@cotal-ai/linear 0.0.0-bootstrap.0 → 0.76.0

package/dist/oauth.js

@@ -0,0 +1,240 @@
+/**
+ * OAuth for a Linear MCP account, through the MCP SDK's client: dynamic client registration and an
+ * authorization-code grant with PKCE, against the authorization server the pinned Linear MCP origin
+ * advertises. `cotal linear account login` runs it once on a loopback redirect and prints only the
+ * authorize URL. Refresh happens before a request is sent, never by re-sending a refused request.
+ *
+ * Every OAuth request goes to `https://mcp.linear.app` (any path), with no redirects followed and a
+ * bounded body. If Linear moves its authorization server to another origin, login refuses and
+ * names that origin rather than following it.
+ *
+ * State (client registration, tokens, the PKCE verifier) lives in one 0600 file per account.
+ */
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { auth } from "@modelcontextprotocol/sdk/client/auth.js";
+import { mkSecretDir, writeSecretFileAtomic } from "@cotal-ai/core";
+import { assertPrivateFile, linearDir, oauthStatePath, readAccountToken, saveAccount } from "./account.js";
+import { LINEAR_MCP_ORIGIN, linearMcpUrl, OriginRefusedError, ResponseTooLargeError } from "./origin.js";
+const MAX_OAUTH_BODY = 64 * 1024;
+const LOGIN_TIMEOUT_MS = 5 * 60_000;
+/** Refresh this long before the access token expires. */
+const REFRESH_MARGIN_MS = 60_000;
+export function scopeFor(mode) {
+    return mode === "readonly" ? "read" : "read write";
+}
+/** OAuth traffic only reaches the Linear MCP origin, never follows a redirect, and is bounded. */
+const oauthFetch = async (url, init) => {
+    const target = new URL(typeof url === "string" ? url : url.href);
+    if (target.origin !== LINEAR_MCP_ORIGIN)
+        throw new OriginRefusedError(`refusing an OAuth request to ${target.origin}: only ${LINEAR_MCP_ORIGIN} is allowed`);
+    const res = await fetch(target, { ...init, redirect: "manual" });
+    if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+        await res.body?.cancel().catch(() => { });
+        throw new OriginRefusedError(`refusing a ${res.status} redirect from ${target.origin}${target.pathname}`);
+    }
+    return new Response(await boundedBody(res), { status: res.status, statusText: res.statusText, headers: res.headers });
+};
+async function boundedBody(res) {
+    const declared = res.headers.get("content-length");
+    if (declared !== null && Number(declared) > MAX_OAUTH_BODY) {
+        await res.body?.cancel().catch(() => { });
+        throw new ResponseTooLargeError(MAX_OAUTH_BODY);
+    }
+    const out = new Uint8Array(MAX_OAUTH_BODY);
+    if (!res.body)
+        return out.subarray(0, 0);
+    const reader = res.body.getReader();
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (total + value.byteLength > MAX_OAUTH_BODY) {
+            await reader.cancel().catch(() => { });
+            throw new ResponseTooLargeError(MAX_OAUTH_BODY);
+        }
+        out.set(value, total);
+        total += value.byteLength;
+    }
+    return out.subarray(0, total);
+}
+class FileOAuthProvider {
+    name;
+    redirect;
+    scope;
+    expectedState;
+    constructor(name, redirect, scope) {
+        this.name = name;
+        this.redirect = redirect;
+        this.scope = scope;
+    }
+    load() {
+        const path = oauthStatePath(this.name);
+        if (!existsSync(path))
+            return {};
+        assertPrivateFile(path);
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    store(patch) {
+        mkSecretDir(linearDir());
+        writeSecretFileAtomic(oauthStatePath(this.name), `${JSON.stringify({ ...this.load(), ...patch }, null, 2)}\n`);
+    }
+    /** Start a login from nothing: a new redirect port means a new client registration. */
+    reset() {
+        mkSecretDir(linearDir());
+        writeSecretFileAtomic(oauthStatePath(this.name), "{}\n");
+    }
+    get redirectUrl() {
+        return this.redirect;
+    }
+    get clientMetadata() {
+        return {
+            client_name: "Cotal Linear",
+            redirect_uris: this.redirect ? [this.redirect] : [],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+            scope: this.scope,
+        };
+    }
+    state() {
+        this.expectedState = randomBytes(16).toString("hex");
+        return this.expectedState;
+    }
+    stateFor() {
+        return this.expectedState;
+    }
+    clientInformation() {
+        return this.load().client;
+    }
+    saveClientInformation(client) {
+        this.store({ client });
+    }
+    tokens() {
+        return this.load().tokens;
+    }
+    saveTokens(tokens) {
+        this.store({ tokens, obtainedAt: Date.now() });
+    }
+    prepareTokenRequest() {
+        if (this.redirect !== undefined)
+            return undefined;
+        const refreshToken = this.tokens()?.refresh_token;
+        if (!refreshToken)
+            return undefined;
+        return new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken });
+    }
+    redirectToAuthorization(url) {
+        if (!this.redirect)
+            throw new Error(`the Linear OAuth session for ${this.name} has ended; run \`cotal linear account login ${this.name}\` again`);
+        if (url.protocol !== "https:")
+            throw new OriginRefusedError(`refusing a non-https authorization URL (${url.origin})`);
+        console.log(`Open this URL to authorize Cotal with Linear:\n${url.href}`);
+    }
+    saveCodeVerifier(codeVerifier) {
+        this.store({ codeVerifier });
+    }
+    codeVerifier() {
+        const v = this.load().codeVerifier;
+        if (!v)
+            throw new Error("no PKCE verifier is stored for this login");
+        return v;
+    }
+}
+/** Interactive login: loopback redirect, PKCE, dynamic registration. Saves an `oauth` account. */
+export async function loginAccount(name, mode) {
+    const serverUrl = linearMcpUrl(mode);
+    const scope = scopeFor(mode);
+    const http = createServer();
+    await new Promise((ok, bad) => {
+        http.once("error", bad);
+        http.listen(0, "127.0.0.1", () => ok());
+    });
+    try {
+        const port = http.address().port;
+        const provider = new FileOAuthProvider(name, `http://127.0.0.1:${port}/callback`, scope);
+        provider.reset();
+        let timer;
+        const code = new Promise((ok, bad) => {
+            timer = setTimeout(() => bad(new Error("no authorization arrived within 5 minutes")), LOGIN_TIMEOUT_MS);
+            http.on("request", (req, res) => {
+                const u = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+                if (req.method !== "GET" || u.pathname !== "/callback") {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const expected = provider.stateFor();
+                if (!expected || u.searchParams.get("state") !== expected) {
+                    res.writeHead(400).end("state mismatch");
+                    bad(new Error("the authorization callback carried the wrong state; nothing was saved"));
+                    return;
+                }
+                const error = u.searchParams.get("error");
+                const got = u.searchParams.get("code");
+                if (error || !got) {
+                    res.writeHead(400).end("authorization failed");
+                    bad(new Error(`Linear refused the authorization: ${error ?? "no code"}`));
+                    return;
+                }
+                res.writeHead(200, { "content-type": "text/plain" }).end("Linear authorization received. You can close this tab.");
+                ok(got);
+            });
+        });
+        code.catch(() => { });
+        try {
+            if ((await auth(provider, { serverUrl, scope, fetchFn: oauthFetch })) !== "AUTHORIZED") {
+                const authorizationCode = await code;
+                if ((await auth(provider, { serverUrl, scope, authorizationCode, fetchFn: oauthFetch })) !== "AUTHORIZED")
+                    throw new Error("Linear did not issue tokens for this authorization");
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!provider.tokens()?.access_token)
+            throw new Error("Linear issued no access token");
+        saveAccount({ name, mode, auth: "oauth" });
+    }
+    finally {
+        http.close();
+    }
+}
+function oauthCredential(account) {
+    const provider = new FileOAuthProvider(account.name, undefined, scopeFor(account.mode));
+    let refreshing;
+    const relogin = `run \`cotal linear account login ${account.name} --mode ${account.mode}\``;
+    return {
+        bearer() {
+            const token = provider.tokens()?.access_token;
+            if (!token)
+                throw new Error(`the Linear account ${account.name} has no OAuth token; ${relogin}`);
+            return token;
+        },
+        async prepare() {
+            const s = provider.load();
+            if (!s.tokens)
+                throw new Error(`the Linear account ${account.name} has no OAuth token; ${relogin}`);
+            if (s.tokens.expires_in === undefined || s.obtainedAt === undefined)
+                return;
+            if (s.obtainedAt + s.tokens.expires_in * 1000 - REFRESH_MARGIN_MS > Date.now())
+                return;
+            if (!s.tokens.refresh_token)
+                throw new Error(`the OAuth token for ${account.name} expired and cannot be refreshed; ${relogin}`);
+            // One refresh at a time: Linear rotates refresh tokens, so a second concurrent refresh fails.
+            refreshing ??= (async () => {
+                const r = await auth(provider, { serverUrl: linearMcpUrl(account.mode), scope: scopeFor(account.mode), fetchFn: oauthFetch });
+                if (r !== "AUTHORIZED")
+                    throw new Error(`the OAuth refresh for ${account.name} failed; ${relogin}`);
+            })().finally(() => (refreshing = undefined));
+            await refreshing;
+        },
+    };
+}
+export function credentialFor(account) {
+    if (account.auth === "oauth")
+        return oauthCredential(account);
+    return { bearer: () => readAccountToken(account), prepare: async () => { } };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,IAAI,EAA4B,MAAM,0CAA0C,CAAC;AAG1F,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAsB,MAAM,cAAc,CAAC;AAC/H,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAmB,MAAM,aAAa,CAAC;AAgB1H,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpC,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,UAAU,QAAQ,CAAC,IAAgB;IACvC,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACrD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,GAAc,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB;QAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,MAAM,CAAC,MAAM,UAAU,iBAAiB,aAAa,CAAC,CAAC;IAC7J,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAAC,cAAc,GAAG,CAAC,MAAM,kBAAkB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AACxH,CAAC,CAAC;AAEF,KAAK,UAAU,WAAW,CAAC,GAAa;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3D,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YAC9C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,iBAAiB;IAGQ;IAA+B;IAA+C;IAFnG,aAAa,CAAU;IAE/B,YAA6B,IAAY,EAAmB,QAA4B,EAAmB,KAAa;QAA3F,SAAI,GAAJ,IAAI,CAAQ;QAAmB,aAAQ,GAAR,QAAQ,CAAoB;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE5H,IAAI;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAe,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,KAA0B;QACtC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;QACzB,qBAAqB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjH,CAAC;IAED,uFAAuF;IACvF,KAAK;QACH,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;QACzB,qBAAqB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO;YACL,WAAW,EAAE,cAAc;YAC3B,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACnD,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,MAAmC;QACvD,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,mBAAmB;QACjB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC;QAClD,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,OAAO,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,uBAAuB,CAAC,GAAQ;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,IAAI,gDAAgD,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QAClJ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACtH,OAAO,CAAC,GAAG,CAAC,kDAAkD,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,IAAI,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAgB;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,IAAI,WAAW,EAAE,KAAK,CAAC,CAAC;QACzF,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,KAAiC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;YAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACxG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACvD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBACzC,GAAG,CAAC,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC,CAAC;oBACxF,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;oBAC/C,GAAG,CAAC,IAAI,KAAK,CAAC,qCAAqC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC1E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACnH,EAAE,CAAC,GAAG,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACvF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC;gBACrC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,YAAY;oBACvG,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvF,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAkD;IACzE,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,UAAqC,CAAC;IAC1C,MAAM,OAAO,GAAG,oCAAoC,OAAO,CAAC,IAAI,WAAW,OAAO,CAAC,IAAI,IAAI,CAAC;IAC5F,OAAO;QACL,MAAM;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC;YAC9C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,IAAI,wBAAwB,OAAO,EAAE,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,IAAI,wBAAwB,OAAO,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC5E,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO;YACvF,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,qCAAqC,OAAO,EAAE,CAAC,CAAC;YAChI,8FAA8F;YAC9F,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC9H,IAAI,CAAC,KAAK,YAAY;oBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,IAAI,YAAY,OAAO,EAAE,CAAC,CAAC;YACtG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;YAC7C,MAAM,UAAU,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/origin.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The only network surface of this package: the official Linear MCP server, hard-pinned. There is
+ * no caller-supplied URL or header anywhere; a mode picks one of two fixed paths.
+ *
+ * Every request goes through {@link pinnedFetch}, which refuses any other origin or path, sets the
+ * bearer itself, never follows a redirect (a redirect would carry the credential somewhere else),
+ * and bounds each response body BEFORE it is accumulated: a declared `content-length` over the cap
+ * is refused unread, and an undeclared or streamed body errors at the first byte past the cap.
+ */
+import type { FetchLike } from "@modelcontextprotocol/sdk/shared/transport.js";
+export declare const LINEAR_MCP_ORIGIN = "https://mcp.linear.app";
+/** `write` is Linear's default read-write server; `readonly` only exposes read tools. */
+export declare const LINEAR_MCP_PATHS: {
+    readonly write: "/mcp";
+    readonly readonly: "/mcp/readonly";
+};
+export type LinearMode = keyof typeof LINEAR_MCP_PATHS;
+export declare function isLinearMode(v: unknown): v is LinearMode;
+export declare function linearMcpUrl(mode: LinearMode): URL;
+/** A response body crossed the per-response byte cap. The payload is discarded, never truncated. */
+export declare class ResponseTooLargeError extends Error {
+    readonly maxBytes: number;
+    constructor(maxBytes: number);
+}
+/** Refused before any byte left this process. */
+export declare class OriginRefusedError extends Error {
+    constructor(message: string);
+}
+/** The request reached the upstream, but its redirect is not followed. Its effect is unknown. */
+export declare class RedirectRefusedError extends Error {
+    constructor(message: string);
+}
+export declare function pinnedFetch(pinned: URL, readToken: () => string, maxBytes: number): FetchLike;
+//# sourceMappingURL=origin.d.ts.map

package/dist/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,yFAAyF;AACzF,eAAO,MAAM,gBAAgB;;;CAAwD,CAAC;AAEtF,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvD,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,UAAU,CAExD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAElD;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,iDAAiD;AACjD,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,iGAAiG;AACjG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAc7F"}

package/dist/origin.js

@@ -0,0 +1,69 @@
+export const LINEAR_MCP_ORIGIN = "https://mcp.linear.app";
+/** `write` is Linear's default read-write server; `readonly` only exposes read tools. */
+export const LINEAR_MCP_PATHS = { write: "/mcp", readonly: "/mcp/readonly" };
+export function isLinearMode(v) {
+    return v === "write" || v === "readonly";
+}
+export function linearMcpUrl(mode) {
+    return new URL(LINEAR_MCP_PATHS[mode], LINEAR_MCP_ORIGIN);
+}
+/** A response body crossed the per-response byte cap. The payload is discarded, never truncated. */
+export class ResponseTooLargeError extends Error {
+    maxBytes;
+    constructor(maxBytes) {
+        super(`the Linear MCP response exceeded ${maxBytes} bytes and was discarded`);
+        this.maxBytes = maxBytes;
+        this.name = "ResponseTooLargeError";
+    }
+}
+/** Refused before any byte left this process. */
+export class OriginRefusedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "OriginRefusedError";
+    }
+}
+/** The request reached the upstream, but its redirect is not followed. Its effect is unknown. */
+export class RedirectRefusedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RedirectRefusedError";
+    }
+}
+export function pinnedFetch(pinned, readToken, maxBytes) {
+    return async (url, init) => {
+        const target = new URL(typeof url === "string" ? url : url.href);
+        if (target.origin !== pinned.origin || target.pathname !== pinned.pathname || target.search !== "")
+            throw new OriginRefusedError(`refusing a request to ${target.origin}${target.pathname}: only ${pinned.href} is allowed`);
+        const headers = new Headers(init?.headers);
+        headers.set("authorization", `Bearer ${readToken()}`);
+        const res = await fetch(target, { ...init, headers, redirect: "manual" });
+        if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+            await res.body?.cancel().catch(() => { });
+            throw new RedirectRefusedError(`refusing a ${res.status} redirect from ${pinned.href}: the credential is never forwarded`);
+        }
+        return boundResponse(res, maxBytes);
+    };
+}
+function boundResponse(res, maxBytes) {
+    const declared = res.headers.get("content-length");
+    if (declared !== null && Number(declared) > maxBytes) {
+        void res.body?.cancel().catch(() => { });
+        throw new ResponseTooLargeError(maxBytes);
+    }
+    if (!res.body)
+        return res;
+    let seen = 0;
+    const counted = res.body.pipeThrough(new TransformStream({
+        transform(chunk, ctl) {
+            seen += chunk.byteLength;
+            if (seen > maxBytes) {
+                ctl.error(new ResponseTooLargeError(maxBytes));
+            }
+            else
+                ctl.enqueue(chunk);
+        },
+    }));
+    return new Response(counted, { status: res.status, statusText: res.statusText, headers: res.headers });
+}
+//# sourceMappingURL=origin.js.map

package/dist/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAW,CAAC;AAItF,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAC5D,CAAC;AAED,oGAAoG;AACpG,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACzB;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,oCAAoC,QAAQ,0BAA0B,CAAC,CAAC;QAD3D,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,iDAAiD;AACjD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,MAAW,EAAE,SAAuB,EAAE,QAAgB;IAChF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAChG,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,UAAU,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC;QAC3H,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,SAAS,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,MAAM,IAAI,oBAAoB,CAAC,cAAc,GAAG,CAAC,MAAM,kBAAkB,MAAM,CAAC,IAAI,qCAAqC,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAa,EAAE,QAAgB;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrD,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe,CAAyB;QAC/E,SAAS,CAAC,KAAK,EAAE,GAAG;YAClB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,GAAG,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,CAAC;;gBAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC,CAAC;IACJ,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AACzG,CAAC"}

package/dist/serve.d.ts

@@ -0,0 +1,72 @@
+import { type EpCapability, type EpServeGrant, type Identity, type SpaceAuth } from "@cotal-ai/core";
+import type { LinearUpstream } from "./upstream.js";
+/** A reverse-DNS endpoint name: at least two lowercase labels, as the operator configured it. */
+export declare function assertLinearEndpointName(name: string): string;
+/** An authorized, scoped serve bundle. `creds` returns the CURRENT serve credential and is read on
+ *  every (re)connect, so a renewed credential is adopted without re-registering. */
+export interface LinearServeBundle {
+    servers: string;
+    space: string;
+    tls: boolean;
+    identity: Identity;
+    grant: EpServeGrant;
+    creds: () => string;
+}
+export interface LinearEndpointHandle {
+    readonly endpoint: string;
+    readonly instanceId: string;
+    readonly epoch: number;
+    /** Stop serving, then close the upstream session, each within `graceMs`. */
+    stop(graceMs?: number): Promise<void>;
+    /** Resolves when the serve connection closes for good. */
+    closed: Promise<Error | undefined>;
+}
+/** Serve the fixed Linear contract on an authorized bundle. Command names, schemas and the
+ *  `linear.mcp` capability are fixed; the upstream result is returned as data and never parsed. */
+export declare function runLinearEndpoint(bundle: LinearServeBundle, upstream: LinearUpstream): Promise<LinearEndpointHandle>;
+export interface LinearRegistration {
+    bundle: LinearServeBundle;
+    /** Re-mint the serve credential through the same fenced issuance. */
+    renew(): Promise<string>;
+    /** Remove this instance's service record. The issuance gate stays, as for every endpoint. */
+    deregister(): Promise<void>;
+}
+/**
+ * Register `endpoint` as a fresh instance on a static-auth mesh and mint its serve credential.
+ * `auth` is the operator's own space authority; it stays in this closure for renewal and
+ * deregistration and is never placed in the returned bundle.
+ */
+export declare function registerLinearEndpoint(opts: {
+    auth: SpaceAuth;
+    servers: string;
+    space: string;
+    tls: boolean;
+    endpoint: string;
+}): Promise<LinearRegistration>;
+/** Milliseconds until a credential reaches 75% of its remaining lifetime, or undefined when it is
+ *  unbounded. */
+export declare function renewalDelayMs(creds: string, nowMs?: number): number | undefined;
+/** The caller rows for every Linear command on `endpoint`: what a least-privilege caller
+ *  credential carries, and nothing more. */
+export declare function linearCallerCapabilities(endpoint: string): EpCapability[];
+/**
+ * Provision and mint a standalone caller for a static-auth mesh: the ordinary `agent` profile, its
+ * lifecycle-keyed mailboxes, and the exact request rows for the Linear commands on `endpoint`. It
+ * carries no spawn, run, admin or provisioner capability. The caller is an isolated, hand-launched
+ * seat the operator starts with this credential and lifecycle UID; managed spawns still refuse
+ * endpoint capabilities in static mode, which this does not change. The provisioner connection is
+ * minted for this call and stopped before it returns.
+ */
+export declare function provisionLinearCaller(auth: SpaceAuth, target: {
+    servers: string;
+    space: string;
+    tls: boolean;
+}, endpoint: string, opts?: {
+    channels?: string[];
+    expiresInSeconds?: number;
+}): Promise<{
+    creds: string;
+    identity: string;
+    lifecycleUid: string;
+}>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAmBA,OAAO,EA0BL,KAAK,YAAY,EACjB,KAAK,YAAY,EAEjB,KAAK,QAAQ,EAEb,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,iGAAiG;AACjG,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;oFACoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;CACpC;AAMD;mGACmG;AACnG,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4B1H;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,qEAAqE;IACrE,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,6FAA6F;IAC7F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoF9B;AAED;iBACiB;AACjB,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAa,GAAG,MAAM,GAAG,SAAS,CAIpF;AAED;4CAC4C;AAC5C,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAGzE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,SAAS,EACf,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EACxD,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCpE"}