@descryy/mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Descry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/action-handshake.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The two-call action-tool handshake — `ai-tool-contract.md` §7, DEC-278's
+ * `action` class.
+ *
+ * G5, the action gate, does not run in MCP mode: no pipeline sits between an
+ * external model and this server, so there is no control flow to hold the
+ * gate. The handshake is what replaces it. An unconfirmed call to an
+ * `action`-class tool performs nothing and returns a token plus a
+ * plain-English description of what confirming would do; only a second call
+ * presenting that exact token performs anything, and it performs the
+ * arguments frozen when the token was minted — never whatever the second
+ * call happens to supply. **The gate holds without the client's
+ * cooperation, because the server owns both the decision and the state.**
+ *
+ * ## Generic by construction
+ *
+ * A tool takes part by declaring `class: "action"` and providing
+ * `describeAction`, nothing else — the mint/redeem/expiry/single-use
+ * machinery below is shared by every present and future action tool rather
+ * than reimplemented per tool. `describeAction` returning `undefined` means
+ * *this particular call* has nothing to confirm — `questions` called with no
+ * `answer` is a pure read of the open-question queue, and gating that behind
+ * a token would make the tool unable to answer the first question asked of
+ * it (the same failure §4 names for over-gating `stateful-read`).
+ *
+ * ## The seam with the server's dispatch loop
+ *
+ * `resolveActionDispatch` decides *before* the caller's budget timer starts:
+ * a mint has no real work to time out on (no I/O, no `tool.run`), so it must
+ * not be raced against `tools.md` §6's budget the way a real call is. The
+ * caller (`server.ts`) checks `decision.kind` — `"handshake"` renders via
+ * `render.ts`'s `renderHandshake` immediately; `"run"` proceeds exactly as
+ * an ungated call would, using `decision.args` (the original arguments for
+ * a `read`/`stateful-read` tool or a pass-through `action` call, or the
+ * arguments captured at mint time for a redeemed one).
+ *
+ * ## Token design, decided here because nothing upstream decides it
+ *
+ * - **Binds to call 1's exact arguments.** The token is not a bare
+ *   capability — it is minted together with a stored copy of the arguments
+ *   that produced its `willDo`. Redeeming it runs *that* stored copy,
+ *   ignoring whatever the redeeming call supplies alongside the token. A
+ *   client cannot describe one action and, on confirmation, have a
+ *   different one performed.
+ * - **Single-use.** A token is deleted from the store the moment it is
+ *   looked up for redemption, whether or not that redemption goes on to
+ *   succeed — replay is not a retry, and a caller that wants to do the same
+ *   thing twice must be told about it twice.
+ * - **Five-minute expiry.** A starting value, not a measurement (no
+ *   confirmation flow has run yet to measure a real gap between mint and
+ *   confirm) — long enough for a human or a model to read `willDo` and
+ *   decide, short enough that a token is not a standing credential.
+ * - **Unknown, expired or wrong-tool token → `ToolInputError`, never a
+ *   silent no-op.** This is an argument the caller can fix (ask again,
+ *   without `confirmToken`, for a fresh one) so it takes the same path as
+ *   any other bad argument — a tool result the caller can read and act on,
+ *   not a protocol error and not a quiet success that performed nothing.
+ * - **Session-scoped.** One MCP server process serves exactly one `Session`
+ *   (`McpServerOptions` takes a single session, not a pool), so the store is
+ *   keyed on the `Session` instance via a `WeakMap` rather than kept as
+ *   module-global mutable state — the scoping a second session would need is
+ *   already correct without anything having to change if one is ever added.
+ */
+import { type ToolContext, type ToolDefinition } from "./tools/kit.ts";
+export type ActionDispatch = {
+    readonly kind: "run";
+    readonly args: Record<string, unknown>;
+} | {
+    readonly kind: "handshake";
+    readonly token: string;
+    readonly willDo: string;
+};
+/**
+ * Decides what a call to `tool` should do, before any budget timer starts.
+ *
+ * `read` and `stateful-read` tools, and an `action` tool whose
+ * `describeAction` says this call has nothing to confirm, resolve to
+ * `{ kind: "run", args }` with `args` unchanged. An unconfirmed call to a
+ * gated `action` tool resolves to `{ kind: "handshake", token, willDo }` —
+ * the caller must render this directly and must not call `tool.run`. A
+ * confirmed call (an `args.confirmToken` that redeems) resolves to `{ kind:
+ * "run", args }` with `args` replaced by the arguments captured at mint
+ * time.
+ */
+export declare function resolveActionDispatch(tool: ToolDefinition, args: Record<string, unknown>, ctx: ToolContext): Promise<ActionDispatch>;
+//# sourceMappingURL=action-handshake.d.ts.map

package/dist/action-handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-handshake.d.ts","sourceRoot":"","sources":["../src/action-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAIH,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAiCvF,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,cAAc,CAAC,CAazB"}

package/dist/action-handshake.js

@@ -0,0 +1,144 @@
+/**
+ * The two-call action-tool handshake — `ai-tool-contract.md` §7, DEC-278's
+ * `action` class.
+ *
+ * G5, the action gate, does not run in MCP mode: no pipeline sits between an
+ * external model and this server, so there is no control flow to hold the
+ * gate. The handshake is what replaces it. An unconfirmed call to an
+ * `action`-class tool performs nothing and returns a token plus a
+ * plain-English description of what confirming would do; only a second call
+ * presenting that exact token performs anything, and it performs the
+ * arguments frozen when the token was minted — never whatever the second
+ * call happens to supply. **The gate holds without the client's
+ * cooperation, because the server owns both the decision and the state.**
+ *
+ * ## Generic by construction
+ *
+ * A tool takes part by declaring `class: "action"` and providing
+ * `describeAction`, nothing else — the mint/redeem/expiry/single-use
+ * machinery below is shared by every present and future action tool rather
+ * than reimplemented per tool. `describeAction` returning `undefined` means
+ * *this particular call* has nothing to confirm — `questions` called with no
+ * `answer` is a pure read of the open-question queue, and gating that behind
+ * a token would make the tool unable to answer the first question asked of
+ * it (the same failure §4 names for over-gating `stateful-read`).
+ *
+ * ## The seam with the server's dispatch loop
+ *
+ * `resolveActionDispatch` decides *before* the caller's budget timer starts:
+ * a mint has no real work to time out on (no I/O, no `tool.run`), so it must
+ * not be raced against `tools.md` §6's budget the way a real call is. The
+ * caller (`server.ts`) checks `decision.kind` — `"handshake"` renders via
+ * `render.ts`'s `renderHandshake` immediately; `"run"` proceeds exactly as
+ * an ungated call would, using `decision.args` (the original arguments for
+ * a `read`/`stateful-read` tool or a pass-through `action` call, or the
+ * arguments captured at mint time for a redeemed one).
+ *
+ * ## Token design, decided here because nothing upstream decides it
+ *
+ * - **Binds to call 1's exact arguments.** The token is not a bare
+ *   capability — it is minted together with a stored copy of the arguments
+ *   that produced its `willDo`. Redeeming it runs *that* stored copy,
+ *   ignoring whatever the redeeming call supplies alongside the token. A
+ *   client cannot describe one action and, on confirmation, have a
+ *   different one performed.
+ * - **Single-use.** A token is deleted from the store the moment it is
+ *   looked up for redemption, whether or not that redemption goes on to
+ *   succeed — replay is not a retry, and a caller that wants to do the same
+ *   thing twice must be told about it twice.
+ * - **Five-minute expiry.** A starting value, not a measurement (no
+ *   confirmation flow has run yet to measure a real gap between mint and
+ *   confirm) — long enough for a human or a model to read `willDo` and
+ *   decide, short enough that a token is not a standing credential.
+ * - **Unknown, expired or wrong-tool token → `ToolInputError`, never a
+ *   silent no-op.** This is an argument the caller can fix (ask again,
+ *   without `confirmToken`, for a fresh one) so it takes the same path as
+ *   any other bad argument — a tool result the caller can read and act on,
+ *   not a protocol error and not a quiet success that performed nothing.
+ * - **Session-scoped.** One MCP server process serves exactly one `Session`
+ *   (`McpServerOptions` takes a single session, not a pool), so the store is
+ *   keyed on the `Session` instance via a `WeakMap` rather than kept as
+ *   module-global mutable state — the scoping a second session would need is
+ *   already correct without anything having to change if one is ever added.
+ */
+import { randomBytes } from "node:crypto";
+import { ToolInputError } from "./tools/kit.js";
+const TOKEN_TTL_MS = 5 * 60 * 1000;
+const storesBySession = new WeakMap();
+function storeFor(session) {
+    let store = storesBySession.get(session);
+    if (store === undefined) {
+        store = new Map();
+        storesBySession.set(session, store);
+    }
+    return store;
+}
+function prune(store) {
+    const now = Date.now();
+    for (const [token, pending] of store) {
+        if (pending.expiresAt < now)
+            store.delete(token);
+    }
+}
+function mintToken() {
+    return `act_${randomBytes(9).toString("base64url")}`;
+}
+/**
+ * Decides what a call to `tool` should do, before any budget timer starts.
+ *
+ * `read` and `stateful-read` tools, and an `action` tool whose
+ * `describeAction` says this call has nothing to confirm, resolve to
+ * `{ kind: "run", args }` with `args` unchanged. An unconfirmed call to a
+ * gated `action` tool resolves to `{ kind: "handshake", token, willDo }` —
+ * the caller must render this directly and must not call `tool.run`. A
+ * confirmed call (an `args.confirmToken` that redeems) resolves to `{ kind:
+ * "run", args }` with `args` replaced by the arguments captured at mint
+ * time.
+ */
+export async function resolveActionDispatch(tool, args, ctx) {
+    if (tool.class !== "action")
+        return { kind: "run", args };
+    const confirmToken = args["confirmToken"];
+    if (confirmToken !== undefined && typeof confirmToken !== "string") {
+        throw new ToolInputError('"confirmToken" must be a string');
+    }
+    if (confirmToken === undefined) {
+        return mintOrPassThrough(tool, args, ctx);
+    }
+    return redeem(tool, confirmToken, ctx);
+}
+async function mintOrPassThrough(tool, args, ctx) {
+    if (tool.describeAction === undefined) {
+        // A bug in the tool registry, not a caller mistake: an author declared
+        // `class: "action"` without saying how to describe it. Thrown, not
+        // returned as a refusal — there is no argument the caller could change
+        // to fix this.
+        throw new Error(`${tool.name} declares class "action" but has no describeAction`);
+    }
+    const willDo = await tool.describeAction(args, ctx);
+    if (willDo === undefined)
+        return { kind: "run", args };
+    const store = storeFor(ctx.session);
+    prune(store);
+    const token = mintToken();
+    store.set(token, { toolName: tool.name, args, expiresAt: Date.now() + TOKEN_TTL_MS });
+    return { kind: "handshake", token, willDo };
+}
+async function redeem(tool, confirmToken, ctx) {
+    const store = storeFor(ctx.session);
+    const pending = store.get(confirmToken);
+    // Deleted on lookup, not on success: a replayed token is a used token
+    // whether or not what follows here succeeds.
+    store.delete(confirmToken);
+    if (pending === undefined) {
+        throw new ToolInputError(`"confirmToken" is unknown or was already used. Call ${tool.name} again without confirmToken for a fresh one.`);
+    }
+    if (pending.expiresAt < Date.now()) {
+        throw new ToolInputError(`"confirmToken" expired. Call ${tool.name} again without confirmToken for a fresh one.`);
+    }
+    if (pending.toolName !== tool.name) {
+        throw new ToolInputError(`"confirmToken" was not issued for ${tool.name}.`);
+    }
+    return { kind: "run", args: pending.args };
+}
+//# sourceMappingURL=action-handshake.js.map

package/dist/action-handshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-handshake.js","sourceRoot":"","sources":["../src/action-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAyC,MAAM,gBAAgB,CAAC;AAGvF,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAQnC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAuC,CAAC;AAE3E,SAAS,QAAQ,CAAC,OAAgB;IAChC,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAiC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;YAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAoB,EACpB,IAA6B,EAC7B,GAAgB;IAEhB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,cAAc,CAAC,iCAAiC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAoB,EACpB,IAA6B,EAC7B,GAAgB;IAEhB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACtC,uEAAuE;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,eAAe;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,oDAAoD,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;IAEtF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAoB,EAAE,YAAoB,EAAE,GAAgB;IAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,sEAAsE;IACtE,6CAA6C;IAC7C,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACtB,uDAAuD,IAAI,CAAC,IAAI,8CAA8C,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CACtB,gCAAgC,IAAI,CAAC,IAAI,8CAA8C,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CAAC,qCAAqC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC"}

package/dist/bin/descry-mcp.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * The executable an MCP host launches.
+ *
+ * Takes the repository path as its only argument, defaulting to the working
+ * directory — which is what a host passes when it starts the server inside a
+ * project. Everything else comes from `.descry/config.json`.
+ *
+ * ## Nothing may print before the transport is installed
+ *
+ * `serveStdio` redirects every console channel to stderr on its first line. Any
+ * output *before* that call goes to real stdout and corrupts the very first
+ * frame — the handshake — which is the worst place to fail, because the host
+ * reports it as "server did not start" with no further detail. So this file
+ * writes nothing itself and does its argument handling before opening anything.
+ */
+export {};
+//# sourceMappingURL=descry-mcp.d.ts.map

package/dist/bin/descry-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descry-mcp.d.ts","sourceRoot":"","sources":["../../src/bin/descry-mcp.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG"}

package/dist/bin/descry-mcp.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+/**
+ * The executable an MCP host launches.
+ *
+ * Takes the repository path as its only argument, defaulting to the working
+ * directory — which is what a host passes when it starts the server inside a
+ * project. Everything else comes from `.descry/config.json`.
+ *
+ * ## Nothing may print before the transport is installed
+ *
+ * `serveStdio` redirects every console channel to stderr on its first line. Any
+ * output *before* that call goes to real stdout and corrupts the very first
+ * frame — the handshake — which is the worst place to fail, because the host
+ * reports it as "server did not start" with no further detail. So this file
+ * writes nothing itself and does its argument handling before opening anything.
+ */
+import process from "node:process";
+import { resolve } from "node:path";
+import { createMcpServer } from "../server.js";
+import { Session } from "../session.js";
+import { serveStdio } from "../transport.js";
+const USAGE = `descry-mcp — Descry's MCP server (stdio)
+
+  descry-mcp [repository-path]
+
+Reads .descry/config.json from the repository for the graph location and the
+list of adapter packages to load. Runs until stdin closes.
+`;
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stderr.write(USAGE);
+        return 0;
+    }
+    const repoPath = resolve(args[0] ?? process.cwd());
+    const session = await Session.open({ repoPath });
+    const server = createMcpServer({ session, name: "descry", version: "0.0.0" });
+    try {
+        await serveStdio({ stdin: process.stdin, stdout: process.stdout, stderr: process.stderr }, (line, transport) => server.dispatch(line, transport));
+        return 0;
+    }
+    finally {
+        // The SQLite handle and anything else with a lifetime. Held open past the
+        // end of stdin, a WAL journal outlives the process that owned it.
+        session.close();
+    }
+}
+main().then((code) => {
+    process.exitCode = code;
+}, (error) => {
+    process.stderr.write(`descry-mcp: ${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=descry-mcp.js.map

package/dist/bin/descry-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descry-mcp.js","sourceRoot":"","sources":["../../src/bin/descry-mcp.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,KAAK,GAAG;;;;;;CAMb,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9E,IAAI,CAAC;QACH,MAAM,UAAU,CACd,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACxE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CACtD,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzF,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `@descryy/mcp` — the agent-facing front door.
+ *
+ * A thin wrapper over the query layer, as DEC-002 requires: every consumer goes
+ * through here and **nothing touches storage directly**. That is why the tools
+ * hold a `Session` and not a driver.
+ */
+export { createMcpServer } from "./server.ts";
+export type { McpServer, McpServerOptions } from "./server.ts";
+export { Session, loadConfig, writeConfig, writeSources, ConfigError, CONFIG_RELATIVE_PATH, DEFAULT_GRAPH_RELATIVE_PATH, } from "./session.ts";
+export type { DescryConfig, SessionOptions, ConfigPatch } from "./session.ts";
+export { loadSources, detectSources, normaliseSpec } from "./registry.ts";
+export type { SourceSpec, LoadedSource, SourceLoadFailure, RegistryResult } from "./registry.ts";
+export { renderAnswer, renderFailed, renderHandshake, renderTimedOut, renderToolError, DisclosureError, TOOL_TIERS, } from "./render.ts";
+export type { AnswerEnvelope, CallToolResult, Provenance, ResultState, ToolAnswer, ToolTier, TruncationDetail, } from "./render.ts";
+export { TOOLS, TOOLS_BY_NAME, ToolInputError, resolveOneNode } from "./tools/index.ts";
+export type { BriefNode, NodeCandidates, Progress, ToolContext, ToolDefinition, } from "./tools/index.ts";
+/**
+ * The shape each tool puts in `AnswerEnvelope.data`.
+ *
+ * `data` is `unknown` in the envelope by design — it differs per tool — but
+ * "read the handler" is not a contract, and an AI caller cannot rely on a
+ * shape nobody wrote down. Each of these describes what its tool returns
+ * **today**; where a tool's payload is genuinely conditional the type is a
+ * union that says so rather than a widening to `unknown`.
+ */
+export type { AffectedNode, AnalyzeData, BlockedCheck, CoChangedFile, ConfigDependencyReport, ContractPathFinding, ContractShapeMismatchReport, ContractShapeStatus, ContractsData, CrossPrData, CrossPrEmptyDiff, CrossPrGitFailure, CrossPrReport, EnvFindingReport, HiddenDependencyCheck, HiddenDependencyFinding, HistoryData, HistoryFile, HistoryFileResolved, HistoryFileUnresolved, HistoryReport, ImpactData, ImpactReport, ImpactedNode, LinkWorkspaceData, LinkedRepo, OverlapCheck, OverlapReportChecked, PrAnalysisData, PrAnalysisEmptyDiff, PrAnalysisGitFailure, PrAnalysisRange, PrAnalysisReport, PrAnalysisUnresolved, PropagationData, PropagationReport, QuestionsData, ReachedNode, RelatedNode, ScopeData, ScopeNotSeeded, ScopeReport, ScopeTierCount, ScopedNodeReport, SimilarIncidentReport, SimilarIncidentSignalReport, SimilarIncidentsData, SourceRun, SupersededCheck, TracedPath, ValidateData, } from "./tools/index.ts";
+export { serveStdio, guardStdout, createLineReader } from "./transport.ts";
+export type { Transport, StdioOptions } from "./transport.ts";
+export { PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, negotiateVersion, parseMessage, ProtocolError, } from "./protocol.ts";
+export type { RpcRequest, RpcNotification, RpcResponse, RpcMessage, RpcId } from "./protocol.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,cAAc,EACd,UAAU,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,cAAc,EACd,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;GAQG;AACH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,WAAW,EACX,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,SAAS,EACT,eAAe,EACf,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+/**
+ * `@descryy/mcp` — the agent-facing front door.
+ *
+ * A thin wrapper over the query layer, as DEC-002 requires: every consumer goes
+ * through here and **nothing touches storage directly**. That is why the tools
+ * hold a `Session` and not a driver.
+ */
+export { createMcpServer } from "./server.js";
+export { Session, loadConfig, writeConfig, writeSources, ConfigError, CONFIG_RELATIVE_PATH, DEFAULT_GRAPH_RELATIVE_PATH, } from "./session.js";
+export { loadSources, detectSources, normaliseSpec } from "./registry.js";
+export { renderAnswer, renderFailed, renderHandshake, renderTimedOut, renderToolError, DisclosureError, TOOL_TIERS, } from "./render.js";
+export { TOOLS, TOOLS_BY_NAME, ToolInputError, resolveOneNode } from "./tools/index.js";
+export { serveStdio, guardStdout, createLineReader } from "./transport.js";
+export { PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, negotiateVersion, parseMessage, ProtocolError, } from "./protocol.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG1E,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AAWrB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAwExF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC"}

package/dist/language-guess.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A guess, never an assertion — this module names its own limits so nothing
+ * downstream mistakes its output for a confirmed fact.
+ *
+ * `verification_status` needs a language name for a ref that resolved to
+ * nothing in the graph, to check whether a *configured, declared* source
+ * covers it (`registry.ts`'s `SourceSpec.language`). Extension alone cannot
+ * confirm a file's language — a `.h` file could be C or C++, a build script
+ * could be anything — so this table only maps extensions unambiguous enough
+ * that a wrong guess would be a surprise, and returns `null` rather than a
+ * plausible-but-unconfirmed answer for everything else. `null` here means
+ * exactly what it always meant one layer up: "this tool did not determine
+ * one," never "no language exists."
+ */
+/** `null` on anything not confidently namable — see the module header. */
+export declare function guessLanguageFromPath(path: string): string | null;
+//# sourceMappingURL=language-guess.d.ts.map

package/dist/language-guess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"language-guess.d.ts","sourceRoot":"","sources":["../src/language-guess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwBH,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE"}

package/dist/language-guess.js

@@ -0,0 +1,43 @@
+/**
+ * A guess, never an assertion — this module names its own limits so nothing
+ * downstream mistakes its output for a confirmed fact.
+ *
+ * `verification_status` needs a language name for a ref that resolved to
+ * nothing in the graph, to check whether a *configured, declared* source
+ * covers it (`registry.ts`'s `SourceSpec.language`). Extension alone cannot
+ * confirm a file's language — a `.h` file could be C or C++, a build script
+ * could be anything — so this table only maps extensions unambiguous enough
+ * that a wrong guess would be a surprise, and returns `null` rather than a
+ * plausible-but-unconfirmed answer for everything else. `null` here means
+ * exactly what it always meant one layer up: "this tool did not determine
+ * one," never "no language exists."
+ */
+const EXTENSION_TO_LANGUAGE = {
+    ts: "typescript",
+    tsx: "typescript",
+    js: "javascript",
+    jsx: "javascript",
+    mjs: "javascript",
+    cjs: "javascript",
+    py: "python",
+    go: "go",
+    java: "java",
+    kt: "kotlin",
+    kts: "kotlin",
+    cs: "csharp",
+    php: "php",
+    rb: "ruby",
+    rs: "rust",
+    swift: "swift",
+    sql: "sql",
+    sh: "bash",
+    bash: "bash",
+};
+/** `null` on anything not confidently namable — see the module header. */
+export function guessLanguageFromPath(path) {
+    const match = /\.([^./]+)$/.exec(path);
+    if (match === null)
+        return null;
+    return EXTENSION_TO_LANGUAGE[match[1].toLowerCase()] ?? null;
+}
+//# sourceMappingURL=language-guess.js.map

package/dist/language-guess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"language-guess.js","sourceRoot":"","sources":["../src/language-guess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,qBAAqB,GAAqC;IAC9D,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,QAAQ;IACZ,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,QAAQ;IACb,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AAChE,CAAC"}

package/dist/protocol.d.ts

@@ -0,0 +1,91 @@
+/**
+ * JSON-RPC 2.0 and the slice of MCP this server speaks.
+ *
+ * ## Why this is hand-written
+ *
+ * `@modelcontextprotocol/sdk` is the obvious answer and the blueprint's
+ * dependency table names it. It was measured rather than assumed: version 1.30.0
+ * declares **seventeen direct dependencies** — `express`, `hono`,
+ * `@hono/node-server`, `cors`, `express-rate-limit`, `jose`, `pkce-challenge`,
+ * `eventsource`, `ajv`, `zod` — essentially all of which exist to serve the HTTP
+ * and OAuth transports. This server speaks stdio to a coding agent on the same
+ * machine. It will never open a socket.
+ *
+ * The rest of this project has made the same call four times — `node:sqlite`
+ * over `better-sqlite3`, `node --test` over a test runner, `tsc` over a bundler,
+ * `git` invoked directly over a git library — every time on the same grounds:
+ * this is a **locally installed developer tool**, and a dependency tree is a
+ * distribution problem before it is anything else. Both shipped packages have
+ * zero runtime dependencies today. Seventeen transitively-hundreds is a large
+ * price for newline-delimited JSON.
+ *
+ * **The cost is named, not waved away.** Hand-rolling means spec drift is
+ * silent: the wire format changes, the client stops working, and nothing in this
+ * repository fails. Two things pay it down. `PROTOCOL_VERSION` is pinned and
+ * `SUPPORTED_PROTOCOL_VERSIONS` is explicit, so an unknown version is negotiated
+ * rather than assumed compatible; and the handshake is covered by tests that
+ * assert the exact frames, so a change to the shape is a red test rather than a
+ * user-visible mystery. If the protocol moves past what is here, the fix is to
+ * add a version to the list — not to discover it from a bug report.
+ */
+/** JSON-RPC 2.0 ids: string or number, never null in a request. */
+export type RpcId = string | number;
+export interface RpcRequest {
+    readonly jsonrpc: "2.0";
+    readonly id: RpcId;
+    readonly method: string;
+    readonly params?: Record<string, unknown>;
+}
+export interface RpcNotification {
+    readonly jsonrpc: "2.0";
+    readonly method: string;
+    readonly params?: Record<string, unknown>;
+}
+export interface RpcError {
+    readonly code: number;
+    readonly message: string;
+    readonly data?: unknown;
+}
+export interface RpcResponse {
+    readonly jsonrpc: "2.0";
+    readonly id: RpcId;
+    readonly result?: unknown;
+    readonly error?: RpcError;
+}
+export type RpcMessage = RpcRequest | RpcNotification;
+/** Standard JSON-RPC codes. MCP adds none of its own at this layer. */
+export declare const RPC_PARSE_ERROR = -32700;
+export declare const RPC_INVALID_REQUEST = -32600;
+export declare const RPC_METHOD_NOT_FOUND = -32601;
+export declare const RPC_INVALID_PARAMS = -32602;
+export declare const RPC_INTERNAL_ERROR = -32603;
+/**
+ * The version this server implements.
+ *
+ * Newest first. Negotiation echoes the client's version when it is on this list
+ * and otherwise answers with `PROTOCOL_VERSION`, which is what the spec asks for
+ * — the client then decides whether it can proceed. Answering with the client's
+ * unknown version instead would be a claim of compatibility nobody has checked.
+ */
+export declare const PROTOCOL_VERSION = "2025-06-18";
+export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+export declare function negotiateVersion(requested: unknown): string;
+/**
+ * A frame that could not be understood well enough to answer.
+ *
+ * Distinguished from a request that is merely wrong, because JSON-RPC says a
+ * message with no usable id gets no response at all — replying to it with a
+ * fabricated id would put a frame on the wire the client cannot correlate.
+ */
+export declare class ProtocolError extends Error {
+    readonly code: number;
+    /** Null when the frame carried no usable id and must therefore go unanswered. */
+    readonly id: RpcId | null;
+    constructor(code: number, message: string, id: RpcId | null);
+}
+/** Parse one line into a request or notification, or throw `ProtocolError`. */
+export declare function parseMessage(line: string): RpcMessage;
+export declare function isRequest(message: RpcMessage): message is RpcRequest;
+export declare function ok(id: RpcId, result: unknown): RpcResponse;
+export declare function fail(id: RpcId, code: number, message: string, data?: unknown): RpcResponse;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,mEAAmE;AACnE,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEtD,uEAAuE;AACvE,eAAO,MAAM,eAAe,SAAS,CAAC;AACtC,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAIxD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAI3D;AAMD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC;gBAEd,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI;CAM5D;AAMD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAsCrD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,IAAI,UAAU,CAEpE;AAED,wBAAgB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,WAAW,CAE1D;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAM1F"}