@frontmcp/adapters 1.11.1-rc.1 → 1.11.1

package/skills/security/webhook-replay-guard.d.ts

@@ -1,5 +1,6 @@
+import { type ReplayNonceStore } from './replay-nonce-store';
 /** Why a check refused: also the `reason` label of `frontmcp_skills_replay_rejects_total`. */
-export type ReplayRejectCode = 'invalid_timestamp' | 'invalid_nonce' | 'outside_window' | 'nonce_replay';
+export type ReplayRejectCode = 'invalid_timestamp' | 'invalid_nonce' | 'outside_window' | 'nonce_replay' | 'store_unavailable';
 export interface ReplayCheckResult {
     ok: boolean;
     reason?: string;
@@ -19,8 +20,13 @@ export interface ReplayGuardTelemetry {
 export interface WebhookReplayGuardOptions {
     /** Allowed clock skew window in ms (default 300_000 = 5min). */
     windowMs?: number;
-    /** Max nonces tracked simultaneously (default 5_000). */
+    /** Max nonces the default in-memory store tracks simultaneously (default 5_000). */
     capacity?: number;
+    /**
+     * Where the accepted nonces are recorded. Default: this process's memory, which replicas and Worker isolates don't
+     * share. Give every instance that serves the server the same store.
+     */
+    store?: ReplayNonceStore;
     /**
      * Optional telemetry hook. When provided, every `check()` rejection is
      * recorded against `frontmcp_skills_replay_rejects_total` with a low-cardinality
@@ -30,8 +36,7 @@ export interface WebhookReplayGuardOptions {
 }
 export declare class WebhookReplayGuard {
     private readonly windowMs;
-    private readonly capacity;
-    private readonly seen;
+    private readonly store;
     private now;
     private readonly rejectsCounter;
     private readonly checksCounter;
@@ -39,17 +44,12 @@ export declare class WebhookReplayGuard {
     /** For tests: override the time source. */
     setNowProvider(fn: () => number): void;
     /**
-     * Check that a (timestamp, nonce) pair is fresh and unseen. Returns ok=false
-     * if the timestamp is outside the freshness window or the nonce has already
-     * been observed within that window.
+     * Check that a (timestamp, nonce) pair is fresh and unseen, and record the nonce. Returns ok=false if the timestamp
+     * is outside the freshness window, the nonce was already recorded within that window, or the store failed.
      */
     check(args: {
         timestampMs: number;
         nonce: string;
-    }): ReplayCheckResult;
-    /** Test/maintenance helper: drop expired entries proactively. */
-    prune(): number;
-    /** Inspect: number of nonces currently tracked. */
-    get size(): number;
+    }): Promise<ReplayCheckResult>;
 }
 //# sourceMappingURL=webhook-replay-guard.d.ts.map

package/skills/security/webhook-replay-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-replay-guard.d.ts","sourceRoot":"","sources":["../../../src/skills/security/webhook-replay-guard.ts"],"names":[],"mappings":"AAMA,8FAA8F;AAC9F,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,eAAe,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAEzG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AACD,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACvE;AAED,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAKD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;gBAEnD,OAAO,GAAE,yBAA8B;IAyBnD,2CAA2C;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,IAAI;IAItC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IA0DtE,iEAAiE;IACjE,KAAK,IAAI,MAAM;IAYf,mDAAmD;IACnD,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"webhook-replay-guard.d.ts","sourceRoot":"","sources":["../../../src/skills/security/webhook-replay-guard.ts"],"names":[],"mappings":"AAMA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAErF,8FAA8F;AAC9F,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,mBAAmB,CAAC;AAExB,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AACD,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACvE;AAED,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;gBAEnD,OAAO,GAAE,yBAA8B;IAwBnD,2CAA2C;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,IAAI;IAItC;;;OAGG;IACG,KAAK,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAiCtF"}

package/skills/source-options.d.ts

@@ -1,4 +1,5 @@
 import { z } from '@frontmcp/lazy-zod';
+import type { StorageConfig } from '@frontmcp/utils';
 export declare const staticSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
     type: import("@frontmcp/lazy-zod").ZodLiteral<"static">;
     path: import("@frontmcp/lazy-zod").ZodString;
@@ -17,6 +18,9 @@ export declare const saasSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
     expectedAudience: import("@frontmcp/lazy-zod").ZodString;
     pollIntervalMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
     enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requirePushBodyDigest: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    allowRollback: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    pushReplayStorage: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<StorageConfig, StorageConfig>>;
     jwksUrl: import("@frontmcp/lazy-zod").ZodString;
     expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
 }, import("zod/v4/core").$strip>;
@@ -40,6 +44,9 @@ export declare const bundleSourceSchema: import("@frontmcp/lazy-zod").ZodDiscrim
     expectedAudience: import("@frontmcp/lazy-zod").ZodString;
     pollIntervalMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
     enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requirePushBodyDigest: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    allowRollback: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    pushReplayStorage: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<StorageConfig, StorageConfig>>;
     jwksUrl: import("@frontmcp/lazy-zod").ZodString;
     expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
 }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{

package/skills/source-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAkBvC,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAiB1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;gCA2B3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;gCAS7B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;0CAK7B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAe,MAAM,iBAAiB,CAAC;AA0ClE,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAiB1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;gCA4C3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;gCAS7B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;0CAK7B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/skills/sources/index.d.ts

@@ -2,10 +2,10 @@ import type { FrontMcpLogger } from '@frontmcp/sdk';
 import type { BundleSourceOptions } from '../source-options';
 import { InlineSource } from './inline.source';
 import { NpmSource } from './npm.source';
-import { SaasPullSource, SaasPushRefusedError } from './saas-pull.source';
+import { PUSH_BODY_DIGEST_CLAIM, pushBodyDigest, SaasJwksUnavailableError, SaasPullSource, SaasPullTokenRejectedError, SaasPushRefusedError, tokenFailureOf } from './saas-pull.source';
 import type { BundleSourceDeps, SkillBundleSource } from './skill-bundle-source.interface';
 import { StaticSource } from './static.source';
-export { StaticSource, NpmSource, SaasPullSource, SaasPushRefusedError, InlineSource };
-export type { BundleCacheStore, BundlePushReceiver, BundleSourceDeps, BundleSourceListener, SkillBundleSource, } from './skill-bundle-source.interface';
+export { StaticSource, NpmSource, SaasPullSource, SaasPullTokenRejectedError, SaasJwksUnavailableError, SaasPushRefusedError, tokenFailureOf, PUSH_BODY_DIGEST_CLAIM, pushBodyDigest, InlineSource, };
+export type { BundleCacheStore, BundleOrigin, BundlePullFailureListener, BundlePushReceiver, BundleSourceDeps, BundleSourceListener, BundleTokenFailure, SkillBundleSource, } from './skill-bundle-source.interface';
 export declare function createBundleSource(source: BundleSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger, deps?: BundleSourceDeps): SkillBundleSource;
 //# sourceMappingURL=index.d.ts.map

package/skills/sources/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;AACvF,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAEzC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EAGtB,IAAI,CAAC,EAAE,gBAAgB,GACtB,iBAAiB,CAWnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,CAAC;AACF,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAEzC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EAGtB,IAAI,CAAC,EAAE,gBAAgB,GACtB,iBAAiB,CAWnB"}

package/skills/sources/saas-pull.source.d.ts

@@ -1,40 +1,63 @@
 import type { FrontMcpLogger } from '@frontmcp/sdk';
 import type { ResolvedBundle } from '../bundle/bundle.types';
 import type { SaasSourceOptions } from '../source-options';
-import type { BundlePushReceiver, BundleSourceDeps, BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+import type { BundlePullFailureListener, BundlePushReceiver, BundleSourceDeps, BundleSourceListener, BundleTokenFailure, SkillBundleSource } from './skill-bundle-source.interface';
 /**
  * The pinned pull token failed verification against `jwksUrl`, `expectedIssuer`
  * or `expectedAudience`. Unlike an outage, this never falls back to a cached
  * bundle: the configured SaaS is not the one the server was set up to trust.
  */
 export declare class SaasPullTokenRejectedError extends Error {
-    constructor(reason: string);
+    readonly tokenFailure: BundleTokenFailure;
+    constructor(reason: string, tokenFailure: BundleTokenFailure);
+}
+/** The issuer's JWKS could not be read, or holds no usable signing key: no token can be checked, an outage. */
+export declare class SaasJwksUnavailableError extends Error {
+    readonly tokenFailure = "jwks_unavailable";
+    constructor(message: string, options?: ErrorOptions);
 }
 /**
- * The token of a pushed bundle was refused: it fails the checks the pull token passes (`invalid-token`), or a push
- * already used it (`replayed`). The pushed bundle is not applied.
+ * The token of a pushed bundle was refused: it fails the checks the pull token passes (`invalid-token`), a push
+ * already used it (`replayed`), or the replay store could not record its `jti` (`replay-unchecked`). The pushed
+ * bundle is not applied.
  */
 export declare class SaasPushRefusedError extends Error {
-    readonly refusal: 'invalid-token' | 'replayed';
-    constructor(refusal: 'invalid-token' | 'replayed', reason: string);
+    readonly refusal: 'invalid-token' | 'replayed' | 'replay-unchecked';
+    /** The check that refused the token, when the issuer's checks did rather than the replay guard. */
+    readonly tokenFailure?: BundleTokenFailure | undefined;
+    constructor(refusal: 'invalid-token' | 'replayed' | 'replay-unchecked', reason: string, 
+    /** The check that refused the token, when the issuer's checks did rather than the replay guard. */
+    tokenFailure?: BundleTokenFailure | undefined);
 }
+/** The token check a pull or push failed on, from the error it threw; undefined for any other failure. */
+export declare function tokenFailureOf(error: unknown): BundleTokenFailure | undefined;
+/** The push token claim that binds it to the body it came with: {@link pushBodyDigest} of that body. */
+export declare const PUSH_BODY_DIGEST_CLAIM = "body_sha256";
+/** The `body_sha256` claim a push token carries for `body`: the base64url SHA-256 of its exact bytes, unpadded. */
+export declare function pushBodyDigest(body: string | Uint8Array): string;
 /**
  * Pulls bundles from a configured SaaS endpoint via authenticated HTTPS.
  *
  * Boot semantics:
  *   - Always attempts a fresh pull on `start()`.
- *   - If the pull fails AND a cached bundle exists on disk, falls back to it
- *     and emits a warning. This prevents a SaaS outage at boot from killing
- *     the customer's MCP server. The cache holds the last bundle the plugin
- *     applied ({@link SaasPullSource.keepBundle}): a pulled bundle that fails
- *     its signature or apply never replaces it.
+ *   - If the pull fails AND a cached bundle exists on disk, falls back to it,
+ *     emits a warning, and hands it to its listeners with why the pull failed.
+ *     This prevents a SaaS outage at boot from killing the customer's MCP
+ *     server. The cache holds the last bundle the plugin applied
+ *     ({@link SaasPullSource.keepBundle}): a pulled bundle that fails its
+ *     signature or apply never replaces it, and the plugin doesn't write back
+ *     the cached bundle it serves. While no bundle serves, the plugin reads the
+ *     cache ({@link SaasPullSource.keptBundle}), and serves it in place of a
+ *     pulled bundle that is older or refused.
  *   - If both pull and cache fail, `start()` throws. Polling still starts, so a
  *     later pull that succeeds loads the bundle.
  *
  * Refresh: poll on `pollIntervalMs`. Single-flight per source — overlapping
- * polls are skipped, never queued. With `enableWebhook` the source also takes
- * pushed bundles ({@link SaasPullSource.verifyPushToken}): the plugin serves
- * them at `POST /__skilled_openapi/push`.
+ * polls are skipped, never queued. A poll that fails is logged and reported to
+ * the {@link SaasPullSource.onPullFailure} listeners. With `enableWebhook` the
+ * source also takes pushed bundles ({@link SaasPullSource.verifyPushToken}):
+ * the plugin serves them at `POST /__skilled_openapi/push`, and a push token
+ * with a `body_sha256` claim is good only for the body it was issued for.
  *
  * Before every pull the pinned `authToken` is verified: it must be a JWT signed
  * by a key in the issuer's JWKS (`jwksUrl`), with `iss` equal to
@@ -45,7 +68,8 @@ export declare class SaasPushRefusedError extends Error {
  * other pull failure (the cache fallback still applies).
  *
  * NOTE: Bundle signature verification is applied by the bundle-sync service
- * before the bundle becomes active.
+ * before the bundle becomes active, and so is the version order: the source is
+ * {@link SaasPullSource.forwardOnly}, so a bundle older than the served one is refused.
  */
 export declare class SaasPullSource implements SkillBundleSource, BundlePushReceiver {
     private readonly options;
@@ -54,6 +78,7 @@ export declare class SaasPullSource implements SkillBundleSource, BundlePushRece
     private readonly deps;
     readonly id: string;
     private listeners;
+    private pullFailureListeners;
     private pollHandle;
     /** The pull running now, from start, a poll or a refresh; only one runs at a time. */
     private inFlightPull;
@@ -62,22 +87,35 @@ export declare class SaasPullSource implements SkillBundleSource, BundlePushRece
     private readonly replayGuard?;
     private pushSigningKeys?;
     private pushSigningKeysLoading?;
+    private warnedOfUnboundPushToken;
     constructor(options: SaasSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger, deps?: BundleSourceDeps);
+    /** The store an injected `pushReplayStore` or the `pushReplayStorage` option names; none keeps the jtis in memory. */
+    private pushReplayStore;
     /** This source, when `enableWebhook` is on: it then takes bundles pushed to the server. */
     get push(): BundlePushReceiver | undefined;
+    /** A pulled or pushed bundle older than the one being served is not applied, unless `allowRollback` is on. */
+    get forwardOnly(): boolean;
     /**
      * Check the token of a pushed bundle: by the rules the pull token passes (a key in `jwksUrl`, `iss`, `aud`,
-     * `resource`, expiry), then by the replay guard, so its `iat` must be within five minutes and its `jti` unused.
-     * Throws {@link SaasPushRefusedError}, or a plain Error when the JWKS can't be read.
+     * `resource`, expiry), then against `body`, the exact bytes of the request body ({@link PUSH_BODY_DIGEST_CLAIM}),
+     * then by the replay guard, so its `iat` must be within five minutes and its `jti` unused by every instance sharing
+     * the replay store. A token refused for its body leaves its `jti` unused. Throws {@link SaasPushRefusedError}, or
+     * {@link SaasJwksUnavailableError} when the JWKS can't be read.
      */
-    verifyPushToken(token: string): Promise<void>;
+    verifyPushToken(token: string, body: Uint8Array): Promise<void>;
+    /** Refuse a push whose body isn't the one its token was issued for, or, with `requirePushBodyDigest`, unbound. */
+    private checkPushBody;
     /** Keep a bundle the plugin applied, pulled or pushed, as the last good one a start falls back to. */
     keepBundle(bundle: ResolvedBundle): Promise<void>;
+    /** The last good bundle {@link keepBundle} kept, schema-checked as a pull is; undefined when there is none. */
+    keptBundle(): Promise<ResolvedBundle | undefined>;
     start(): Promise<void>;
     private pullAtStart;
     /** Run `pull` as the one pull in flight, so a start, a poll and a refresh never pull at once. */
     private exclusivePull;
     onChange(listener: BundleSourceListener): () => void;
+    /** Subscribe to the polls that fail, with why; a failed start or refresh throws to its caller instead. */
+    onPullFailure(listener: BundlePullFailureListener): () => void;
     stop(): Promise<void>;
     private schedulePoll;
     /**
@@ -96,9 +134,9 @@ export declare class SaasPullSource implements SkillBundleSource, BundlePushRece
         body: string;
     }>;
     /**
-     * Verify the pinned pull token against the issuer's JWKS, issuer and audience.
-     * Throws {@link SaasPullTokenRejectedError} when the token is refused, and a
-     * plain Error when the JWKS can't be fetched (an outage).
+     * Verify the pinned pull token against the issuer's JWKS, issuer and audience, and log the check it fails on.
+     * Throws {@link SaasPullTokenRejectedError} when the token is refused, and {@link SaasJwksUnavailableError} when
+     * the JWKS can't be fetched (an outage).
      */
     private verifyPullToken;
     /**
@@ -116,5 +154,6 @@ export declare class SaasPullSource implements SkillBundleSource, BundlePushRece
     private persistCache;
     private loadCache;
     private notify;
+    private notifyPullFailure;
 }
 //# sourceMappingURL=saas-pull.source.d.ts.map

package/skills/sources/saas-pull.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AASzC;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,MAAM,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU;gBAArC,OAAO,EAAE,eAAe,GAAG,UAAU,EAC9C,MAAM,EAAE,MAAM;CAKjB;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,cAAe,YAAW,iBAAiB,EAAE,kBAAkB;IAcxE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,sFAAsF;IACtF,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,eAAe,CAAC,CAAyC;IACjE,OAAO,CAAC,sBAAsB,CAAC,CAAqB;gBAGjC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAM9C,2FAA2F;IAC3F,IAAI,IAAI,IAAI,kBAAkB,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBnD,sGAAsG;IACtG,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAcd,WAAW;IAsBzB,iGAAiG;IACjG,OAAO,CAAC,aAAa;IAQrB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;IAcpB;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cAwBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;IAK7B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAcZ,gBAAgB;IA0B9B,8EAA8E;YAChE,iBAAiB;YAuBjB,SAAS;IAkBvB,4GAA4G;IAC5G,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;YAkBT,MAAM;CASrB"}
+{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAWpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAEV,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AASzC;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IAGjD,QAAQ,CAAC,YAAY,EAAE,kBAAkB;gBADzC,MAAM,EAAE,MAAM,EACL,YAAY,EAAE,kBAAkB;CAK5C;AAED,+GAA+G;AAC/G,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,YAAY,sBAAsB;gBAE/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU,GAAG,kBAAkB;IAEnE,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAHjC,OAAO,EAAE,eAAe,GAAG,UAAU,GAAG,kBAAkB,EACnE,MAAM,EAAE,MAAM;IACd,mGAAmG;IAC1F,YAAY,CAAC,EAAE,kBAAkB,YAAA;CAK7C;AAED,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAM7E;AAMD,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,mHAAmH;AACnH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAEhE;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,cAAe,YAAW,iBAAiB,EAAE,kBAAkB;IAgBxE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,oBAAoB,CAAwC;IACpE,OAAO,CAAC,UAAU,CAA6B;IAC/C,sFAAsF;IACtF,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,eAAe,CAAC,CAAyC;IACjE,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IACpD,OAAO,CAAC,wBAAwB,CAAS;gBAGtB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAM9C,sHAAsH;IACtH,OAAO,CAAC,eAAe;IAOvB,2FAA2F;IAC3F,IAAI,IAAI,IAAI,kBAAkB,GAAG,SAAS,CAEzC;IAED,8GAA8G;IAC9G,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBrE,kHAAkH;IAClH,OAAO,CAAC,aAAa;IA0BrB,sGAAsG;IACtG,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,+GAA+G;IAC/G,UAAU,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAcd,WAAW;IAwBzB,iGAAiG;IACjG,OAAO,CAAC,aAAa;IAQrB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAOpD,0GAA0G;IAC1G,aAAa,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,IAAI;IAOxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B,OAAO,CAAC,YAAY;IAcpB;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cA0BN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;IAW7B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAcZ,gBAAgB;IA+B9B,8EAA8E;YAChE,iBAAiB;YAgCjB,SAAS;IAkBvB,4GAA4G;IAC5G,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;YAkBT,MAAM;IAUpB,OAAO,CAAC,iBAAiB;CAS1B"}

package/skills/sources/skill-bundle-source.interface.d.ts

@@ -1,4 +1,6 @@
+import type { TokenVerifyFailure } from '@frontmcp/auth';
 import type { ResolvedBundle } from '../bundle/bundle.types';
+import type { ReplayNonceStore } from '../security/replay-nonce-store';
 /**
  * Pluggable source of skill bundles. Static, npm-installed, and SaaS-pull
  * implementations all conform to this interface.
@@ -32,6 +34,11 @@ export interface SkillBundleSource {
      * notification fires on or shortly after `start()` resolves.
      */
     onChange(listener: BundleSourceListener): () => void;
+    /**
+     * Subscribe to the pulls that fail in the background (a poll), which no caller sees: `start()` and `refresh()` throw
+     * theirs. Returns an unsubscribe function. Present on a polling source: the `saas` source.
+     */
+    onPullFailure?(listener: BundlePullFailureListener): () => void;
     /**
      * Pull a fresh bundle on demand and notify listeners — the manual,
      * externally-driven counterpart to background polling. Optional: only
@@ -48,18 +55,49 @@ export interface SkillBundleSource {
      * a source with a last-good cache: the `saas` source.
      */
     keepBundle?(bundle: ResolvedBundle): Promise<void>;
+    /**
+     * The last good bundle {@link keepBundle} kept, read back from the cache; undefined when none is kept or it can't be
+     * read. While no bundle serves, the plugin compares a new bundle with it, and serves it in place of one it refuses.
+     */
+    keptBundle?(): Promise<ResolvedBundle | undefined>;
     /** Present on a source that takes pushed bundles: the `saas` source with `enableWebhook`. */
     readonly push?: BundlePushReceiver;
+    /**
+     * True on a source whose bundles only move forward: the `saas` source, unless `allowRollback`. The plugin then
+     * refuses a bundle older than the one being served, as `compareBundleVersions` orders them.
+     */
+    readonly forwardOnly?: boolean;
     /** Halt background work; idempotent. */
     stop(): Promise<void>;
 }
 /** The check a pushed bundle's token passes before the bundle is applied. */
 export interface BundlePushReceiver {
-    /** Resolves when the push token is accepted; throws when it is refused or can't be checked. */
-    verifyPushToken(token: string): Promise<void>;
+    /**
+     * Resolves when the push token is accepted for `body`, the exact bytes of the request body; throws when it is
+     * refused or can't be checked.
+     */
+    verifyPushToken(token: string, body: Uint8Array): Promise<void>;
 }
 /** Takes each new bundle; a pulling source waits for a promise it returns before its pull counts as done. */
-export type BundleSourceListener = (bundle: ResolvedBundle) => unknown;
+export type BundleSourceListener = (bundle: ResolvedBundle, origin?: BundleOrigin) => unknown;
+/** How a source came by a bundle it hands its listeners. */
+export interface BundleOrigin {
+    /**
+     * Set when the pull failed and the bundle is the last good one the source kept, served in its place: why it failed.
+     * The plugin doesn't keep such a bundle again, since the cache holds it.
+     */
+    pullFailure?: string;
+    /** Set when that pull failed on its token: the check that refused it, or `jwks_unavailable`. */
+    tokenFailure?: BundleTokenFailure;
+}
+/**
+ * Which check refused a pull or push token, or `jwks_unavailable` when the issuer's keys could not be read to check
+ * it; `body_mismatch` is a push token issued for another body. For the server's logs and `/readyz`: a caller learns
+ * only that its token was refused.
+ */
+export type BundleTokenFailure = TokenVerifyFailure | 'wrong_audience' | 'body_mismatch';
+/** Takes the reason a background pull failed, and the token check it failed on, if any. */
+export type BundlePullFailureListener = (reason: string, tokenFailure?: BundleTokenFailure) => void;
 /**
  * Pluggable last-good bundle cache. The default (Node) implementation writes to
  * disk; V8-isolate runtimes (Cloudflare Workers) inject a KV-backed store
@@ -76,7 +114,9 @@ export interface BundleCacheStore {
  *   - `cache` replaces the on-disk last-good cache (no filesystem on a Worker),
  *   - `disablePolling` turns off the internal `setInterval` loop (no background
  *     execution on a Worker; a Cron Trigger / DO alarm drives {@link
- *     SkillBundleSource.refresh} instead).
+ *     SkillBundleSource.refresh} instead),
+ *   - `pushReplayStore` records the pushed tokens' `jti`s where every instance
+ *     reaches them (a Durable Object on a Worker).
  */
 export interface BundleSourceDeps {
     /**
@@ -90,5 +130,10 @@ export interface BundleSourceDeps {
      * {@link SkillBundleSource.refresh} instead.
      */
     disablePolling?: boolean;
+    /**
+     * Where the push replay guard records the `jti`s it accepted, shared by every instance that serves the server.
+     * Replaces the `saas` source's `pushReplayStorage` option and its in-memory default.
+     */
+    pushReplayStore?: ReplayNonceStore;
 }
 //# sourceMappingURL=skill-bundle-source.interface.d.ts.map

package/skills/sources/skill-bundle-source.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-bundle-source.interface.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/skill-bundle-source.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAErD;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEhD;;;OAGG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAEnC,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,6GAA6G;AAC7G,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"skill-bundle-source.interface.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/skill-bundle-source.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAErD;;;OAGG;IACH,aAAa,CAAC,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,IAAI,CAAC;IAEhE;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEhD;;;OAGG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;OAGG;IACH,UAAU,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEnD,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,6GAA6G;AAC7G,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC;AAE9F,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEzF,2FAA2F;AAC3F,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAEpG;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC"}