@eco-incorp/sauce 0.99.6 → 0.99.8

package/mcp/dist/guard.js

@@ -0,0 +1,262 @@
+/**
+ * The guard between a remote server and the RPC endpoints its callers name.
+ *
+ * A tool call may carry its own `rpcUrl`. On a server others reach over HTTP, that URL is chosen by
+ * whoever calls it, so the server must not become a way into the network it runs in: its own
+ * loopback, the private networks around it, a cloud's metadata service. So, over HTTP, a caller's
+ * endpoint is reached only through this guard:
+ *
+ * - `https:` only (unless the operator allows private endpoints);
+ * - its host resolved, and refused when any address it resolves to is loopback, private (RFC 1918,
+ *   ULA), link-local, CGNAT, unspecified, multicast, reserved, or a cloud metadata address;
+ * - RESOLVED AGAIN, AND CHECKED AGAIN, AT EVERY CONNECTION. The SDK's clients are handed a loopback
+ *   URL of this guard's own, which forwards each request to the endpoint through a DNS lookup that
+ *   refuses those addresses — so a name that resolved to a public address when it was checked and
+ *   to a private one when it is used (DNS rebinding) is refused when it is used;
+ * - no redirect followed, a timeout, and bounds on what is sent and what is read back.
+ *
+ * `--allow-private-rpc` relaxes it for a private deployment: `http:` and private addresses then
+ * pass, but link-local and metadata addresses never do. Over stdio there is no guard: the server is
+ * the user's own process, on the user's own machine, reached by the user's own agent, so an
+ * endpoint it names is one the user can reach anyway — a local node included.
+ */
+import { randomBytes } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns";
+import { createServer, request as httpRequest, } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { BlockList, isIP } from "node:net";
+import { UsageError } from "./sdk.js";
+/** Never reached, guard relaxed or not: link-local and the cloud metadata services. */
+const ALWAYS = new BlockList();
+ALWAYS.addSubnet("169.254.0.0", 16, "ipv4"); // link-local; AWS, GCP and Azure metadata, ECS tasks
+ALWAYS.addAddress("100.100.100.200", "ipv4"); // Alibaba Cloud metadata
+ALWAYS.addSubnet("fe80::", 10, "ipv6"); // link-local
+ALWAYS.addAddress("fd00:ec2::254", "ipv6"); // AWS metadata over IPv6
+/** Never reached by a guarded server: everything that is not the public internet. */
+const PRIVATE = new BlockList();
+for (const [network, prefix] of [
+    ["0.0.0.0", 8], // "this network", unspecified
+    ["10.0.0.0", 8], // RFC 1918
+    ["100.64.0.0", 10], // CGNAT (RFC 6598)
+    ["127.0.0.0", 8], // loopback
+    ["172.16.0.0", 12], // RFC 1918
+    ["192.0.0.0", 24], // IETF protocol assignments
+    ["192.0.2.0", 24], // documentation
+    ["192.168.0.0", 16], // RFC 1918
+    ["198.18.0.0", 15], // benchmarking
+    ["198.51.100.0", 24], // documentation
+    ["203.0.113.0", 24], // documentation
+    ["224.0.0.0", 4], // multicast
+    ["240.0.0.0", 4], // reserved, and broadcast
+]) {
+    PRIVATE.addSubnet(network, prefix, "ipv4");
+}
+for (const [network, prefix] of [
+    ["::", 128], // unspecified
+    ["::1", 128], // loopback
+    ["64:ff9b::", 96], // NAT64: an IPv4 address behind it may be any of the above
+    ["100::", 64], // discard
+    ["2001:db8::", 32], // documentation
+    ["fc00::", 7], // unique local (ULA)
+    ["ff00::", 8], // multicast
+]) {
+    PRIVATE.addSubnet(network, prefix, "ipv6");
+}
+/** The IPv4 address an IPv4-mapped IPv6 one (`::ffff:10.0.0.1`) stands for. */
+function mappedV4(address) {
+    const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address)?.[1];
+    if (dotted !== undefined)
+        return dotted;
+    const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(address);
+    if (hex === null)
+        return undefined;
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+/** Why the guard refuses `address`, or `undefined` when it may be reached. */
+export function blockedAddress(address, allowPrivate) {
+    const v4 = mappedV4(address);
+    const [ip, family] = v4 !== undefined
+        ? [v4, "ipv4"]
+        : [address, isIP(address) === 6 ? "ipv6" : "ipv4"];
+    if (isIP(ip) === 0)
+        return "is not an IP address";
+    if (ALWAYS.check(ip, family))
+        return "is link-local or a cloud metadata address";
+    if (!allowPrivate && PRIVATE.check(ip, family)) {
+        return "is loopback, private, CGNAT or otherwise not on the public internet";
+    }
+    return undefined;
+}
+const systemResolve = (hostname) => new Promise((resolve, reject) => dnsLookup(hostname, { all: true, verbatim: true }, (error, addresses) => error === null ? resolve(addresses) : reject(error)));
+/** The scheme and host a caller's `raw` URL names, checked; the message never quotes it. */
+export async function checkRpcUrl(raw, options) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new UsageError("rpcUrl is not a URL");
+    }
+    const schemes = options.allowPrivate ? ["https:", "http:"] : ["https:"];
+    if (!schemes.includes(url.protocol)) {
+        throw new UsageError(options.allowPrivate
+            ? "rpcUrl must be an http(s) URL"
+            : "rpcUrl must be an https URL: this server reaches a caller's endpoint over TLS only");
+    }
+    if (url.username !== "" || url.password !== "") {
+        throw new UsageError("rpcUrl must not carry a user name or password before its host");
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const addresses = isIP(host) === 0
+        ? await (options.resolve ?? systemResolve)(host).catch(() => {
+            throw new UsageError("rpcUrl's host does not resolve");
+        })
+        : [{ address: host, family: isIP(host) }];
+    for (const { address } of addresses) {
+        const why = blockedAddress(address, options.allowPrivate);
+        if (why !== undefined) {
+            throw new UsageError(`rpcUrl's host resolves to an address that ${why}, which this server does not reach. ` +
+                "Pass a public endpoint, or run the server yourself (npx -y @eco-incorp/sauce mcp) to " +
+                "reach a local or private one.");
+        }
+    }
+    return url;
+}
+const refuse = (res, status, message) => {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    res.writeHead(status, { "content-type": "text/plain" });
+    res.end(message);
+};
+/** Reads `req`'s body, up to `max` bytes; `undefined` when it is larger. */
+function body(req, max) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > max) {
+                resolve(undefined);
+                req.destroy();
+            }
+            else
+                chunks.push(chunk);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+/** The guard, with its forwarder on an ephemeral loopback port, started on the first route. */
+export function createRpcGuard(options) {
+    const resolve = options.resolve ?? systemResolve;
+    const timeoutMs = options.timeoutMs ?? 20_000;
+    const maxRequest = options.maxRequest ?? 2 * 1024 * 1024;
+    const maxResponse = options.maxResponse ?? 16 * 1024 * 1024;
+    const routes = new Map();
+    let listening;
+    /** `dns.lookup` for the connection itself: the check repeated on the addresses it will use. */
+    const lookup = (hostname, lookupOptions, callback) => {
+        resolve(hostname).then((addresses) => {
+            const blocked = addresses.find((each) => blockedAddress(each.address, options.allowPrivate) !== undefined);
+            if (blocked !== undefined || addresses.length === 0) {
+                callback(Object.assign(new Error("refused address"), { code: "ESAUCEBLOCKED" }), "");
+            }
+            else if (lookupOptions.all === true) {
+                callback(null, [...addresses]);
+            }
+            else {
+                callback(null, addresses[0].address, addresses[0].family);
+            }
+        }, (error) => callback(error, ""));
+    };
+    const forward = async (req, res) => {
+        const target = routes.get((req.url ?? "").slice(1));
+        if (target === undefined)
+            return refuse(res, 404, "no such route");
+        if (req.method !== "POST")
+            return refuse(res, 405, "POST only");
+        const sent = await body(req, maxRequest);
+        if (sent === undefined)
+            return refuse(res, 413, "request too large");
+        const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+        const upstream = send(target, {
+            method: "POST",
+            headers: {
+                "content-type": req.headers["content-type"] ?? "application/json",
+                "content-length": sent.length,
+                accept: "application/json",
+            },
+            lookup,
+            timeout: timeoutMs,
+        }, (answer) => {
+            const status = answer.statusCode ?? 502;
+            // A redirect could lead anywhere the checks never saw: it is not followed.
+            if (status >= 300 && status < 400) {
+                answer.resume();
+                return refuse(res, 502, "the endpoint redirected, which this server does not follow");
+            }
+            const chunks = [];
+            let size = 0;
+            answer.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > maxResponse) {
+                    answer.destroy();
+                    refuse(res, 502, "the endpoint's answer is too large");
+                }
+                else
+                    chunks.push(chunk);
+            });
+            answer.on("end", () => {
+                if (res.headersSent || size > maxResponse)
+                    return;
+                res.writeHead(status, {
+                    "content-type": answer.headers["content-type"] ?? "application/json",
+                });
+                res.end(Buffer.concat(chunks));
+            });
+            answer.on("error", () => refuse(res, 502, "the endpoint's answer failed"));
+        });
+        upstream.on("timeout", () => upstream.destroy(new Error("timed out")));
+        upstream.on("error", (error) => refuse(res, 502, error.code === "ESAUCEBLOCKED"
+            ? "refused: the endpoint's host resolves to an address this server does not reach"
+            : error.message === "timed out"
+                ? "the endpoint did not answer in time"
+                : "the endpoint could not be reached"));
+        upstream.end(sent);
+    };
+    const start = () => {
+        listening ??= new Promise((ready, fail) => {
+            const server = createServer((req, res) => {
+                forward(req, res).catch(() => refuse(res, 502, "the endpoint could not be reached"));
+            });
+            server.once("error", fail);
+            // Loopback only, on a port the system picks: nothing outside this host can reach it.
+            server.listen(0, "127.0.0.1", () => {
+                server.off("error", fail);
+                ready({ server, port: server.address().port });
+            });
+        });
+        return listening;
+    };
+    return {
+        route: async (raw) => {
+            const target = await checkRpcUrl(raw, { allowPrivate: options.allowPrivate, resolve });
+            const { port } = await start();
+            // Unguessable, and good for this one call only.
+            const token = randomBytes(24).toString("hex");
+            routes.set(token, target);
+            return { url: `http://127.0.0.1:${port}/${token}`, release: () => routes.delete(token) };
+        },
+        close: async () => {
+            if (listening === undefined)
+                return;
+            const { server } = await listening;
+            await new Promise((done) => server.close(() => done()));
+        },
+    };
+}
+//# sourceMappingURL=guard.js.map

package/mcp/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAsB,MAAM,UAAU,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,OAAO,IAAI,WAAW,GAIvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAoB,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,uFAAuF;AACvF,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;AAC/B,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,qDAAqD;AAClG,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB;AACvE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa;AACrD,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB;AAErE,qFAAqF;AACrF,MAAM,OAAO,GAAG,IAAI,SAAS,EAAE,CAAC;AAChC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,8BAA8B;IAC9C,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,WAAW;IAC5B,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,mBAAmB;IACvC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,WAAW;IAC/B,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAC/C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACnC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,WAAW;IAChC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACtC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACrC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,0BAA0B;CACpC,EAAE,CAAC;IACX,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,cAAc;IAC3B,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW;IACzB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,2DAA2D;IAC9E,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,UAAU;IACzB,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACpC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,qBAAqB;IACpC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,YAAY;CACnB,EAAE,CAAC;IACX,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,GAAG,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAElC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,YAAqB;IACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAChB,EAAE,KAAK,SAAS;QACd,CAAC,CAAC,CAAC,EAAE,EAAE,MAAe,CAAC;QACvB,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC;QAAE,OAAO,2CAA2C,CAAC;IACjF,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/C,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAKD,MAAM,aAAa,GAAY,CAAC,QAAQ,EAAE,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC9B,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CACtE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACpD,CACF,CAAC;AA2BJ,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,OAA0D;IAE1D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,OAAO,CAAC,YAAY;YAClB,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,oFAAoF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAAC,+DAA+D,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxD,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;QACzD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,6CAA6C,GAAG,sCAAsC;gBACpF,uFAAuF;gBACvF,+BAA+B,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe,EAAQ,EAAE;IAC5E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,GAAG,CAAC,OAAO,EAAE,CAAC;QAEd,OAAO;IACT,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF,4EAA4E;AAC5E,SAAS,IAAI,CAAC,GAAoB,EAAE,GAAW;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;gBACf,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;;gBAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACtC,IAAI,SAAgE,CAAC;IAErE,+FAA+F;IAC/F,MAAM,MAAM,GAAG,CACb,QAAgB,EAChB,aAAgC,EAChC,QAIS,EACH,EAAE;QACR,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE;YACZ,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAC5B,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,SAAS,CAC3E,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,IAAI,aAAa,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,EACD,CAAC,KAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CACtD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CACnB,MAAM,EACN;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB;gBACjE,gBAAgB,EAAE,IAAI,CAAC,MAAM;gBAC7B,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM;YACN,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;YACxC,2EAA2E;YAC3E,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAEhB,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,4DAA4D,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,WAAW,EAAE,CAAC;oBACvB,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACzD,CAAC;;oBAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,GAAG,WAAW;oBAAE,OAAO;gBAClD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;oBACpB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB;iBACrE,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC,CAAC;QAC7E,CAAC,CACF,CAAC;QACF,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,CACpD,MAAM,CACJ,GAAG,EACH,GAAG,EACH,KAAK,CAAC,IAAI,KAAK,eAAe;YAC5B,CAAC,CAAC,gFAAgF;YAClF,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW;gBAC7B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,mCAAmC,CAC1C,CACF,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAA8C,EAAE;QAC5D,SAAS,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACvC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3B,qFAAqF;YACrF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAG,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;YAC/B,gDAAgD;YAChD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAE1B,OAAO,EAAE,GAAG,EAAE,oBAAoB,IAAI,IAAI,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO;YACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC;YACnC,MAAM,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/mcp/dist/http.js

@@ -0,0 +1,111 @@
+/**
+ * The server over Streamable HTTP, stateless: every POST to `/mcp` gets a server and a transport
+ * of its own, answered with JSON, and nothing is kept between requests — no session, so any
+ * replica can answer any request. There is no GET stream and no DELETE (405).
+ *
+ * It authenticates NO ONE. It binds to the loopback interface unless told otherwise, and answers
+ * only requests whose Host (and Origin, when sent) is a loopback name or one `--allowed-host`
+ * names, which is what stops a web page from reaching it through DNS rebinding. A deployment others
+ * can reach goes behind the operator's own authentication — a reverse proxy that checks a token —
+ * and must name the host it is served as (`entry.ts` refuses to bind beyond loopback without one).
+ *
+ * A request body past `maxBody` bytes is refused (413) before it is parsed; each tool bounds its
+ * own inputs besides (`tools.ts#LIMITS`).
+ */
+import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { scrub } from "./sdk.js";
+/** The default bound on a request body: 2 MiB, room for the largest program a tool takes. */
+export const DEFAULT_MAX_BODY = 2 * 1024 * 1024;
+const LOOPBACK = ["localhost", "127.0.0.1", "[::1]", "::1"];
+export const isLoopback = (host) => LOOPBACK.includes(host) || /^127\.\d+\.\d+\.\d+$/.test(host);
+/** The hostname a Host or Origin header names, port dropped; `undefined` when it names none. */
+function hostnameOf(value, origin) {
+    try {
+        return new URL(origin ? value : `http://${value}`).hostname;
+    }
+    catch {
+        return undefined;
+    }
+}
+function refuse(res, status, message) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32000, message }, id: null }));
+}
+/**
+ * Which hosts a request may name: the loopback ones and `allowedHosts`; `undefined` (any) only
+ * when `allowedHosts` says `*` — for an operator whose proxy checks the Host itself.
+ */
+function hostsAllowed(options) {
+    if (!options.allowedHosts.includes("*")) {
+        // A name given with a port is the name: the Host check compares hostnames, port dropped.
+        return [
+            ...LOOPBACK,
+            ...options.allowedHosts.map((host) => (hostnameOf(host, false) ?? host).toLowerCase()),
+        ];
+    }
+    return undefined;
+}
+async function handle(req, res, options) {
+    const path = new URL(req.url ?? "/", "http://localhost").pathname;
+    if (path !== "/mcp")
+        return refuse(res, 404, "not found: the MCP endpoint is /mcp");
+    const allowed = hostsAllowed(options);
+    if (allowed !== undefined) {
+        const host = hostnameOf(req.headers.host ?? "", false);
+        if (host === undefined || !allowed.includes(host.toLowerCase())) {
+            return refuse(res, 403, "this server does not answer for that Host");
+        }
+        const origin = req.headers.origin;
+        if (origin !== undefined) {
+            const from = hostnameOf(origin, true);
+            if (from === undefined || !allowed.includes(from.toLowerCase())) {
+                return refuse(res, 403, "this server does not answer requests from that Origin");
+            }
+        }
+    }
+    if (req.method !== "POST") {
+        res.setHeader("allow", "POST");
+        return refuse(res, 405, "this server is stateless: POST each JSON-RPC request to /mcp");
+    }
+    const server = options.server();
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+        maxRequestBodySize: options.maxBody,
+    });
+    res.on("close", () => {
+        // Closing what this one request opened; nothing to report if either was already closed.
+        transport.close().catch(() => { });
+        server.close().catch(() => { });
+    });
+    await server.connect(transport);
+    await transport.handleRequest(req, res);
+}
+/** Starts listening; resolves once it is, with the server (its address has the port taken). */
+export async function serveHttp(options) {
+    const http = createServer((req, res) => {
+        handle(req, res, options).catch((error) => {
+            options.log?.(`sauce mcp: a request failed: ${scrub(error instanceof Error ? error.message : String(error))}\n`);
+            if (!res.headersSent)
+                refuse(res, 500, "internal error");
+            else
+                res.end();
+        });
+    });
+    await new Promise((resolve, reject) => {
+        http.once("error", reject);
+        http.listen(options.port, options.host, () => {
+            http.off("error", reject);
+            resolve();
+        });
+    });
+    return http;
+}
+/** Where a listening server answers, for the line it prints. */
+export function endpointUrl(http, host) {
+    const { port } = http.address();
+    const shown = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+    return `http://${shown}:${port}/mcp`;
+}
+//# sourceMappingURL=http.js.map

package/mcp/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAe5D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAClD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE/D,gGAAgG;AAChG,SAAS,UAAU,CAAC,KAAa,EAAE,MAAe;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAoB;IACxC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,yFAAyF;QACzF,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,OAAoB;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,2CAA2C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAChE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE/B,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,8DAA8D,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;QAC7B,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,OAAO,CAAC,OAAO;KACpC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,wFAAwF;QACxF,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAoB;IAClD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACjD,OAAO,CAAC,GAAG,EAAE,CACX,gCAAgC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAClG,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;;gBACpD,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAiB,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/E,OAAO,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC;AACvC,CAAC"}