@claude-flow/security 3.0.0-alpha.9 → 3.0.0

package/dist/keychain-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-adapter.js","sourceRoot":"","sources":["../src/keychain-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,uFAAuF;AACvF,MAAM,OAAO,0BAA0B;IACpB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;QAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAe;QACjD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,MAAM,qBAAqB;IACjB,SAAS,CAAsC,CAAC,+BAA+B;IAE/E,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAA2C,CAAC;YACzF,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,8DAA8D;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;YACxD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,QAAQ,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,2EAA2E;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;QAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,4CAA4C;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAe;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC3C,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,IAAI,0BAA0B,EAAE,CAAC;AAC1C,CAAC"}

package/dist/mcp-caller-identity.d.ts

@@ -0,0 +1,101 @@
+/**
+ * McpCallerIdentity — ADR-377 Phase 3 (ruvnet/ruflo#2516, #2873).
+ *
+ * Per-invocation, Ed25519-signed capability tokens binding an MCP tool call
+ * to a specific caller. Closes the gap identified in arXiv:2603.07473
+ * (Caller Identity Confusion in MCP): authorization state today persists
+ * across callers with no re-verification, and `AgentAuthorizationPropagator`
+ * (ADR-144)'s `checkToolCall` validates a *scope* but not that the caller
+ * presenting it is who they claim to be for *this* call.
+ *
+ * Signing implementation follows the same pattern already used in this repo
+ * for Ed25519 signing (`@claude-flow/browser`'s `witness-signer.ts`): native
+ * `node:crypto`, zero new dependencies, sign+verify both supported (unlike
+ * `@claude-flow/security`'s own `plugins/integrity-verifier.ts`, which uses
+ * `@noble/ed25519` for verify-only). Reimplemented here rather than imported
+ * from `@claude-flow/browser` because a security-primitives module
+ * depending on the browser package would be a backwards layering
+ * dependency; the pattern is ~15 lines and not worth a cross-package import
+ * for that.
+ *
+ * Scope and honest limitations (per the ADR's own text)
+ * --------------------------------------------------------
+ * This module implements token issuance/verification only. It does NOT
+ * wire itself into any MCP tool dispatcher — this repo currently has at
+ * least two distinct `ToolRegistry` implementations
+ * (`v3/mcp/tool-registry.ts`, `v3/@claude-flow/mcp/src/tool-registry.ts`)
+ * plus a third under `@claude-flow/shared`, and it was not safe to guess
+ * which one is authoritative without risking silently wiring the wrong
+ * dispatch path. `AgentAuthorizationPropagator.checkToolCall` (ADR-144) is
+ * the natural composition point — call `verifyInvocationToken` first and
+ * only proceed to `checkToolCall` if it passes — but that composition is
+ * left to the caller rather than baked into `checkToolCall` itself, to
+ * avoid changing ADR-144's already-shipped, already-tested behavior.
+ *
+ * Key distribution (how callers obtain a private key to sign with in the
+ * first place) is explicitly out of scope — the ADR calls for "a follow-on
+ * ADR for key distribution" before this ships enabled by default, which is
+ * why `CLAUDE_FLOW_MCP_CALLER_AUTH` defaults to disabled.
+ */
+import type { KeyObject } from 'node:crypto';
+export interface CallerIdentityKey {
+    privateKey: KeyObject;
+    publicKey: KeyObject;
+    publicKeyHex: string;
+}
+export interface InvocationToken {
+    /** Agent/principal id of the caller this token was issued to. */
+    callerId: string;
+    /** Tool this token authorizes — a token issued for one tool cannot be
+     * replayed against another. */
+    toolName: string;
+    /** Unix ms the token was issued. */
+    issuedAt: number;
+    /** Unix ms after which the token is no longer valid. */
+    expiresAt: number;
+    /** Random per-token value; prevents replay of an otherwise-identical
+     * token issued in the same millisecond. */
+    nonce: string;
+    /** Hex-encoded Ed25519 signature over the canonicalized fields above. */
+    signature: string;
+}
+export interface TokenVerificationResult {
+    valid: boolean;
+    reason?: 'expired' | 'bad-signature' | 'tool-mismatch';
+}
+/** Generate a fresh Ed25519 keypair. */
+export declare function generateCallerIdentityKey(): CallerIdentityKey;
+/** Load a caller-identity key from a PEM-encoded private key string. */
+export declare function loadCallerIdentityKey(privateKeyPem: string): CallerIdentityKey;
+/**
+ * Issue a fresh, signed `InvocationToken` for `callerId` to call `toolName`.
+ * Callers must present a *new* token per invocation — tokens are
+ * single-tool-bound and short-lived (`ttlMs`, default 30s) by design; there
+ * is no renewal API on purpose.
+ */
+export declare function issueInvocationToken(callerId: string, toolName: string, key: CallerIdentityKey, opts?: {
+    ttlMs?: number;
+    now?: number;
+}): InvocationToken;
+/**
+ * Verify an `InvocationToken` against the issuing caller's public key and
+ * (if provided) the tool the caller is about to invoke. Never throws.
+ */
+export declare function verifyInvocationToken(token: InvocationToken, publicKey: KeyObject, opts?: {
+    toolName?: string;
+    now?: number;
+}): TokenVerificationResult;
+/** Off by default — see the file header re: key distribution being out of scope pending a follow-on ADR. Only the literal `'true'` enables enforcement. */
+export declare function isMcpCallerAuthEnabled(): boolean;
+/** Inverse of `extractPublicKeyHex`: rebuild a `KeyObject` from the raw hex it produced. */
+export declare function publicKeyFromHex(hex: string): KeyObject;
+/**
+ * Pack an `InvocationToken` into one env-var-safe string (JSON + base64url).
+ * The issuer's public key travels in its own env var (set alongside this
+ * one, hex is already env-var-safe) rather than being folded in here — kept
+ * separate to mirror how the two values are set independently at spawn time.
+ */
+export declare function encodeTokenEnvelope(token: InvocationToken): string;
+/** Inverse of `encodeTokenEnvelope`. Never throws — returns `undefined` on any malformed input. */
+export declare function decodeTokenEnvelope(encoded: string): InvocationToken | undefined;
+//# sourceMappingURL=mcp-caller-identity.d.ts.map

package/dist/mcp-caller-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-caller-identity.d.ts","sourceRoot":"","sources":["../src/mcp-caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB;mCAC+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;+CAC2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;CACxD;AAeD,wCAAwC;AACxC,wBAAgB,yBAAyB,IAAI,iBAAiB,CAG7D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAI9E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,eAAe,CAWjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,uBAAuB,CAgBzB;AAQD,2JAA2J;AAC3J,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAoBD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAMvD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAElE;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAmBhF"}

package/dist/mcp-caller-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-caller-identity.js","sourceRoot":"","sources":["../src/mcp-caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+BhH,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,iGAAiG;AACjG,SAAS,cAAc,CAAC,CAAsF;IAC5G,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAChF,SAAS,mBAAmB,CAAC,SAAoB;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,yBAAyB;IACvC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,QAAgB,EAChB,GAAsB,EACtB,OAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC/C,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5G,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsB,EACtB,SAAoB,EACpB,OAA4C,EAAE;IAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAChJ,MAAM,CACP,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,2JAA2J;AAC3J,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC;AACjD,CAAC;AAED,+EAA+E;AAC/E,oEAAoE;AACpE,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,qEAAqE;AACrE,yEAAyE;AAEzE;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE/E,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACzF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IACE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;eAC3B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;eAC9B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;eAC9B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;eAC/B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;eAC3B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/mcp-composition-inspector.d.ts

@@ -0,0 +1,133 @@
+/**
+ * MCP Tool Composition Inspector — ADR-320 (this ADR; ruvnet/ruflo dream-cycle
+ * proposal, arXiv:2606.27027 "ShareLock").
+ *
+ * The attack: an adversary registers N seemingly-benign MCP tools whose
+ * individual descriptions look fine in isolation, but whose CONCATENATION
+ * (or pairwise overlap) forms an injection payload targeting a downstream
+ * agent — a Shamir-secret-sharing-style split across tool descriptions.
+ * Per-tool inspection misses this because each fragment sits under any
+ * single-tool detection threshold.
+ *
+ * Relationship to prior art in this repo
+ * ---------------------------------------
+ * A CLI-only v1 of this idea already shipped directly to `main`
+ * (dream-cycle #2783, commits 381b7ebcc/581cd2bf3) as
+ * `v3/@claude-flow/cli/src/security/mcp-composition-inspector.ts` — an
+ * on-demand `ruflo security composition-scan` command using exact
+ * common-substring matching plus an injection-phrase catalog and
+ * typosquat check. That module's own header explicitly scopes itself as
+ * "a bounded engineering fix rather than an ADR-scope subsystem" and lists
+ * "Future v2: SimHash + LSH for scale" as deliberately deferred. THIS
+ * module is that v2: a reusable `@claude-flow/security` library primitive
+ * (not a CLI-only tool) built around a real SimHash fingerprint, so it can
+ * be called from a pre-task/pre-tool-use hook before a multi-tool chain
+ * executes, per this ADR's implementation target. It does not replace or
+ * import the CLI v1 — the two are independent, complementary detectors
+ * (exact-substring vs. hashed-shingle-overlap) that a caller may run
+ * together.
+ *
+ * Detection method (deterministic, no LLM call)
+ * -----------------------------------------------
+ * 1. Each tool description is normalized and split into overlapping
+ *    word-shingles (default: 5-word windows). Shingling — rather than
+ *    whole-description comparison — is what lets us find a SMALL embedded
+ *    fragment inside an otherwise unrelated, benign description.
+ * 2. Each tool gets a 64-bit SimHash fingerprint: every shingle is hashed
+ *    (FNV-1a, 64-bit) and the fingerprint bits are set by majority vote
+ *    across all of a tool's shingle hashes. Two tools whose descriptions
+ *    share enough content have a SMALL Hamming distance between
+ *    fingerprints — this is the O(1)-per-pair coarse filter that avoids an
+ *    LLM call and stays cheap even at hundreds of registered tools (fast
+ *    64-bit XOR + popcount per pair).
+ * 3. An inverted shingle-hash index (hash -> set of tool indices) is built
+ *    once, in O(total shingles). For each pair flagged by the SimHash
+ *    filter (or found in the index) the SAME index is used to compute the
+ *    actual overlapping shingle text — this is what makes the finding
+ *    reportable (the SimHash score alone can't tell an operator *what*
+ *    matched).
+ * 4. A fragment's "population" (how many distinct tools carry it) caps
+ *    false positives: shared shingles that appear in more than
+ *    `maxFragmentPopulation` (default 3) tools are template language
+ *    (e.g. every ruflo `memory_*` tool's boilerplate), not an attack —
+ *    Shamir-split attacks concentrate a fragment in a small conspiracy of
+ *    2-3 tools. Same population-cap idea as the CLI v1, reimplemented here
+ *    against the hash index instead of raw substrings.
+ *
+ * This is a heuristic detector, not a security boundary: it reports
+ * SUSPECTS. Default action is warn + log; blocking is opt-in via
+ * `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK=1` (see {@link evaluateToolComposition}).
+ *
+ * @module @claude-flow/security/mcp-composition-inspector
+ */
+export interface McpToolDescriptor {
+    name: string;
+    description: string;
+}
+export interface CompositionInspectorOptions {
+    /** Words per shingle window. Default 5. */
+    shingleSize?: number;
+    /** SimHash similarity (1 - Hamming/64) at/above which a pair is a candidate. Default 0.6. */
+    simhashThreshold?: number;
+    /** Fraction of a tool's shingles shared with a peer (low-population only) at/above which a pair is flagged. Default 0.25. */
+    fragmentOverlapThreshold?: number;
+    /** Max number of distinct tools a shingle may appear in before it's treated as template language, not an attack fragment. Default 3. */
+    maxFragmentPopulation?: number;
+    /** Minimum character length for a shingle to be indexed (filters trivial/common short phrases). Default 12. */
+    minShingleChars?: number;
+    /** Max sample shared fragments recorded per finding (display only). Default 5. */
+    maxSampleFragments?: number;
+}
+export interface CompositionFinding {
+    toolA: string;
+    toolB: string;
+    /** 1 - (Hamming distance / 64) between the two tools' SimHash fingerprints. */
+    simhashSimilarity: number;
+    /** sharedLowPopulationShingles / min(shingleCount(A), shingleCount(B)). */
+    fragmentOverlapScore: number;
+    /** Sample of the actual shared shingle text driving the finding (truncated). */
+    sharedFragments: string[];
+    /** Max population (distinct tools) observed among the shared shingles that triggered this finding. */
+    fragmentPopulation: number;
+    reason: string;
+}
+export interface CompositionInspectionStats {
+    toolsScanned: number;
+    pairsCompared: number;
+    shinglesIndexed: number;
+    /** Pairs whose SimHash similarity alone crossed simhashThreshold (diagnostic — includes pairs later excluded for having no low-population shared shingle). */
+    candidatePairsFromSimhash: number;
+}
+export interface CompositionInspectionResult {
+    findings: CompositionFinding[];
+    stats: CompositionInspectionStats;
+}
+export interface CompositionGuardResult {
+    result: CompositionInspectionResult;
+    action: 'none' | 'warn' | 'block';
+    blocked: boolean;
+    message?: string;
+}
+/** FNV-1a, 64-bit. Deterministic, dependency-free, good avalanche for short strings. */
+export declare function fnv1a64(input: string): bigint;
+/**
+ * Classic SimHash: bit-vote a 64-bit fingerprint across a list of token
+ * hashes. Near-duplicate token sets (even with some fragments differing)
+ * produce fingerprints with a small Hamming distance.
+ */
+export declare function simhash64(shingles: readonly string[]): bigint;
+/** Hamming distance between two 64-bit fingerprints (0..64). */
+export declare function hammingDistance64(a: bigint, b: bigint): number;
+export declare function inspectToolComposition(tools: readonly McpToolDescriptor[], options?: CompositionInspectorOptions): CompositionInspectionResult;
+/** Reads `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK` fresh on every call. '1' or 'true' (case-insensitive) enables blocking; unset/anything else keeps the default warn+log posture. */
+export declare function isCompositionBlockEnabled(): boolean;
+/**
+ * Runs {@link inspectToolComposition} and applies the ADR-320 default
+ * posture: warn + log (via `console.warn`) unless
+ * `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK=1`, in which case the chain is marked
+ * `blocked: true` — the caller (the pre-task hook / MCP dispatcher) decides
+ * what "blocked" means operationally; this function does not throw or abort
+ * anything itself.
+ */
+export declare function evaluateToolComposition(tools: readonly McpToolDescriptor[], options?: CompositionInspectorOptions): CompositionGuardResult;
+//# sourceMappingURL=mcp-composition-inspector.d.ts.map

package/dist/mcp-composition-inspector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-composition-inspector.d.ts","sourceRoot":"","sources":["../src/mcp-composition-inspector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAMH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6HAA6H;IAC7H,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,wIAAwI;IACxI,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+GAA+G;IAC/G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sGAAsG;IACtG,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,8JAA8J;IAC9J,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,KAAK,EAAE,0BAA0B,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,2BAA2B,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD,wFAAwF;AACxF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO7C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAe7D;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAkCD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,OAAO,GAAE,2BAAgC,GACxC,2BAA2B,CAyF7B;AAQD,gLAAgL;AAChL,wBAAgB,yBAAyB,IAAI,OAAO,CAGnD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,OAAO,GAAE,2BAAgC,GACxC,sBAAsB,CAwBxB"}

package/dist/mcp-composition-inspector.js

@@ -0,0 +1,254 @@
+/**
+ * MCP Tool Composition Inspector — ADR-320 (this ADR; ruvnet/ruflo dream-cycle
+ * proposal, arXiv:2606.27027 "ShareLock").
+ *
+ * The attack: an adversary registers N seemingly-benign MCP tools whose
+ * individual descriptions look fine in isolation, but whose CONCATENATION
+ * (or pairwise overlap) forms an injection payload targeting a downstream
+ * agent — a Shamir-secret-sharing-style split across tool descriptions.
+ * Per-tool inspection misses this because each fragment sits under any
+ * single-tool detection threshold.
+ *
+ * Relationship to prior art in this repo
+ * ---------------------------------------
+ * A CLI-only v1 of this idea already shipped directly to `main`
+ * (dream-cycle #2783, commits 381b7ebcc/581cd2bf3) as
+ * `v3/@claude-flow/cli/src/security/mcp-composition-inspector.ts` — an
+ * on-demand `ruflo security composition-scan` command using exact
+ * common-substring matching plus an injection-phrase catalog and
+ * typosquat check. That module's own header explicitly scopes itself as
+ * "a bounded engineering fix rather than an ADR-scope subsystem" and lists
+ * "Future v2: SimHash + LSH for scale" as deliberately deferred. THIS
+ * module is that v2: a reusable `@claude-flow/security` library primitive
+ * (not a CLI-only tool) built around a real SimHash fingerprint, so it can
+ * be called from a pre-task/pre-tool-use hook before a multi-tool chain
+ * executes, per this ADR's implementation target. It does not replace or
+ * import the CLI v1 — the two are independent, complementary detectors
+ * (exact-substring vs. hashed-shingle-overlap) that a caller may run
+ * together.
+ *
+ * Detection method (deterministic, no LLM call)
+ * -----------------------------------------------
+ * 1. Each tool description is normalized and split into overlapping
+ *    word-shingles (default: 5-word windows). Shingling — rather than
+ *    whole-description comparison — is what lets us find a SMALL embedded
+ *    fragment inside an otherwise unrelated, benign description.
+ * 2. Each tool gets a 64-bit SimHash fingerprint: every shingle is hashed
+ *    (FNV-1a, 64-bit) and the fingerprint bits are set by majority vote
+ *    across all of a tool's shingle hashes. Two tools whose descriptions
+ *    share enough content have a SMALL Hamming distance between
+ *    fingerprints — this is the O(1)-per-pair coarse filter that avoids an
+ *    LLM call and stays cheap even at hundreds of registered tools (fast
+ *    64-bit XOR + popcount per pair).
+ * 3. An inverted shingle-hash index (hash -> set of tool indices) is built
+ *    once, in O(total shingles). For each pair flagged by the SimHash
+ *    filter (or found in the index) the SAME index is used to compute the
+ *    actual overlapping shingle text — this is what makes the finding
+ *    reportable (the SimHash score alone can't tell an operator *what*
+ *    matched).
+ * 4. A fragment's "population" (how many distinct tools carry it) caps
+ *    false positives: shared shingles that appear in more than
+ *    `maxFragmentPopulation` (default 3) tools are template language
+ *    (e.g. every ruflo `memory_*` tool's boilerplate), not an attack —
+ *    Shamir-split attacks concentrate a fragment in a small conspiracy of
+ *    2-3 tools. Same population-cap idea as the CLI v1, reimplemented here
+ *    against the hash index instead of raw substrings.
+ *
+ * This is a heuristic detector, not a security boundary: it reports
+ * SUSPECTS. Default action is warn + log; blocking is opt-in via
+ * `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK=1` (see {@link evaluateToolComposition}).
+ *
+ * @module @claude-flow/security/mcp-composition-inspector
+ */
+// ============================================================================
+// SimHash primitives (plain TS, no dependency)
+// ============================================================================
+const FNV_OFFSET_BASIS_64 = 0xcbf29ce484222325n;
+const FNV_PRIME_64 = 0x100000001b3n;
+const MASK_64 = (1n << 64n) - 1n;
+/** FNV-1a, 64-bit. Deterministic, dependency-free, good avalanche for short strings. */
+export function fnv1a64(input) {
+    let hash = FNV_OFFSET_BASIS_64;
+    for (let i = 0; i < input.length; i++) {
+        hash ^= BigInt(input.charCodeAt(i));
+        hash = (hash * FNV_PRIME_64) & MASK_64;
+    }
+    return hash;
+}
+/**
+ * Classic SimHash: bit-vote a 64-bit fingerprint across a list of token
+ * hashes. Near-duplicate token sets (even with some fragments differing)
+ * produce fingerprints with a small Hamming distance.
+ */
+export function simhash64(shingles) {
+    if (shingles.length === 0)
+        return 0n;
+    const bitVotes = new Array(64).fill(0);
+    for (const shingle of shingles) {
+        const h = fnv1a64(shingle);
+        for (let bit = 0; bit < 64; bit++) {
+            const set = (h >> BigInt(bit)) & 1n;
+            bitVotes[bit] += set === 1n ? 1 : -1;
+        }
+    }
+    let fingerprint = 0n;
+    for (let bit = 0; bit < 64; bit++) {
+        if (bitVotes[bit] > 0)
+            fingerprint |= 1n << BigInt(bit);
+    }
+    return fingerprint;
+}
+/** Hamming distance between two 64-bit fingerprints (0..64). */
+export function hammingDistance64(a, b) {
+    let x = (a ^ b) & MASK_64;
+    let count = 0;
+    while (x > 0n) {
+        count += Number(x & 1n);
+        x >>= 1n;
+    }
+    return count;
+}
+// ============================================================================
+// Shingling
+// ============================================================================
+function normalize(text) {
+    return text.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/** Overlapping word-shingles of `k` words each. Falls back to the whole (short) text as a single shingle. */
+function wordShingles(text, k) {
+    const words = normalize(text).split(' ').filter(Boolean);
+    if (words.length === 0)
+        return [];
+    if (words.length < k)
+        return [words.join(' ')];
+    const shingles = [];
+    for (let i = 0; i + k <= words.length; i++) {
+        shingles.push(words.slice(i, i + k).join(' '));
+    }
+    return shingles;
+}
+export function inspectToolComposition(tools, options = {}) {
+    const shingleSize = options.shingleSize ?? 5;
+    const simhashThreshold = options.simhashThreshold ?? 0.6;
+    const fragmentOverlapThreshold = options.fragmentOverlapThreshold ?? 0.25;
+    const maxFragmentPopulation = options.maxFragmentPopulation ?? 3;
+    const minShingleChars = options.minShingleChars ?? 12;
+    const maxSampleFragments = options.maxSampleFragments ?? 5;
+    const indexed = tools.map((t, idx) => {
+        const shingles = wordShingles(t.description, shingleSize).filter((s) => s.length >= minShingleChars);
+        const hashKeys = new Set(shingles.map((s) => fnv1a64(s).toString(36)));
+        return {
+            idx,
+            name: t.name,
+            shingles,
+            hashKeys,
+            fingerprint: simhash64(shingles),
+        };
+    });
+    // Inverted index: shingle-hash -> {tools that carry it, sample text}.
+    const shingleToTools = new Map();
+    const shingleSampleText = new Map();
+    for (const t of indexed) {
+        for (const shingle of t.shingles) {
+            const key = fnv1a64(shingle).toString(36);
+            const set = shingleToTools.get(key) ?? new Set();
+            set.add(t.idx);
+            shingleToTools.set(key, set);
+            if (!shingleSampleText.has(key))
+                shingleSampleText.set(key, shingle);
+        }
+    }
+    const findings = [];
+    const stats = {
+        toolsScanned: tools.length,
+        pairsCompared: 0,
+        shinglesIndexed: shingleToTools.size,
+        candidatePairsFromSimhash: 0,
+    };
+    for (let i = 0; i < indexed.length; i++) {
+        for (let j = i + 1; j < indexed.length; j++) {
+            stats.pairsCompared++;
+            const a = indexed[i];
+            const b = indexed[j];
+            const hamming = hammingDistance64(a.fingerprint, b.fingerprint);
+            const simhashSimilarity = a.shingles.length > 0 && b.shingles.length > 0 ? 1 - hamming / 64 : 0;
+            if (simhashSimilarity >= simhashThreshold)
+                stats.candidatePairsFromSimhash++;
+            // Low-population shared shingles between this pair, via the inverted index.
+            let sharedCount = 0;
+            let maxPopulationSeen = 0;
+            const sample = [];
+            for (const key of a.hashKeys) {
+                if (!b.hashKeys.has(key))
+                    continue;
+                const population = shingleToTools.get(key)?.size ?? 0;
+                if (population > maxFragmentPopulation)
+                    continue; // template language, not an attack signature
+                sharedCount++;
+                maxPopulationSeen = Math.max(maxPopulationSeen, population);
+                if (sample.length < maxSampleFragments) {
+                    const text = shingleSampleText.get(key);
+                    if (text)
+                        sample.push(text);
+                }
+            }
+            const minShingleCount = Math.max(1, Math.min(a.shingles.length, b.shingles.length));
+            const fragmentOverlapScore = sharedCount / minShingleCount;
+            const flagBySimhash = simhashSimilarity >= simhashThreshold && sharedCount > 0;
+            const flagByFragment = fragmentOverlapScore >= fragmentOverlapThreshold && sharedCount > 0;
+            if (!flagBySimhash && !flagByFragment)
+                continue;
+            findings.push({
+                toolA: a.name,
+                toolB: b.name,
+                simhashSimilarity: Number(simhashSimilarity.toFixed(3)),
+                fragmentOverlapScore: Number(fragmentOverlapScore.toFixed(3)),
+                sharedFragments: sample,
+                fragmentPopulation: maxPopulationSeen,
+                reason: flagBySimhash
+                    ? `SimHash similarity ${simhashSimilarity.toFixed(2)} (Hamming distance ${hamming}/64) with ${sharedCount} low-population shared shingle(s) (population <= ${maxFragmentPopulation}) — possible cross-tool instruction fragment`
+                    : `Fragment overlap ${fragmentOverlapScore.toFixed(2)} (${sharedCount}/${minShingleCount} shingles shared, population <= ${maxFragmentPopulation}) — possible Shamir-split instruction fragment`,
+            });
+        }
+    }
+    return { findings, stats };
+}
+// ============================================================================
+// Guard: env-var-gated warn/block decision
+// ============================================================================
+const COMPOSITION_BLOCK_ENV = 'CLAUDE_FLOW_MCP_COMPOSITION_BLOCK';
+/** Reads `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK` fresh on every call. '1' or 'true' (case-insensitive) enables blocking; unset/anything else keeps the default warn+log posture. */
+export function isCompositionBlockEnabled() {
+    const raw = process.env[COMPOSITION_BLOCK_ENV];
+    return raw === '1' || raw?.toLowerCase() === 'true';
+}
+/**
+ * Runs {@link inspectToolComposition} and applies the ADR-320 default
+ * posture: warn + log (via `console.warn`) unless
+ * `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK=1`, in which case the chain is marked
+ * `blocked: true` — the caller (the pre-task hook / MCP dispatcher) decides
+ * what "blocked" means operationally; this function does not throw or abort
+ * anything itself.
+ */
+export function evaluateToolComposition(tools, options = {}) {
+    const result = inspectToolComposition(tools, options);
+    if (result.findings.length === 0) {
+        return { result, action: 'none', blocked: false };
+    }
+    const summary = `MCP Composition Inspector: ${result.findings.length} suspicious cross-tool fragment(s) ` +
+        `across ${result.stats.toolsScanned} tools (${result.stats.pairsCompared} pairs compared)`;
+    if (isCompositionBlockEnabled()) {
+        const message = `${summary} — blocking chain (${COMPOSITION_BLOCK_ENV}=1)`;
+        console.warn(`[mcp-composition-inspector] ${message}`);
+        for (const f of result.findings) {
+            console.warn(`  - ${f.toolA} <-> ${f.toolB}: ${f.reason}`);
+        }
+        return { result, action: 'block', blocked: true, message };
+    }
+    console.warn(`[mcp-composition-inspector] ${summary}`);
+    for (const f of result.findings) {
+        console.warn(`  - ${f.toolA} <-> ${f.toolB}: ${f.reason}`);
+    }
+    return { result, action: 'warn', blocked: false, message: summary };
+}
+//# sourceMappingURL=mcp-composition-inspector.js.map

package/dist/mcp-composition-inspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-composition-inspector.js","sourceRoot":"","sources":["../src/mcp-composition-inspector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AA4DH,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAChD,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAEjC,wFAAwF;AACxF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,IAAI,IAAI,GAAG,mBAAmB,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,QAA2B;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,WAAW,IAAI,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,6GAA6G;AAC7G,SAAS,YAAY,CAAC,IAAY,EAAE,CAAS;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAcD,MAAM,UAAU,sBAAsB,CACpC,KAAmC,EACnC,UAAuC,EAAE;IAEzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI,IAAI,CAAC;IAC1E,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAkB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO;YACL,GAAG;YACH,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ;YACR,QAAQ;YACR,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACf,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAA+B;QACxC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,cAAc,CAAC,IAAI;QACpC,yBAAyB,EAAE,CAAC;KAC7B,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,KAAK,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAErB,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,iBAAiB,IAAI,gBAAgB;gBAAE,KAAK,CAAC,yBAAyB,EAAE,CAAC;YAE7E,4EAA4E;YAC5E,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACnC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;gBACtD,IAAI,UAAU,GAAG,qBAAqB;oBAAE,SAAS,CAAC,6CAA6C;gBAC/F,WAAW,EAAE,CAAC;gBACd,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;gBAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACpF,MAAM,oBAAoB,GAAG,WAAW,GAAG,eAAe,CAAC;YAE3D,MAAM,aAAa,GAAG,iBAAiB,IAAI,gBAAgB,IAAI,WAAW,GAAG,CAAC,CAAC;YAC/E,MAAM,cAAc,GAAG,oBAAoB,IAAI,wBAAwB,IAAI,WAAW,GAAG,CAAC,CAAC;YAC3F,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc;gBAAE,SAAS;YAEhD,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,CAAC,CAAC,IAAI;gBACb,KAAK,EAAE,CAAC,CAAC,IAAI;gBACb,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvD,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC7D,eAAe,EAAE,MAAM;gBACvB,kBAAkB,EAAE,iBAAiB;gBACrC,MAAM,EAAE,aAAa;oBACnB,CAAC,CAAC,sBAAsB,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,OAAO,aAAa,WAAW,oDAAoD,qBAAqB,8CAA8C;oBAChO,CAAC,CAAC,oBAAoB,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,eAAe,mCAAmC,qBAAqB,gDAAgD;aACnM,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAElE,gLAAgL;AAChL,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC,EACnC,UAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GACX,8BAA8B,MAAM,CAAC,QAAQ,CAAC,MAAM,qCAAqC;QACzF,UAAU,MAAM,CAAC,KAAK,CAAC,YAAY,WAAW,MAAM,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC;IAE7F,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,OAAO,sBAAsB,qBAAqB,KAAK,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACtE,CAAC"}

package/dist/oauth/browser.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Opens the system default browser for the `ruflo auth login` flow. A
+ * TypeScript port of meta-proxy's `src/oauth/browser.rs`.
+ *
+ * Deliberately does NOT go through `SafeExecutor.execute()`: `SafeExecutor`'s
+ * blocked-argument patterns (`safe-executor.ts`'s `DEFAULT_BLOCKED_PATTERNS`)
+ * include a bare `&`, which is meant to catch shell-metacharacter injection in
+ * command-line-style arguments — but it also appears in every real OAuth
+ * authorize URL's query string (`?a=1&b=2&...`), so passing one through would
+ * false-positive-reject on every real invocation. That blocklist is the wrong
+ * tool for a URL argument: with `shell: false` (used here, same as
+ * `SafeExecutor`), a single argv element containing `&` is inert — there's no
+ * shell to interpret it. The actual safety property that matters is "the URL
+ * was constructed by us from validated components, never from raw external
+ * input" (this module's `authorizeUrl()` in `client.ts` is the only caller),
+ * which `assertSafeUrl` below checks directly instead.
+ *
+ * @module v3/security/oauth/browser
+ */
+/**
+ * Attempts to open `url` in the system default browser. Resolves whether or
+ * not a browser window actually appeared — this cannot be confirmed in
+ * general, which is why the caller always also prints the URL as a fallback.
+ */
+export declare function openBrowser(url: string): Promise<void>;
+/** Pure command selection, exported for platform regression tests. */
+export declare function browserCommand(url: string, platform?: NodeJS.Platform): {
+    cmd: string;
+    args: string[];
+};
+//# sourceMappingURL=browser.d.ts.map

package/dist/oauth/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/oauth/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtD;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWzH"}

package/dist/oauth/browser.js

@@ -0,0 +1,55 @@
+/**
+ * Opens the system default browser for the `ruflo auth login` flow. A
+ * TypeScript port of meta-proxy's `src/oauth/browser.rs`.
+ *
+ * Deliberately does NOT go through `SafeExecutor.execute()`: `SafeExecutor`'s
+ * blocked-argument patterns (`safe-executor.ts`'s `DEFAULT_BLOCKED_PATTERNS`)
+ * include a bare `&`, which is meant to catch shell-metacharacter injection in
+ * command-line-style arguments — but it also appears in every real OAuth
+ * authorize URL's query string (`?a=1&b=2&...`), so passing one through would
+ * false-positive-reject on every real invocation. That blocklist is the wrong
+ * tool for a URL argument: with `shell: false` (used here, same as
+ * `SafeExecutor`), a single argv element containing `&` is inert — there's no
+ * shell to interpret it. The actual safety property that matters is "the URL
+ * was constructed by us from validated components, never from raw external
+ * input" (this module's `authorizeUrl()` in `client.ts` is the only caller),
+ * which `assertSafeUrl` below checks directly instead.
+ *
+ * @module v3/security/oauth/browser
+ */
+import { execFile } from 'node:child_process';
+/** Throws if `url` isn't a well-formed https/http URL — the one check that matters here. */
+function assertSafeUrl(url) {
+    const parsed = new URL(url); // throws on malformed input
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error(`refusing to open non-http(s) URL scheme: ${parsed.protocol}`);
+    }
+}
+/**
+ * Attempts to open `url` in the system default browser. Resolves whether or
+ * not a browser window actually appeared — this cannot be confirmed in
+ * general, which is why the caller always also prints the URL as a fallback.
+ */
+export function openBrowser(url) {
+    assertSafeUrl(url);
+    const { cmd, args } = browserCommand(url);
+    return new Promise((resolve) => {
+        execFile(cmd, args, { shell: false, windowsHide: true }, () => resolve());
+    });
+}
+/** Pure command selection, exported for platform regression tests. */
+export function browserCommand(url, platform = process.platform) {
+    assertSafeUrl(url);
+    if (platform === 'darwin') {
+        return { cmd: 'open', args: [url] };
+    }
+    else if (platform === 'win32') {
+        // cmd.exe treats OAuth query-string `&` separators as command operators,
+        // truncating the URL before client_id. Use the URL handler without a shell.
+        return { cmd: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url] };
+    }
+    else {
+        return { cmd: 'xdg-open', args: [url] };
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/oauth/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/oauth/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,4FAA4F;AAC5F,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACtF,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,yEAAyE;QACzE,4EAA4E;QAC5E,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC"}