@ggui-ai/mcp-server 0.24.0 → 0.25.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/build-mcp.d.ts.map +1 -1
- package/dist/build-mcp.js +50 -8
- package/dist/control-service.d.ts.map +1 -1
- package/dist/control-service.js +0 -3
- package/dist/ggui-session-channel/subscribe.d.ts +11 -36
- package/dist/ggui-session-channel/subscribe.d.ts.map +1 -1
- package/dist/ggui-session-channel/subscribe.js +41 -0
- package/dist/ggui-session-channel.d.ts +31 -3
- package/dist/ggui-session-channel.d.ts.map +1 -1
- package/dist/ggui-session-channel.js +5 -0
- package/dist/llm-backed-negotiator.d.ts +3 -1
- package/dist/llm-backed-negotiator.d.ts.map +1 -1
- package/dist/llm-backed-negotiator.js +28 -14
- package/dist/mcp-apps-outbound.d.ts +1 -1
- package/dist/mcp-apps-outbound.d.ts.map +1 -1
- package/dist/mcp-apps-outbound.js +56 -13
- package/dist/mcp-endpoint-routes.d.ts +1 -0
- package/dist/mcp-endpoint-routes.d.ts.map +1 -1
- package/dist/mcp-endpoint-routes.js +34 -3
- package/dist/runtime-bundle-hash.d.ts +7 -0
- package/dist/runtime-bundle-hash.d.ts.map +1 -1
- package/dist/runtime-bundle-hash.js +8 -2
- package/dist/runtime-bundle-route.d.ts.map +1 -1
- package/dist/runtime-bundle-route.js +15 -0
- package/dist/server.d.ts +35 -52
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +46 -65
- package/package.json +13 -13
- package/dist/render-read-gate.d.ts +0 -50
- package/dist/render-read-gate.d.ts.map +0 -1
- package/dist/render-read-gate.js +0 -36
package/dist/build-mcp.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;
|
|
1
|
+
{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAwOD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAmRX"}
|
package/dist/build-mcp.js
CHANGED
|
@@ -100,8 +100,10 @@ function classifyFailurePayload(payload) {
|
|
|
100
100
|
};
|
|
101
101
|
}
|
|
102
102
|
/**
|
|
103
|
-
* Per-session fields on the `tool_invoked` line of the
|
|
104
|
-
* runtime tools (ggui#1377 for pull; ggui#1395 for consume and
|
|
103
|
+
* Per-session fields on the `tool_invoked` line of the session-keyed tools:
|
|
104
|
+
* the three runtime tools (ggui#1377 for pull; ggui#1395 for consume and
|
|
105
|
+
* submit) and the mutation and render tools (ggui#1474 — amend, update,
|
|
106
|
+
* render), so an instrument joins a reaction to its tap by session.
|
|
105
107
|
*
|
|
106
108
|
* In a composition that wires no logger into these handlers, this line is
|
|
107
109
|
* their whole trace. ggui#1376 had to be read per app and minute; these
|
|
@@ -111,7 +113,7 @@ function classifyFailurePayload(payload) {
|
|
|
111
113
|
* never a spread.
|
|
112
114
|
*
|
|
113
115
|
* What a `sessionId` on a SUCCESS line proves, per tool — never raw caller
|
|
114
|
-
* input in any of
|
|
116
|
+
* input in any of them:
|
|
115
117
|
* - pull and consume: a session the caller's app owns. Both throw on an
|
|
116
118
|
* unknown or cross-app session before they return (the visibility gate),
|
|
117
119
|
* so every success line of theirs qualifies.
|
|
@@ -122,6 +124,23 @@ function classifyFailurePayload(payload) {
|
|
|
122
124
|
* so the claim stops there. An audit kind (`openLink`,
|
|
123
125
|
* `requestDisplayMode`, an extension kind) touches no pipe and carries no
|
|
124
126
|
* session at all: its `sessionId` was never read by anything.
|
|
127
|
+
* - amend and update: a session the caller's app owns, read from the
|
|
128
|
+
* OUTPUT. Both run the shared mutation core, which app-scope-gates the
|
|
129
|
+
* session (`renderStore.get` + an `appId` match) and throws
|
|
130
|
+
* `GguiSessionNotFoundError` on a missing or cross-app one before any
|
|
131
|
+
* return — so the output's `sessionId` is the gated one, including when
|
|
132
|
+
* an in-process caller threads it through the context rather than the
|
|
133
|
+
* input.
|
|
134
|
+
* - render: the session id this call MINTED for the caller's app, read
|
|
135
|
+
* from the OUTPUT (never caller input — render's input names no
|
|
136
|
+
* session). A `rendered` result carries it, and so does a `failed` one
|
|
137
|
+
* (on the in-result failure line); a `refused` result mints none. It
|
|
138
|
+
* proves the id is this call's, NOT that a row backs it: the handler
|
|
139
|
+
* swallows a render-store commit rejection (the placeholder, probe,
|
|
140
|
+
* cache-hit and error-record commits, and the cold-generation success
|
|
141
|
+
* commit, which then answers `failed`), so on those paths the id names
|
|
142
|
+
* no row, or only a provisional placeholder — the claim stops there,
|
|
143
|
+
* and a consumer that needs the row reads it from the store.
|
|
125
144
|
*
|
|
126
145
|
* Consume adds `eventCount`, `status`, `timeoutS` (the requested timeout; 0
|
|
127
146
|
* when omitted, the handler's own default) and `aborted: true` when the
|
|
@@ -133,12 +152,17 @@ const SESSION_TOOLS = new Set([
|
|
|
133
152
|
'ggui_runtime_pull',
|
|
134
153
|
'ggui_consume',
|
|
135
154
|
'ggui_runtime_submit_action',
|
|
155
|
+
'ggui_amend',
|
|
156
|
+
'ggui_update',
|
|
157
|
+
'ggui_render',
|
|
136
158
|
]);
|
|
159
|
+
/** ggui#1474 — session tools whose logged session is the OUTPUT's (the gated or committed one), not the input's. */
|
|
160
|
+
const OUTPUT_SESSION_TOOLS = new Set(['ggui_amend', 'ggui_update', 'ggui_render']);
|
|
137
161
|
function sessionFields(tool, input, output, ctx) {
|
|
138
162
|
if (!SESSION_TOOLS.has(tool))
|
|
139
163
|
return {};
|
|
140
|
-
const sessionId = input['sessionId'];
|
|
141
|
-
if (typeof sessionId !== 'string')
|
|
164
|
+
const sessionId = OUTPUT_SESSION_TOOLS.has(tool) ? output['sessionId'] : input['sessionId'];
|
|
165
|
+
if (typeof sessionId !== 'string' || sessionId === '')
|
|
142
166
|
return {};
|
|
143
167
|
if (tool === 'ggui_runtime_submit_action') {
|
|
144
168
|
if (input['kind'] !== 'dispatch')
|
|
@@ -168,8 +192,10 @@ function sessionFields(tool, input, output, ctx) {
|
|
|
168
192
|
/** Bound on `claimedSessionId`: a real id is a UUID; anything longer is not one. */
|
|
169
193
|
const CLAIMED_SESSION_ID_MAX_CHARS = 128;
|
|
170
194
|
/**
|
|
171
|
-
* The caller's CLAIMED session on an `outcome: 'error'` line of the
|
|
172
|
-
*
|
|
195
|
+
* The caller's CLAIMED session on an `outcome: 'error'` line of the session
|
|
196
|
+
* tools (ggui#1395; amend and update since ggui#1474). Render's input schema
|
|
197
|
+
* declares no `sessionId` and the MCP SDK strips undeclared keys before the
|
|
198
|
+
* handler runs, so a render line never carries a claim. A refused consume — unknown or cross-app
|
|
173
199
|
* session, the visibility gate — is the one failure of the tap → consume
|
|
174
200
|
* chain that is otherwise invisible per session. It is raw caller input,
|
|
175
201
|
* the first on this line: named as a claim so it never reads as an owned
|
|
@@ -212,7 +238,7 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
|
|
|
212
238
|
// Thread the same per-request context accessor + logger the tool
|
|
213
239
|
// path uses (`getContext`, param 3 of `buildMcpServer`) so the
|
|
214
240
|
// per-session resource handler's render-read gate sees the
|
|
215
|
-
// caller (
|
|
241
|
+
// caller (`renderReadAllowed`, @ggui-ai/mcp-server-handlers/renders).
|
|
216
242
|
...(opts.selfContained !== undefined
|
|
217
243
|
? { selfContained: { ...opts.selfContained, getContext, logger } }
|
|
218
244
|
: {}),
|
|
@@ -343,9 +369,25 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
|
|
|
343
369
|
const gestureHint = nextStepHint !== undefined && nextStepHint.includes('ggui_consume')
|
|
344
370
|
? nextStepHint
|
|
345
371
|
: undefined;
|
|
372
|
+
// The consume → amend hint (ggui#1399 step 2) gets the same
|
|
373
|
+
// plain-text lead, in its own words: the agent that drained a
|
|
374
|
+
// gesture repaints THIS card rather than rendering a new one
|
|
375
|
+
// (the replacement-instead-of-amend pattern ggui#1376 read on
|
|
376
|
+
// prod). Gentle and bounded like the poll wording above.
|
|
377
|
+
const amendHint = nextStepHint !== undefined && nextStepHint.includes('ggui_amend(')
|
|
378
|
+
? nextStepHint
|
|
379
|
+
: undefined;
|
|
346
380
|
return {
|
|
347
381
|
structuredContent: validated,
|
|
348
382
|
content: [
|
|
383
|
+
...(amendHint !== undefined
|
|
384
|
+
? [
|
|
385
|
+
{
|
|
386
|
+
type: 'text',
|
|
387
|
+
text: `You drained a gesture. If it changed what the user is looking at, repaint the SAME card in place with ${amendHint} — do not render a new one — then re-call ggui_consume for the next gesture.`,
|
|
388
|
+
},
|
|
389
|
+
]
|
|
390
|
+
: []),
|
|
349
391
|
...(gestureHint !== undefined
|
|
350
392
|
? [
|
|
351
393
|
{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,
|
|
1
|
+
{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAc9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC/G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC9G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EACjH,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAkCzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAwBjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C"}
|
package/dist/control-service.js
CHANGED
|
@@ -105,15 +105,12 @@ export function filterHandlersByAudience(set, allowed) {
|
|
|
105
105
|
export const SINGLE_CALL_OPS = new Set([
|
|
106
106
|
"ggui_ops_get_credit_balance",
|
|
107
107
|
"ggui_ops_get_my_blueprint_source",
|
|
108
|
-
"ggui_ops_get_org_balance",
|
|
109
108
|
"ggui_ops_get_render_source",
|
|
110
109
|
"ggui_ops_list_apps",
|
|
111
110
|
"ggui_ops_list_blueprints",
|
|
112
|
-
"ggui_ops_list_connector_keys",
|
|
113
111
|
"ggui_ops_list_credit_transactions",
|
|
114
112
|
"ggui_ops_list_my_apps",
|
|
115
113
|
"ggui_ops_list_my_blueprints",
|
|
116
|
-
"ggui_ops_list_orgs",
|
|
117
114
|
"ggui_ops_list_provider_keys",
|
|
118
115
|
"ggui_ops_list_themes",
|
|
119
116
|
"ggui_ops_list_recent_renders",
|
|
@@ -44,8 +44,9 @@ import type { SubscriberLifecycle } from "./subscriber-lifecycle.js";
|
|
|
44
44
|
* G14 (2026-05-23): bootstrap envelopes are no longer single-use. A
|
|
45
45
|
* signature-valid + unexpired token authenticates EVERY subscribe
|
|
46
46
|
* within the TTL window; transient WS drops reconnect without a fresh
|
|
47
|
-
* handshake. Past expiry, the
|
|
48
|
-
*
|
|
47
|
+
* handshake. Past expiry, the view refreshes through
|
|
48
|
+
* `ggui_runtime_refresh_ws_token`, which re-mints only for a caller
|
|
49
|
+
* admitted to the session (ggui#1496 part B).
|
|
49
50
|
*/
|
|
50
51
|
export type GguiSessionChannelBootstrapVerifyResult = {
|
|
51
52
|
readonly ok: true;
|
|
@@ -55,30 +56,15 @@ export type GguiSessionChannelBootstrapVerifyResult = {
|
|
|
55
56
|
readonly ok: false;
|
|
56
57
|
readonly reason: "expired" | "invalid";
|
|
57
58
|
};
|
|
58
|
-
/**
|
|
59
|
-
* Result of {@link GguiSessionChannelBootstrap.refresh}.
|
|
60
|
-
*
|
|
61
|
-
* - `ok: true`: caller swaps the old envelope for `token` and resumes.
|
|
62
|
-
* - `ok: false`: caller MUST re-handshake (refresh window closed,
|
|
63
|
-
* tampered envelope, etc.).
|
|
64
|
-
*/
|
|
65
|
-
export type GguiSessionChannelBootstrapRefreshResult = {
|
|
66
|
-
readonly ok: true;
|
|
67
|
-
readonly token: string;
|
|
68
|
-
readonly expiresAt: string;
|
|
69
|
-
} | {
|
|
70
|
-
readonly ok: false;
|
|
71
|
-
readonly reason: "window_closed" | "invalid";
|
|
72
|
-
};
|
|
73
59
|
export interface GguiSessionChannelBootstrap {
|
|
74
60
|
/**
|
|
75
61
|
* Verify a `SubscribePayload.wsToken` token.
|
|
76
62
|
*
|
|
77
63
|
* Returns the bound identity on success, or a discriminated failure.
|
|
78
|
-
* The channel server maps `'expired'` to `BOOTSTRAP_EXPIRED`
|
|
79
|
-
*
|
|
80
|
-
* `BOOTSTRAP_INVALID` for tamper
|
|
81
|
-
*
|
|
64
|
+
* The channel server maps `'expired'` to `BOOTSTRAP_EXPIRED` (the view
|
|
65
|
+
* then refreshes through `ggui_runtime_refresh_ws_token`, an authorized
|
|
66
|
+
* re-mint), and `'invalid'` to `BOOTSTRAP_INVALID` for tamper, format or
|
|
67
|
+
* kind failures.
|
|
82
68
|
*/
|
|
83
69
|
verify(token: string): GguiSessionChannelBootstrapVerifyResult;
|
|
84
70
|
/**
|
|
@@ -87,21 +73,6 @@ export interface GguiSessionChannelBootstrap {
|
|
|
87
73
|
* `verify()` on a bootstrap subscribe.
|
|
88
74
|
*/
|
|
89
75
|
issueSessionToken(sessionId: string, appId: string): string;
|
|
90
|
-
/**
|
|
91
|
-
* Refresh a (possibly-expired-but-signature-valid) bootstrap envelope
|
|
92
|
-
* into a new envelope with a fresh TTL. Used by the
|
|
93
|
-
* `ggui_runtime_refresh_ws_token` MCP tool — iframes that see their
|
|
94
|
-
* bootstrap drift out of the TTL window swap in the refreshed
|
|
95
|
-
* envelope without going back through `ggui_render`.
|
|
96
|
-
*
|
|
97
|
-
* Stateless: verifies HMAC against the same secret used at mint,
|
|
98
|
-
* checks the refresh window against the ORIGINAL `iat`, and mints
|
|
99
|
-
* a fresh bootstrap envelope bound to the SAME `(sessionId, appId)`.
|
|
100
|
-
* Past the refresh window the result is `{ok:false, reason:
|
|
101
|
-
* 'window_closed'}`; tampered envelopes are `{ok:false, reason:
|
|
102
|
-
* 'invalid'}`.
|
|
103
|
-
*/
|
|
104
|
-
refresh(token: string): GguiSessionChannelBootstrapRefreshResult;
|
|
105
76
|
}
|
|
106
77
|
/**
|
|
107
78
|
* Cookie-based authentication for the live-channel upgrade. Used
|
|
@@ -140,6 +111,10 @@ export interface SubscribeDeps {
|
|
|
140
111
|
readonly cookieAuth?: GguiSessionChannelCookieAuth;
|
|
141
112
|
/** Identity → appId mapping — see `GguiSessionChannelOptions.appIdFromIdentity`. */
|
|
142
113
|
readonly appIdFromIdentity?: (result: AuthResult) => string;
|
|
114
|
+
/** Per-app authorization for a declared appId — see `GguiSessionChannelOptions.authorizeApp`. */
|
|
115
|
+
readonly authorizeApp?: (appId: string, identity: AuthResult) => Promise<void>;
|
|
116
|
+
/** Sources authorized on every subscribe — see `GguiSessionChannelOptions.perAppOnlySources`. */
|
|
117
|
+
readonly perAppOnlySources?: readonly AuthResult["source"][];
|
|
143
118
|
/** Version-handshake policy — see `GguiSessionChannelOptions.versionPolicy`. */
|
|
144
119
|
readonly versionPolicy?: "advisory" | "reject";
|
|
145
120
|
readonly sendError: Outbound["sendError"];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH
|
|
1
|
+
{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;IAC/D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7D;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,iGAAiG;IACjG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,iGAAiG;IACjG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAkBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA6jB9E"}
|
|
@@ -230,6 +230,47 @@ export function createSubscribeHandlers(deps) {
|
|
|
230
230
|
appId: bound.appId,
|
|
231
231
|
});
|
|
232
232
|
}
|
|
233
|
+
// A DECLARED app on the bearer path is a claim, not a binding
|
|
234
|
+
// (ggui#1480, SPEC §12.2). The wsToken and console-cookie paths
|
|
235
|
+
// above already refuse a declared appId their credential does not
|
|
236
|
+
// bind; the bearer path proves only an identity. When the declared
|
|
237
|
+
// app is not that identity's own, it MUST pass the deployment's
|
|
238
|
+
// per-app authorization — the same check the `/mcp` endpoint runs
|
|
239
|
+
// on a URL-addressed app — before it decides the app-scope gate or
|
|
240
|
+
// names a provisioned row's app below. Refused before any store
|
|
241
|
+
// read, with one fixed answer whatever the reason, so the refusal
|
|
242
|
+
// says nothing about whether the app or the session exists. A
|
|
243
|
+
// deployment that wires no authorization keeps today's posture,
|
|
244
|
+
// as the `/mcp` endpoint does for per-app routing without one.
|
|
245
|
+
//
|
|
246
|
+
// A credential whose source the deployment lists as per-app-only
|
|
247
|
+
// (ggui#1482) passes the same authorization on EVERY subscribe, its
|
|
248
|
+
// identity-default app included — omitting `appId`, or declaring
|
|
249
|
+
// the identity's own, must not skip the checks that authorization
|
|
250
|
+
// runs. The channel refuses to construct with such a list and no
|
|
251
|
+
// authorization, so this arm can never fail open.
|
|
252
|
+
if (tokenBoundAppId === undefined && cookieBound === undefined && deps.authorizeApp) {
|
|
253
|
+
const identityAppId = (deps.appIdFromIdentity ?? defaultAppIdFromIdentity)(effectiveIdentity);
|
|
254
|
+
const appToAuthorize = payload.appId ?? identityAppId;
|
|
255
|
+
const perAppOnly = deps.perAppOnlySources?.includes(effectiveIdentity.source) === true;
|
|
256
|
+
if (perAppOnly || appToAuthorize !== identityAppId) {
|
|
257
|
+
try {
|
|
258
|
+
await deps.authorizeApp(appToAuthorize, effectiveIdentity);
|
|
259
|
+
}
|
|
260
|
+
catch (err) {
|
|
261
|
+
deps.logger.warn("render_channel_app_refused", {
|
|
262
|
+
sessionId: payload.sessionId,
|
|
263
|
+
appId: appToAuthorize,
|
|
264
|
+
declared: payload.appId !== undefined,
|
|
265
|
+
identityAppId,
|
|
266
|
+
source: effectiveIdentity.source,
|
|
267
|
+
reason: err instanceof Error ? err.message : String(err),
|
|
268
|
+
});
|
|
269
|
+
deps.sendError(ws, "APP_MISMATCH", "This credential may not act on the app this subscribe resolves", message.requestId);
|
|
270
|
+
return;
|
|
271
|
+
}
|
|
272
|
+
}
|
|
273
|
+
}
|
|
233
274
|
// Identity-default appId resolution (SPEC §12.2): `payload.appId`
|
|
234
275
|
// is optional on the wire. Absent ⇒ resolve it from the
|
|
235
276
|
// connection's authenticated identity BEFORE any store work —
|
|
@@ -112,7 +112,7 @@ export declare const DEFAULT_PRE_SUBSCRIBE_IDLE_MS = 30000;
|
|
|
112
112
|
*/
|
|
113
113
|
export declare const DEFAULT_MAX_PRE_SUBSCRIBE_CONNECTIONS = 1024;
|
|
114
114
|
export type { GguiSessionChannelLocalToolsOptions } from "./ggui-session-channel/channel-subscriptions.js";
|
|
115
|
-
export type { GguiSessionChannelBootstrap,
|
|
115
|
+
export type { GguiSessionChannelBootstrap, GguiSessionChannelBootstrapVerifyResult, GguiSessionChannelCookieAuth, } from "./ggui-session-channel/subscribe.js";
|
|
116
116
|
export type { SubscriberSink } from "./ggui-session-channel/internal-types.js";
|
|
117
117
|
/**
|
|
118
118
|
* Thrown by {@link GguiSessionChannelServer.attachExternalSubscriber}
|
|
@@ -160,12 +160,40 @@ export interface GguiSessionChannelOptions {
|
|
|
160
160
|
readonly auth: AuthAdapter;
|
|
161
161
|
/**
|
|
162
162
|
* Maps resolved identity → the appId for subscribes that omit
|
|
163
|
-
* `payload.appId` (SPEC §12.2 identity-default resolution)
|
|
164
|
-
*
|
|
163
|
+
* `payload.appId` (SPEC §12.2 identity-default resolution), and on
|
|
164
|
+
* the bearer path decides whether a DECLARED appId is the identity's
|
|
165
|
+
* own or must pass {@link authorizeApp}. Defaults to
|
|
166
|
+
* `defaultAppIdFromIdentity` — same mapping the `/mcp` endpoint
|
|
165
167
|
* uses. Token-bound subscribes (wsToken / console cookie) never
|
|
166
168
|
* consult this seam: their credential already binds the appId.
|
|
167
169
|
*/
|
|
168
170
|
readonly appIdFromIdentity?: (result: AuthResult) => string;
|
|
171
|
+
/**
|
|
172
|
+
* Per-app authorization on the bearer path (SPEC §12.2). The channel
|
|
173
|
+
* awaits this with the subscribe's app and the identity before any
|
|
174
|
+
* store work — when the subscribe DECLARES an app other than the one
|
|
175
|
+
* `appIdFromIdentity` resolves (ggui#1480), and on EVERY subscribe
|
|
176
|
+
* from a {@link perAppOnlySources} credential, its identity-default
|
|
177
|
+
* app included (ggui#1482). A throw refuses with `APP_MISMATCH`.
|
|
178
|
+
* Wire the same check the `/mcp` endpoint runs on a URL-addressed
|
|
179
|
+
* app (`createGguiServer` threads `perAppRouting.authorize`). Absent
|
|
180
|
+
* → a declared appId is trusted, as the `/mcp` endpoint trusts a URL
|
|
181
|
+
* appId under per-app routing without an authorize callback.
|
|
182
|
+
* Credential-bound subscribes (wsToken / console cookie) never
|
|
183
|
+
* consult it: their credential already binds the app.
|
|
184
|
+
*/
|
|
185
|
+
readonly authorizeApp?: (appId: string, identity: AuthResult) => Promise<void>;
|
|
186
|
+
/**
|
|
187
|
+
* Credential sources that are valid only for their own app (ggui#1482).
|
|
188
|
+
* A bearer subscribe whose identity came from a listed source is sent
|
|
189
|
+
* to {@link authorizeApp} on EVERY subscribe — the identity-default
|
|
190
|
+
* app included, whether `payload.appId` is omitted or names it — so
|
|
191
|
+
* the checks that authorization runs cannot be skipped. Listing a
|
|
192
|
+
* source without an `authorizeApp` throws at construction: the list
|
|
193
|
+
* says these credentials must be authorized, so the channel never
|
|
194
|
+
* serves with nothing to authorize them.
|
|
195
|
+
*/
|
|
196
|
+
readonly perAppOnlySources?: readonly AuthResult["source"][];
|
|
169
197
|
/** Structured logger. */
|
|
170
198
|
readonly logger: Logger;
|
|
171
199
|
/** URL path to mount on. Defaults to `/ws`. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ggui-session-channel.d.ts","sourceRoot":"","sources":["../src/ggui-session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAEV,cAAc,EAGf,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAC;AACtD;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,QAAS,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,YAAY,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAK3G,YAAY,EACV,2BAA2B,EAC3B,
|
|
1
|
+
{"version":3,"file":"ggui-session-channel.d.ts","sourceRoot":"","sources":["../src/ggui-session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAEV,cAAc,EAGf,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAC;AACtD;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,QAAS,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,YAAY,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAK3G,YAAY,EACV,2BAA2B,EAC3B,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,qCAAqC,CAAC;AAM7C,YAAY,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,SAAS,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,mCAAmC,CAAC;IACzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,CAAC,IAAI,EAAE;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,yBAAyB,GAC9B,wBAAwB,CA0Q1B"}
|
|
@@ -129,6 +129,9 @@ export class ChannelSessionNotFoundError extends Error {
|
|
|
129
129
|
* composed into `createGguiServer` — see `server.ts` for the wire-up.
|
|
130
130
|
*/
|
|
131
131
|
export function createGguiSessionChannelServer(opts) {
|
|
132
|
+
if ((opts.perAppOnlySources?.length ?? 0) > 0 && opts.authorizeApp === undefined) {
|
|
133
|
+
throw new Error("createGguiSessionChannelServer: perAppOnlySources lists credential sources that must be authorized on every subscribe, but no authorizeApp is wired");
|
|
134
|
+
}
|
|
132
135
|
const path = opts.path ?? DEFAULT_RENDER_CHANNEL_PATH;
|
|
133
136
|
// Outbound stream buffer — owns seq assignment + bounded replay
|
|
134
137
|
// storage. Default is in-memory; operators swap via `opts.streamBuffer`.
|
|
@@ -225,6 +228,8 @@ export function createGguiSessionChannelServer(opts) {
|
|
|
225
228
|
bootstrap: opts.bootstrap,
|
|
226
229
|
cookieAuth: opts.cookieAuth,
|
|
227
230
|
appIdFromIdentity: opts.appIdFromIdentity,
|
|
231
|
+
...(opts.authorizeApp ? { authorizeApp: opts.authorizeApp } : {}),
|
|
232
|
+
...(opts.perAppOnlySources ? { perAppOnlySources: opts.perAppOnlySources } : {}),
|
|
228
233
|
versionPolicy: opts.versionPolicy,
|
|
229
234
|
sendError,
|
|
230
235
|
register,
|
|
@@ -46,7 +46,9 @@ import type { Blueprint } from "@ggui-ai/protocol";
|
|
|
46
46
|
* (anthropic / openai / google / openrouter / bedrock). `call` runs
|
|
47
47
|
* one `complete()` round-trip on the underlying adapter.
|
|
48
48
|
*
|
|
49
|
-
* `callStructured`
|
|
49
|
+
* `callStructured` (and `callStructuredMetered`, the same call with the
|
|
50
|
+
* response's token usage beside the tool input — ggui#1418) is wired for
|
|
51
|
+
* Anthropic only. Anthropic's
|
|
50
52
|
* `/v1/messages` natively supports forced tool use via `tools[] +
|
|
51
53
|
* tool_choice: {type:'tool', name}` — on the models that accept it; the
|
|
52
54
|
* always-thinking models refuse a forced tool (see
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"llm-backed-negotiator.d.ts","sourceRoot":"","sources":["../src/llm-backed-negotiator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAEjB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,
|
|
1
|
+
{"version":3,"file":"llm-backed-negotiator.d.ts","sourceRoot":"","sources":["../src/llm-backed-negotiator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAEjB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,YAAY,EACvB,WAAW,EAAE,cAAc,EAC3B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CAsDX;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,uEAAuE;AACvE,MAAM,MAAM,kCAAkC;AAC5C,2EAA2E;AACzE,YAAY;AACd,2EAA2E;GACzE,cAAc;AAChB,mDAAmD;GACjD,SAAS;AACX,gCAAgC;GAC9B,MAAM;AACR,4CAA4C;GAC1C,WAAW,CAAC;AAEhB;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEtC,IAAI,EAAE,kCAAkC,EACxC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;CAQzE;AAgID;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;OAMG;IACH,UAAU,EAAE,CACV,GAAG,EAAE,cAAc,KAEjB;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,cAAc,CAAA;KAAE,GACxD,OAAO,CAAC;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,cAAc,CAAA;KAAE,GAAG,IAAI,CAAC,GACxE,IAAI,CAAC;IACT;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAChC,CAAC;IACF;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;IAClD;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,IAAI,CAAC,gCAAgC,EAAE,OAAO,GAAG,qBAAqB,GAAG,WAAW,CAAC,GAC1F,aAAa,EAAE,CAQjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,gCAAgC,GACrC,mBAAmB,CA6DrB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,m3DAoBgN,CAAC;AAqC7P;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CA2CR;AA8CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,CAyBpF"}
|
|
@@ -70,18 +70,17 @@ export function buildLlmCaller(selection, providerKey, options = {}) {
|
|
|
70
70
|
},
|
|
71
71
|
};
|
|
72
72
|
if (isAnthropic) {
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
};
|
|
73
|
+
const metered = (systemPrompt, userMessage, tool, maxTokens) => anthropicCallStructured({
|
|
74
|
+
apiKey: providerKey.key,
|
|
75
|
+
model: selection.model,
|
|
76
|
+
systemPrompt,
|
|
77
|
+
userMessage,
|
|
78
|
+
tool,
|
|
79
|
+
maxTokens,
|
|
80
|
+
...(options.signal !== undefined ? { signal: options.signal } : {}),
|
|
81
|
+
});
|
|
82
|
+
caller.callStructuredMetered = metered;
|
|
83
|
+
caller.callStructured = async (systemPrompt, userMessage, tool, maxTokens) => (await metered(systemPrompt, userMessage, tool, maxTokens)).value;
|
|
85
84
|
}
|
|
86
85
|
return caller;
|
|
87
86
|
}
|
|
@@ -189,8 +188,10 @@ async function anthropicCallStructured(args) {
|
|
|
189
188
|
}
|
|
190
189
|
const stopReason = typeof json["stop_reason"] === "string" ? json["stop_reason"] : undefined;
|
|
191
190
|
const toolUse = json["content"].find((block) => isRecord(block) && block["type"] === "tool_use" && block["name"] === args.tool.name);
|
|
192
|
-
if (toolUse !== undefined && toolUse["input"] !== undefined)
|
|
193
|
-
|
|
191
|
+
if (toolUse !== undefined && toolUse["input"] !== undefined) {
|
|
192
|
+
const usage = readMessagesUsage(json["usage"]);
|
|
193
|
+
return { value: toolUse["input"], ...(usage !== undefined ? { usage } : {}) };
|
|
194
|
+
}
|
|
194
195
|
if (stopReason === "max_tokens") {
|
|
195
196
|
throw new AnthropicStructuredCallError("max_tokens", `stop_reason=max_tokens before the "${args.tool.name}" tool_use block (max_tokens=${body.max_tokens})`, { stopReason });
|
|
196
197
|
}
|
|
@@ -199,6 +200,19 @@ async function anthropicCallStructured(args) {
|
|
|
199
200
|
}
|
|
200
201
|
throw new AnthropicStructuredCallError("no_tool_call", `the turn ended (stop_reason=${stopReason ?? "absent"}) without a "${args.tool.name}" tool_use block`, stopReason !== undefined ? { stopReason } : {});
|
|
201
202
|
}
|
|
203
|
+
/**
|
|
204
|
+
* The token usage of a Messages response, as `{ input, output }`: its
|
|
205
|
+
* `usage.input_tokens` and `usage.output_tokens` when both are numbers,
|
|
206
|
+
* else absent (unmetered, never zeros — ggui#1418). No `cache_control` is
|
|
207
|
+
* sent on this call, so the cache token counts are not added.
|
|
208
|
+
*/
|
|
209
|
+
function readMessagesUsage(usage) {
|
|
210
|
+
if (!isRecord(usage))
|
|
211
|
+
return undefined;
|
|
212
|
+
const input = usage["input_tokens"];
|
|
213
|
+
const output = usage["output_tokens"];
|
|
214
|
+
return typeof input === "number" && typeof output === "number" ? { input, output } : undefined;
|
|
215
|
+
}
|
|
202
216
|
/**
|
|
203
217
|
* Build the handshake pool list: the per-app pool (from `cache`) first —
|
|
204
218
|
* so a deployment's own blueprints win on exact-key first-match — then
|
|
@@ -669,7 +669,7 @@ export interface GguiRenderResourceTemplateOptions {
|
|
|
669
669
|
/**
|
|
670
670
|
* Per-request handler-context accessor — the SAME AsyncLocalStorage
|
|
671
671
|
* read the tool path uses. The per-session resource handler gates
|
|
672
|
-
* reads on it (
|
|
672
|
+
* reads on it (`renderReadAllowed`, in @ggui-ai/mcp-server-handlers/renders). Absent ⇒ the handler fails
|
|
673
673
|
* closed for rows scoped to any app other than the single-app
|
|
674
674
|
* default (compose paths that cannot thread a context keep working
|
|
675
675
|
* for OSS single-app flows only).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcp-apps-outbound.d.ts","sourceRoot":"","sources":["../src/mcp-apps-outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAWL,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAmBjF,OAAO,
|
|
1
|
+
{"version":3,"file":"mcp-apps-outbound.d.ts","sourceRoot":"","sources":["../src/mcp-apps-outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAWL,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAmBjF,OAAO,EAgBL,KAAK,sBAAsB,EAE5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAG3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgc1C,eAAO,MAAM,sBAAsB,QAG6B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAEtB,CAAC;AAwCvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,MAAM,CAiBR;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,CAKR;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAC9B,MAAM,GACN,IAAI,GACJ,CAAC,CAAC,GAAG,EAAE,uBAAuB,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAaR;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,EACjB,SAAS,GAAE,MAA+B,EAC1C,aAAa,CAAC,EAAE,MAAM;AACtB;;;;;;;;;;;GAWG;AACH,UAAU,CAAC,EAAE,MAAM;AACnB;;;;;;;;;;;;;GAaG;AACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;AAClD;;;;;;GAMG;AACH,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC9C,GACA,MAAM,CA2GR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAMpE;AAyCD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACjE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAyI9E;AAuID;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD;yBACqB;IACrB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IAClE;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAChF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,0BAA0B,EAAE,mBAAmB,CAAC;IACtF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,iCAAiC,GACtC,IAAI,CAsjCN;AAiGD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;CACnD,GACL;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAyBvC"}
|