args,
+ *   tool: 'thing_delete', account: undefined, confirmToken, args,
  *   subject: () => ({ target: id, payload: { id }, preview: { id } }),
  * }));
  * if (gate) return gate;
@@ -179,16 +179,27 @@ function boundArgs(args) {
  */
 export function confirmationFromEnv(options) {
     const { tool, account, confirmToken, subject, instruction, args, env = process.env, spent: callerSpent, ...rest } = options;
+    if (args === undefined || args === null) {
+        // A token over the subject alone authorises whatever the subject omits, and
+        // an unbound acceptance authorises anything (fleet-audit#979 and siblings).
+        throw new TypeError(`confirmationFromEnv: ${tool} passed no args; pass the tool's validated arguments ({} for a tool with none).`);
+    }
     // Destructured out of `rest` so it rides the token fallback only, never the
     // returned options (#312).
     const spent = callerSpent ?? spentTokenStoreFromEnv(env);
     const mode = readConfirmMode(env);
     const ttlSeconds = readConfirmTtl(env);
     const elicitationOff = readConfirmElicitation(env) === 'off';
-    const bound = args === undefined ? undefined : boundArgs(args);
-    const bindingAdded = bound === undefined || rest.binding
+    const bound = boundArgs(args);
+    // The elicitation acceptance commits to the account as well as the
+    // arguments; the token already carries the account in its own claims.
+    const elicitationBound = account === undefined ? { args: bound } : { account, args: bound };
+    const bindingAdded = rest.binding
         ? rest
-        : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS } };
+        : {
+            ...rest,
+            binding: { key: confirmKeyFromEnv(env), args: elicitationBound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS },
+        };
     const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
     if (mode === 'refuse' || ttlSeconds === undefined) {
         const reason = mode === 'refuse' ? REFUSE_HINT : BAD_TTL_HINT;
@@ -198,15 +209,13 @@ export function confirmationFromEnv(options) {
             unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint,
         };
     }
-    const boundSubject = bound === undefined
-        ? subject
-        : async () => {
-            const read = await subject();
-            // A CallToolResult (a failed read) passes back unchanged.
-            if ('content' in read)
-                return read;
-            return { ...read, payload: { payload: read.payload, args: bound } };
-        };
+    const boundSubject = async () => {
+        const read = await subject();
+        // A CallToolResult (a failed read) passes back unchanged.
+        if ('content' in read)
+            return read;
+        return { ...read, payload: { payload: read.payload, args: bound } };
+    };
     return {
         ...confirmation,
         tokenFallback: {

package/dist/server/confirm-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-env.js","sourceRoot":"","sources":["../../src/server/confirm-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EACL,yBAAyB,GAI1B,MAAM,oBAAoB,CAAC;AAK5B,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjC,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAkB,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,GAAG,kEAAkE,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,eAAe,GAAG,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,+CAA+C,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACrC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,GAAG,+CAA+C;cAC5E,iGAAiG,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IAC5D,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC;AACpD,CAAC;AAED,IAAI,UAAkC,CAAC;AAEvC,4GAA4G;AAC5G,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,uGAAuG;AACvG,SAAS,YAAY,CAAC,GAAc;IAClC,OAAO,UAAU,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC;WAC3C,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACxE,UAAU,KAAK,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACvC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GACzC,iHAAiH;MAC/G,oHAAoH,CAAC;AAEzH,MAAM,WAAW,GAAG,qFAAqF,CAAC;AAC1G,MAAM,oBAAoB,GAAG,2EAA2E,CAAC;AACzG,MAAM,YAAY,GAAG,mGAAmG;MACpH,wBAAwB,CAAC;AAE7B,+GAA+G;AAC/G,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IAClE,KAAK,YAAY,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAgCD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC5H,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,KAAK,GAAG,WAAW,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,YAAY,GAA+B,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO;QAClF,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI,mBAAmB,EAAE,EAAE,CAAC;IACtH,MAAM,YAAY,GAA+B,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACzH,IAAI,IAAI,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,oBAAoB,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO;YACL,GAAG,YAAY;YACf,eAAe,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;SACjG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAoC,KAAK,KAAK,SAAS;QACvE,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,KAAK,IAAI,EAAE;YACX,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,0DAA0D;YAC1D,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtE,CAAC,CAAC;IACJ,OAAO;QACL,GAAG,YAAY;QACf,aAAa,EAAE;YACb,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;YAC3B,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,OAAO,EAAE,YAAY;YACrB,UAAU;YACV,WAAW,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC;YAC1G,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"confirm-env.js","sourceRoot":"","sources":["../../src/server/confirm-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EACL,yBAAyB,GAI1B,MAAM,oBAAoB,CAAC;AAK5B,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjC,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAkB,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,GAAG,kEAAkE,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,eAAe,GAAG,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,+CAA+C,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACrC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,GAAG,+CAA+C;cAC5E,iGAAiG,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IAC5D,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC;AACpD,CAAC;AAED,IAAI,UAAkC,CAAC;AAEvC,4GAA4G;AAC5G,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,uGAAuG;AACvG,SAAS,YAAY,CAAC,GAAc;IAClC,OAAO,UAAU,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC;WAC3C,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACxE,UAAU,KAAK,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAG,GAAc,OAAO,CAAC,GAAG;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACvC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GACzC,iHAAiH;MAC/G,oHAAoH,CAAC;AAEzH,MAAM,WAAW,GAAG,qFAAqF,CAAC;AAC1G,MAAM,oBAAoB,GAAG,2EAA2E,CAAC;AACzG,MAAM,YAAY,GAAG,mGAAmG;MACpH,wBAAwB,CAAC;AAE7B,+GAA+G;AAC/G,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IAClE,KAAK,YAAY,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAyCD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC5H,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,SAAS,CACjB,wBAAwB,IAAI,iFAAiF,CAC9G,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,KAAK,GAAG,WAAW,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5F,MAAM,YAAY,GAA+B,IAAI,CAAC,OAAO;QAC3D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACA,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,IAAI,mBAAmB,EAAE;SAChH,CAAC;IACJ,MAAM,YAAY,GAA+B,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACzH,IAAI,IAAI,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,oBAAoB,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO;YACL,GAAG,YAAY;YACf,eAAe,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;SACjG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAoC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,0DAA0D;QAC1D,IAAI,SAAS,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IACtE,CAAC,CAAC;IACF,OAAO;QACL,GAAG,YAAY;QACf,aAAa,EAAE;YACb,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;YAC3B,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,OAAO,EAAE,YAAY;YACrB,UAAU;YACV,WAAW,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC;YAC1G,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC"}

package/dist/server/confirm-write.js

@@ -95,7 +95,7 @@ export async function confirmWrite(ctx, options) {
         ...(options.unsupportedNote === undefined ? {} : { unsupportedNote: options.unsupportedNote }),
         ...(options.confirmationLabel === undefined ? {} : { confirmationLabel: options.confirmationLabel }),
         tool,
-        ...(account === undefined ? {} : { account }),
+        account,
         confirmToken,
         args: bound,
         subject: () => ({ target, ...(revision === undefined ? {} : { revision }), payload: bound, preview }),

package/dist/server/confirm-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-write.js","sourceRoot":"","sources":["../../src/server/confirm-write.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAwB,MAAM,oBAAoB,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,gHAAgH;MAC9G,+GAA+G,CAAC;AAEpH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,4GAA4G;MAC1G,sEAAsE,CAAC;AAyE3E,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,CAAU,CAAC;AAEjG,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IAClE,KAAK,YAAY,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,OAA4B;IAE5B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACnG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC1H,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,IAAI,SAAS,CAAC,iBAAiB,IAAI,uEAAuE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK;QAC1B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACtF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAEvG,MAAM,OAAO,GAA4B;QACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,KAAK;KACT,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,2EAA2E;IAC3E,oEAAoE;IACpE,kCAAkC;IAClC,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM;QACN,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,KAAK,EAAE,OAAO;QACd,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;KACnE,CAAC;IAEF,OAAO,+BAA+B,CACpC,GAAG,EACH,mBAAmB,CAAC;QAClB,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;QAC5G,OAAO,EAAE,OAAO;QAChB,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACpG,IAAI;QACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,YAAY;QACZ,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACrG,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC3D,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"confirm-write.js","sourceRoot":"","sources":["../../src/server/confirm-write.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAwB,MAAM,oBAAoB,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,gHAAgH;MAC9G,+GAA+G,CAAC;AAEpH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,4GAA4G;MAC1G,sEAAsE,CAAC;AAyE3E,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,CAAU,CAAC;AAEjG,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IAClE,KAAK,YAAY,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,OAA4B;IAE5B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACnG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC1H,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,IAAI,SAAS,CAAC,iBAAiB,IAAI,uEAAuE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK;QAC1B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACtF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAEvG,MAAM,OAAO,GAA4B;QACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,KAAK;KACT,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,2EAA2E;IAC3E,oEAAoE;IACpE,kCAAkC;IAClC,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM;QACN,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,KAAK,EAAE,OAAO;QACd,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;KACnE,CAAC;IAEF,OAAO,+BAA+B,CACpC,GAAG,EACH,mBAAmB,CAAC;QAClB,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;QAC5G,OAAO,EAAE,OAAO;QAChB,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACpG,IAAI;QACJ,OAAO;QACP,YAAY;QACZ,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACrG,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC3D,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/server/index.d.ts

@@ -51,7 +51,9 @@ export interface CreateMcpServerOptions<TDeps = unknown> {
     /**
      * Append an {@link McpToolError}'s `hint` to the text a failing tool returns.
      * Default `true`. Set `false` only for a server that deliberately wants the
-     * bare message.
+     * bare message. This switches off the whole {@link surfaceToolHints}
+     * wrapper, including the redaction it applies to every thrown error's text,
+     * so a server that opts out must redact its own failures.
      */
     surfaceHints?: boolean;
     /**
@@ -65,7 +67,9 @@ export interface CreateMcpServerOptions<TDeps = unknown> {
     maxToolInputElements?: McpServerOptions['maxToolInputElements'];
 }
 /**
- * Wrap `server.registerTool` so every tool handler surfaces its error `hint`.
+ * Wrap `server.registerTool` so every tool handler surfaces its error `hint`,
+ * and every thrown error's text crosses {@link redactSecrets} before it
+ * reaches the caller.
  *
  * Why this lives here rather than in each repo: the MCP tool boundary renders
  * only a thrown error's `message`. `McpToolError` has carried a `hint` — the

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAA+B,MAAM,8BAA8B,CAAC;AACtF,OAAO,KAAK,EAAE,SAAS,EAAkB,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAIhG,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AAKjC;;;GAGG;AACH,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,GAAG,OAAO,IAAI,CAC3C,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,KAAK,KACR,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,mBAGnC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhD,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB,CAAC,KAAK,GAAG,OAAO;IACrD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;CACjE;AA6FD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAgDxD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,KAAK,GAAG,OAAO,EACnD,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAClC,OAAO,CAAC,SAAS,CAAC,CAyBpB;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,WAAW,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE,uBAA4B,GACjC,IAAI,CAyEN;AAED,oFAAoF;AACpF,MAAM,WAAW,aAAa,CAAC,KAAK,GAAG,OAAO,CAAE,SAAQ,sBAAsB,CAAC,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,uBAAuB,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,MAAM,CAAC,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAuCrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,SAAS,EAIV,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAkB,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAIhG,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AAKjC;;;GAGG;AACH,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,GAAG,OAAO,IAAI,CAC3C,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,KAAK,KACR,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,mBAGnC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhD,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB,CAAC,KAAK,GAAG,OAAO;IACrD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAyGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAgDxD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,KAAK,GAAG,OAAO,EACnD,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAClC,OAAO,CAAC,SAAS,CAAC,CAyBpB;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,WAAW,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE,uBAA4B,GACjC,IAAI,CAyEN;AAED,oFAAoF;AACpF,MAAM,WAAW,aAAa,CAAC,KAAK,GAAG,OAAO,CAAE,SAAQ,sBAAsB,CAAC,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,uBAAuB,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,MAAM,CAAC,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAuCrF"}