npm - @grackle-ai/server - Versions diffs - 0.135.2 → 0.136.0 - Mend

@grackle-ai/server 0.135.2 → 0.136.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/dist/config.d.ts CHANGED Viewed

@@ -1,3 +1,28 @@
+/**
+ * Native-TLS configuration resolved from environment variables.
+ *
+ * When present, every browser- and client-facing Grackle listener (web,
+ * sandbox, MCP, gRPC) terminates TLS in-process. The web/sandbox/MCP
+ * listeners use `http2.createSecureServer({ allowHTTP1: true })` so HTTP/1.1
+ * clients still negotiate via ALPN; the gRPC listener is intentionally
+ * h2-only (`createSecureServer` without `allowHTTP1`) because gRPC clients
+ * always speak h2. Used by deployments that expose the server on the network
+ * without a fronting TLS proxy (#1373).
+ */
+export interface TlsConfig {
+    /** Filesystem path to the PEM-encoded server certificate (`GRACKLE_TLS_CERT`). */
+    certPath: string;
+    /** Filesystem path to the PEM-encoded private key (`GRACKLE_TLS_KEY`). */
+    keyPath: string;
+    /**
+     * Optional filesystem path to an intermediate-CA PEM bundle
+     * (`GRACKLE_TLS_CHAIN`). When set, the contents are appended to the server
+     * certificate at load time so the full chain is served to clients. This is
+     * **server identity** only — for client-cert verification (mTLS) see #1393
+     * (`GRACKLE_TLS_CLIENT_CA`, future).
+     */
+    chainPath?: string;
+}
 /** Validated server configuration resolved from environment variables. */
 export interface ServerConfig {
     /** gRPC server port (GRACKLE_PORT). */
@@ -48,6 +73,12 @@ export interface ServerConfig {
     worktreeBase?: string;
     /** Docker host for host mapping (GRACKLE_DOCKER_HOST). */
     dockerHost?: string;
+    /**
+     * Native-TLS configuration (`GRACKLE_TLS_CERT` + `GRACKLE_TLS_KEY`, optional
+     * `GRACKLE_TLS_CHAIN`). When present, the server terminates TLS in-process on
+     * every listener. When unset, listeners serve cleartext (current behavior).
+     */
+    tls?: TlsConfig;
 }
 /**
  * Resolve and validate all server configuration from environment variables.

package/dist/config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"~~AASA~~,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qGAAqG;IACrG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;~~CACrB~~;~~AA6CD~~;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,YAAY,~~CAsBlD~~"}
1	+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qGAAqG;IACrG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AA6FD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,YAAY,CAwBlD"}

package/dist/config.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { accessSync, constants as fsConstants } from "node:fs";
 import { DEFAULT_SERVER_PORT, DEFAULT_WEB_PORT, DEFAULT_MCP_PORT, DEFAULT_POWERLINE_PORT, DEFAULT_SANDBOX_PORT, } from "@grackle-ai/common";
 import { parsePublicOrigin } from "@grackle-ai/auth";
 /**
@@ -20,6 +21,47 @@ function parsePort(envName, defaultValue) {
 function parseFlag(envName) {
     return process.env[envName] === "1";
 }
+/**
+ * Parse the native-TLS config from env vars. Returns `undefined` when neither
+ * cert nor key is set (the cleartext default). Throws when only one is set, or
+ * when any referenced file is missing/unreadable, so the operator sees a clear
+ * startup error rather than a confusing handshake failure later.
+ */
+function parseTlsConfig() {
+    const certPath = process.env.GRACKLE_TLS_CERT;
+    const keyPath = process.env.GRACKLE_TLS_KEY;
+    const chainPath = process.env.GRACKLE_TLS_CHAIN;
+    if (!certPath && !keyPath) {
+        if (chainPath) {
+            throw new Error("GRACKLE_TLS_CHAIN is set but GRACKLE_TLS_CERT and GRACKLE_TLS_KEY are not. " +
+                "Set both cert and key (or unset chain).");
+        }
+        return undefined;
+    }
+    if (!certPath || !keyPath) {
+        throw new Error("GRACKLE_TLS_CERT and GRACKLE_TLS_KEY must both be set, or neither. " +
+            `Got cert=${certPath ? "set" : "unset"}, key=${keyPath ? "set" : "unset"}.`);
+    }
+    const checkReadable = (envName, path) => {
+        try {
+            accessSync(path, fsConstants.R_OK);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`${envName} path "${path}" is not readable: ${message}`);
+        }
+    };
+    checkReadable("GRACKLE_TLS_CERT", certPath);
+    checkReadable("GRACKLE_TLS_KEY", keyPath);
+    if (chainPath) {
+        checkReadable("GRACKLE_TLS_CHAIN", chainPath);
+    }
+    return {
+        certPath,
+        keyPath,
+        ...(chainPath ? { chainPath } : {}),
+    };
+}
 /**
  * Parse and validate the canonical public origin from an environment variable.
  *
@@ -43,6 +85,7 @@ function parsePublicUrl(envName) {
  * Throws on invalid values so the server fails fast at startup with a clear error.
  */
 export function resolveServerConfig() {
+    const tls = parseTlsConfig();
     return Object.freeze({
         grpcPort: parsePort("GRACKLE_PORT", DEFAULT_SERVER_PORT),
         webPort: parsePort("GRACKLE_WEB_PORT", DEFAULT_WEB_PORT),
@@ -63,6 +106,7 @@ export function resolveServerConfig() {
         workingDirectory: process.env.GRACKLE_WORKING_DIRECTORY || undefined,
         worktreeBase: process.env.GRACKLE_WORKTREE_BASE || undefined,
         dockerHost: process.env.GRACKLE_DOCKER_HOST || undefined,
+        ...(tls ? { tls } : {}),
     });
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;~~AAsDrD~~;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,YAAoB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,MAAM,GAAG,4CAA4C,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC;QACxD,OAAO,EAAE,SAAS,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACxD,OAAO,EAAE,SAAS,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACxD,GAAG,CAAC,GAA2B,EAAE;YAC/B,MAAM,SAAS,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;YACvD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC,EAAE;QACJ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,SAAS,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB;YACpC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,SAAS,CAAC,wBAAwB,EAAE,sBAAsB,CAAC;QAC1E,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,WAAW;QAC7C,kBAAkB,EAAE,SAAS,CAAC,8BAA8B,CAAC;QAC7D,iBAAiB,EAAE,SAAS,CAAC,6BAA6B,CAAC;QAC3D,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS;QACpE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS;QAC5D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,SAAS;~~KACzD~~,CAAC,CAAC;AACL,CAAC"}
1	+ {"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAsFrD;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,YAAoB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,MAAM,GAAG,4CAA4C,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAEhD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,yCAAyC,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAY,EAAQ,EAAE;QAC5D,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,UAAU,IAAI,sBAAsB,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;IACF,aAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC5C,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,SAAS,EAAE,CAAC;QACd,aAAa,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO;QACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC;QACxD,OAAO,EAAE,SAAS,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACxD,OAAO,EAAE,SAAS,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACxD,GAAG,CAAC,GAA2B,EAAE;YAC/B,MAAM,SAAS,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;YACvD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC,EAAE;QACJ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,SAAS,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB;YACpC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,SAAS,CAAC,wBAAwB,EAAE,sBAAsB,CAAC;QAC1E,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,WAAW;QAC7C,kBAAkB,EAAE,SAAS,CAAC,8BAA8B,CAAC;QAC7D,iBAAiB,EAAE,SAAS,CAAC,6BAA6B,CAAC;QAC3D,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS;QACpE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS;QAC5D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,SAAS;QACxD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.js CHANGED Viewed

@@ -10,6 +10,7 @@ import { reconnectOrProvision } from "@grackle-ai/adapter-sdk";
 import { LocalPowerLineManager } from "./local-powerline-manager.js";
 import { registerCrashHandlers } from "./crash-handler.js";
 import { resolveServerConfig } from "./config.js";
+import { loadSecureContext } from "./tls.js";
 import { createMcpServer } from "@grackle-ai/mcp";
 import { loadOrCreateApiKey, verifyApiKey, setAuthLogger, generatePairingCode, startSessionCleanup, startPairingCleanup, startOAuthCleanup, } from "@grackle-ai/auth";
 import { createWebServer, createSandboxServer, isWildcardAddress, } from "@grackle-ai/web-server";
@@ -31,6 +32,36 @@ async function main() {
     // Resolve and validate all server configuration from env vars (fail fast on invalid values)
     const config = resolveServerConfig();
     logger.info({ config }, "Server configuration resolved");
+    // Load TLS material once, before any listener is constructed (#1373). When
+    // unset (the default), all listeners serve cleartext as before.
+    const secureContext = config.tls
+        ? loadSecureContext(config.tls, logger)
+        : undefined;
+    // Effective public origin. Operator-set GRACKLE_PUBLIC_URL wins (#1371 — TLS
+    // terminates upstream); else if native TLS is enabled (#1373) synthesize a
+    // local https origin so every downstream piece (Secure cookie, OAuth
+    // metadata, HSTS, pairing URL, channel ingress) sees the right scheme.
+    // For the synthesized form prefer "localhost" over 127.0.0.1: it lets self-
+    // signed CN=localhost certs validate, browsers prefer it, and on Windows the
+    // IPv4 loopback alone has a Node h2 cross-process quirk that ::1 avoids.
+    const synthesizedPublicHost = isWildcardAddress(config.host)
+        ? detectLanIp() || "localhost"
+        : config.host === "127.0.0.1"
+            ? "localhost"
+            : config.host;
+    // Bracket IPv6 literals per RFC 2732 — `https://::1:port` is an invalid URL
+    // and parsePublicOrigin would reject it downstream in createWebServer.
+    const synthesizedUrlHost = synthesizedPublicHost.includes(":")
+        ? `[${synthesizedPublicHost}]`
+        : synthesizedPublicHost;
+    const effectivePublicUrl = config.publicUrl ??
+        (secureContext ? `https://${synthesizedUrlHost}:${config.webPort}` : undefined);
+    // Listener (wire) scheme. What each listener actually speaks on its socket —
+    // driven solely by secureContext, NOT effectivePublicUrl. A TLS-terminating
+    // reverse proxy could publish https while the listener serves cleartext, or
+    // an operator could pair native TLS with `GRACKLE_PUBLIC_URL=http://...` —
+    // in either case the startup log should reflect on-the-wire reality.
+    const listenerScheme = secureContext ? "https" : "http";
     // AHP HR7: initialize the additive OTLP logs sink for runtime diagnostics.
     // No-op unless OTEL_EXPORTER_OTLP_ENDPOINT is set; never breaks startup.
     initOtlpLogs();
@@ -186,7 +217,12 @@ async function main() {
             },
         ],
     });
-    const grpcServer = http2.createServer(grpcHandler);
+    // gRPC always runs over http2. When TLS is enabled (#1373) we switch to
+    // `createSecureServer` so the same handler terminates h2 over TLS instead of
+    // cleartext h2c. allowHTTP1 is irrelevant here: gRPC clients always speak h2.
+    const grpcServer = secureContext
+        ? http2.createSecureServer({ cert: secureContext.cert, key: secureContext.key }, grpcHandler)
+        : http2.createServer(grpcHandler);
     grpcServer.on("error", (err) => {
         if (err.code === "EADDRINUSE") {
             logger.fatal({ port: grpcPort }, "Port %d is already in use. Is another Grackle server running?", grpcPort);
@@ -200,7 +236,7 @@ async function main() {
         });
     });
     grpcServer.listen(grpcPort, bindHost, () => {
-        logger.info({ port: grpcPort, host: bindHost }, "gRPC server listening on http://%s:%d", urlHost, grpcPort);
+        logger.info({ port: grpcPort, host: bindHost, scheme: listenerScheme }, "gRPC server listening on %s://%s:%d", listenerScheme, urlHost, grpcPort);
     });
     // --- Web server (HTTP/1.1) ---
     const webPort = config.webPort;
@@ -212,19 +248,23 @@ async function main() {
     const ingressUrlHost = ingressHost.includes(":") ? `[${ingressHost}]` : ingressHost;
     setChannelConfig({
         signingSecret: apiKey,
-        // Behind a TLS reverse proxy, external callers reach us at the public origin.
-        ingressBaseUrl: config.publicUrl ?? `http://${ingressUrlHost}:${webPort}`,
+        // External callers reach us at the effective public origin: an explicit
+        // GRACKLE_PUBLIC_URL when behind a TLS reverse proxy (#1371), the
+        // synthesized https origin when native TLS terminates here (#1373), or the
+        // local http origin otherwise.
+        ingressBaseUrl: effectivePublicUrl ?? `http://${ingressUrlHost}:${webPort}`,
     });
     const webServer = createWebServer({
         apiKey,
         webPort,
         bindHost,
+        ...(secureContext ? { secureContext } : {}),
         connectRoutes: routes,
         handleWebhook: ingestChannelMessage,
         pluginNames: loaded.pluginNames,
         sandboxPort: config.sandboxPort,
         ...(config.sandboxOrigin !== undefined ? { sandboxOrigin: config.sandboxOrigin } : {}),
-        ...(config.publicUrl !== undefined ? { publicUrl: config.publicUrl } : {}),
+        ...(effectivePublicUrl !== undefined ? { publicUrl: effectivePublicUrl } : {}),
         readinessCheck: () => {
             const checks = {};
             try {
@@ -261,13 +301,16 @@ async function main() {
         });
     });
     webServer.listen(webPort, bindHost, () => {
-        logger.info({ port: webPort, host: bindHost }, "Web UI on http://%s:%d", urlHost, webPort);
+        logger.info({ port: webPort, host: bindHost, scheme: listenerScheme }, "Web UI on %s://%s:%d", listenerScheme, urlHost, webPort);
         // Generate initial pairing code and print to terminal
         const code = generatePairingCode();
         if (code) {
             const pairingHost = isWildcardAddress(bindHost) ? detectLanIp() || "localhost" : bindHost;
-            const pairingUrl = config.publicUrl
-                ? `${config.publicUrl}/pair?code=${code}`
+            // Prefer the effective public URL (explicit GRACKLE_PUBLIC_URL or the
+            // synthesized https origin under native TLS) so the printed URL is the
+            // one the browser will actually open. Falls back to cleartext loopback.
+            const pairingUrl = effectivePublicUrl
+                ? `${effectivePublicUrl}/pair?code=${code}`
                 : `http://${pairingHost}:${webPort}/pair?code=${code}`;
             process.stdout.write("\n");
             process.stdout.write("  Open in browser:\n");
@@ -296,14 +339,14 @@ async function main() {
             logger.info({ url: pairingUrl }, "Pairing URL generated");
         }
     });
-    // --- MCP server (HTTP/1.1, Streamable HTTP) ---
+    // --- MCP server (Streamable HTTP; h2-over-TLS when secureContext is set) ---
     // The MCP protected-resource metadata points clients at this authorization
-    // server. Behind a TLS reverse proxy, use the public origin so discovery
-    // carries the right scheme/host; otherwise the dialable loopback host
-    // (wildcard → 127.0.0.1).
+    // server. Use the effective public URL (explicit GRACKLE_PUBLIC_URL or the
+    // synthesized https origin under native TLS) so discovery carries the right
+    // scheme/host; otherwise the dialable loopback host (wildcard → 127.0.0.1).
     const dialableHost = isWildcardAddress(bindHost) ? "127.0.0.1" : bindHost;
     const dialableUrlHost = dialableHost.includes(":") ? `[${dialableHost}]` : dialableHost;
-    const authServerUrl = config.publicUrl ?? `http://${dialableUrlHost}:${webPort}`;
+    const authServerUrl = effectivePublicUrl ?? `http://${dialableUrlHost}:${webPort}`;
     // Adapt plugin-contributed tools to the concrete ToolDefinition type expected by MCP.
     // Validates shape at startup so runtime failures surface immediately with a clear message.
     const pluginToolGroups = loaded.mcpTools.length > 0
@@ -327,6 +370,7 @@ async function main() {
         authorizationServerUrl: authServerUrl,
         toolGroups: pluginToolGroups,
         publishWidgetEvent,
+        ...(secureContext ? { secureContext } : {}),
         // Push tools/list_changed to a workspace's MCP sessions when its promoted
         // component set changes (#1297), via the domain-event bus.
         onComponentChangeSubscribe: (notify) => subscribe((e) => {
@@ -352,11 +396,15 @@ async function main() {
         });
     });
     mcpServer.listen(mcpPort, bindHost, () => {
-        logger.info({ port: mcpPort, host: bindHost }, "MCP server on http://%s:%d/mcp", urlHost, mcpPort);
+        logger.info({ port: mcpPort, host: bindHost, scheme: listenerScheme }, "MCP server on %s://%s:%d/mcp", listenerScheme, urlHost, mcpPort);
     });
     // --- MCP Apps widget sandbox server (separate origin) ---
     const sandboxPort = config.sandboxPort;
-    const sandboxServer = createSandboxServer({ bindHost, sandboxPort });
+    const sandboxServer = createSandboxServer({
+        bindHost,
+        sandboxPort,
+        ...(secureContext ? { secureContext } : {}),
+    });
     sandboxServer.on("error", (err) => {
         if (err.code === "EADDRINUSE") {
             logger.fatal({ port: sandboxPort }, "Port %d is already in use. Is another Grackle server running?", sandboxPort);
@@ -370,7 +418,7 @@ async function main() {
         });
     });
     sandboxServer.listen(sandboxPort, bindHost, () => {
-        logger.info({ port: sandboxPort, host: bindHost }, "MCP Apps sandbox on http://%s:%d/sandbox.html", urlHost, sandboxPort);
+        logger.info({ port: sandboxPort, host: bindHost, scheme: listenerScheme }, "MCP Apps sandbox on %s://%s:%d/sandbox.html", listenerScheme, urlHost, sandboxPort);
     });
     // --- Graceful shutdown ---
     shutdown = createShutdown({

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,0BAA0B,EAC1B,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AACjG,OAAO,EAAE,WAAW,EAAsB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,6BAA6B,EAC7B,SAAS,EACT,MAAM,EACN,WAAW,EACX,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,qEAAqE;AACrE,MAAM,UAAU,GAAgB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,KAAK,UAAU,IAAI;IACjB,oFAAoF;IACpF,uFAAuF;IACvF,IAAI,QAAQ,GAAwB,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAEnD,4FAA4F;IAC5F,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,yEAAyE;IACzE,YAAY,EAAE,CAAC;IAEf,iFAAiF;IACjF,kBAAkB,EAAE,CAAC;IAErB,0DAA0D;IAC1D,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtB,4CAA4C;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAE/C,6CAA6C;IAC7C,mBAAmB,EAAE,CAAC;IAEtB,6DAA6D;IAC7D,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CACjF;QACE,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,EACD;QACE,WAAW;QACX,aAAa;QACb,YAAY;QACZ,cAAc;QACd,6BAA6B;QAC7B,SAAS;QACT,UAAU;QACV,kBAAkB;QAClB,aAAa;QACb,oBAAoB;QACpB,IAAI;QACJ,mBAAmB;QACnB,MAAM;QACN,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC;KAClE,CACF,CAAC;IAEF,6DAA6D;IAC7D,0EAA0E;IAC1E,MAAM,mBAAmB,GAAW,KAAK,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,oEAAoE;QACpE,OAAO,uBAAuB,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;YACrD,IAAI,YAAY,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EACtE,2CAA2C,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,MAAM,UAAU,GACd,GAAG,YAAY,KAAK;YACpB,CAAC,MAAM,IAAI,GAAG;gBACZ,CAAC,CAAE,GAAiC,CAAC,IAAI,KAAK,QAAQ;gBACtD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,kHAAkH,CACnH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,EACP,6EAA6E,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,sCAAsC;IACtC,cAAc,CACZ,CAAC,aAAa,EAAE,EAAE;QAChB,yEAAyE;QACzE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAChC,WAAW,CAAC,uBAAuB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,aAAa,GAAG,YAAY,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC,EACD,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAC1B,CAAC;IAEF,gCAAgC;IAChC,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,CAAC;IACtB,iBAAiB,EAAE,CAAC;IAEpB,uBAAuB;IACvB,MAAM,aAAa,GAAkB;QACnC,SAAS;QACT,IAAI;QACJ,MAAM;QACN,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW;YACX,MAAM;YACN,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;KACF,CAAC;IAEF,0EAA0E;IAC1E,4FAA4F;IAC5F,MAAM,OAAO,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrC,IAAI,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzD,oBAAoB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,+EAA+E;IAC/E,wBAAwB,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAE1D,0CAA0C;IAC1C,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC9C,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEvC,iCAAiC;IACjC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrF,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAE9B,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjD,yFAAyF;IACzF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpE,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,MAAM;QACN,YAAY,EAAE;YACZ,gFAAgF;YAChF,6EAA6E;YAC7E,6DAA6D;YAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;gBACxE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9D,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC5C,MAAM,OAAO,GAAG,0BAA0B,CACxC,OAAO,EACP,QAAQ,CAAC,OAAiC,CAC3C,CAAC;oBACD,QAAgD,CAAC,OAAO,GAAG,OAAO,CAAC;gBACtE,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,2CAA2C;YAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;SACF;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAEnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACpD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,+DAA+D,EAC/D,QAAQ,CACT,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClC,uCAAuC,EACvC,OAAO,EACP,QAAQ,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE/B,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1F,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IACpF,gBAAgB,CAAC;QACf,aAAa,EAAE,MAAM;QACrB,8EAA8E;QAC9E,cAAc,EAAE,MAAM,CAAC,SAAS,IAAI,UAAU,cAAc,IAAI,OAAO,EAAE;KAC1E,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,MAAM;QACN,OAAO;QACP,QAAQ;QACR,aAAa,EAAE,MAAM;QACrB,aAAa,EAAE,oBAAoB;QACnC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,cAAc,EAAE,GAAoB,EAAE;YACpC,MAAM,MAAM,GAA8B,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,CAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,GAAG;oBAChB,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAC9D,CAAC;YACJ,CAAC;YACD,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,SAAS,GAAG,0BAA0B,EAAE,CAAC;YAClD,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;gBACzB,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,+DAA+D,EAC/D,OAAO,CACR,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,wBAAwB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3F,sDAAsD;QACtD,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS;gBACjC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,cAAc,IAAI,EAAE;gBACzC,CAAC,CAAC,UAAU,WAAW,IAAI,OAAO,cAAc,IAAI,EAAE,CAAC;YAEzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE3B,yEAAyE;YACzE,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAEjC,CAAC;oBACF,MAAM;yBACH,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;yBACvD,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE;wBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC3B,CAAC,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE;wBACV,wCAAwC;oBAC1C,CAAC,CAAC,CAAC;gBACP,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE3B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,0BAA0B;IAC1B,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACxF,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,eAAe,IAAI,OAAO,EAAE,CAAC;IACjF,sFAAsF;IACtF,2FAA2F;IAC3F,MAAM,gBAAgB,GACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC;YACE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,IAAI,OAAQ,CAAC,CAAC,WAAuC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC/E,MAAM,IAAI,KAAK,CACb,gBAAgB,CAAC,CAAC,IAAI,yDAAyD,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,+BAA+B,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,CAA8B,CAAC;YACxC,CAAC,CAAC;SACH;QACH,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,MAAM;QACN,sBAAsB,EAAE,aAAa;QACrC,UAAU,EAAE,gBAAgB;QAC5B,kBAAkB;QAClB,0EAA0E;QAC1E,2DAA2D;QAC3D,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;gBACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACJ,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IAEH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,+DAA+D,EAC/D,OAAO,CACR,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EACjC,gCAAgC,EAChC,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACvD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,WAAW,EAAE,EACrB,+DAA+D,EAC/D,WAAW,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,EACrC,+CAA+C,EAC/C,OAAO,EACP,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4BAA4B;IAC5B,QAAQ,GAAG,cAAc,CAAC;QACxB,UAAU;QACV,SAAS;QACT,SAAS;QACT,aAAa;QACb,qBAAqB;QACrB,qBAAqB;QACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAC;IAEH,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,wFAAwF;AACxF,qBAAqB,EAAE,CAAC;AAExB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,0BAA0B,EAC1B,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AACjG,OAAO,EAAE,WAAW,EAAsB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,6BAA6B,EAC7B,SAAS,EACT,MAAM,EACN,WAAW,EACX,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAsB,MAAM,UAAU,CAAC;AACjE,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,qEAAqE;AACrE,MAAM,UAAU,GAAgB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,KAAK,UAAU,IAAI;IACjB,oFAAoF;IACpF,uFAAuF;IACvF,IAAI,QAAQ,GAAwB,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAEnD,4FAA4F;IAC5F,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,aAAa,GAA8B,MAAM,CAAC,GAAG;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC;IACd,6EAA6E;IAC7E,2EAA2E;IAC3E,qEAAqE;IACrE,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,qBAAqB,GAAW,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW;QAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;YAC3B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAClB,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,kBAAkB,GAAW,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpE,CAAC,CAAC,IAAI,qBAAqB,GAAG;QAC9B,CAAC,CAAC,qBAAqB,CAAC;IAC1B,MAAM,kBAAkB,GACtB,MAAM,CAAC,SAAS;QAChB,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,kBAAkB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,cAAc,GAAqB,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAE1E,2EAA2E;IAC3E,yEAAyE;IACzE,YAAY,EAAE,CAAC;IAEf,iFAAiF;IACjF,kBAAkB,EAAE,CAAC;IAErB,0DAA0D;IAC1D,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtB,4CAA4C;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAE/C,6CAA6C;IAC7C,mBAAmB,EAAE,CAAC;IAEtB,6DAA6D;IAC7D,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CACjF;QACE,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,EACD;QACE,WAAW;QACX,aAAa;QACb,YAAY;QACZ,cAAc;QACd,6BAA6B;QAC7B,SAAS;QACT,UAAU;QACV,kBAAkB;QAClB,aAAa;QACb,oBAAoB;QACpB,IAAI;QACJ,mBAAmB;QACnB,MAAM;QACN,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC;KAClE,CACF,CAAC;IAEF,6DAA6D;IAC7D,0EAA0E;IAC1E,MAAM,mBAAmB,GAAW,KAAK,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,oEAAoE;QACpE,OAAO,uBAAuB,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;YACrD,IAAI,YAAY,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EACtE,2CAA2C,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,MAAM,UAAU,GACd,GAAG,YAAY,KAAK;YACpB,CAAC,MAAM,IAAI,GAAG;gBACZ,CAAC,CAAE,GAAiC,CAAC,IAAI,KAAK,QAAQ;gBACtD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,kHAAkH,CACnH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,EACP,6EAA6E,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,sCAAsC;IACtC,cAAc,CACZ,CAAC,aAAa,EAAE,EAAE;QAChB,yEAAyE;QACzE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAChC,WAAW,CAAC,uBAAuB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,aAAa,GAAG,YAAY,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC,EACD,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAC1B,CAAC;IAEF,gCAAgC;IAChC,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,CAAC;IACtB,iBAAiB,EAAE,CAAC;IAEpB,uBAAuB;IACvB,MAAM,aAAa,GAAkB;QACnC,SAAS;QACT,IAAI;QACJ,MAAM;QACN,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW;YACX,MAAM;YACN,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;KACF,CAAC;IAEF,0EAA0E;IAC1E,4FAA4F;IAC5F,MAAM,OAAO,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrC,IAAI,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzD,oBAAoB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,+EAA+E;IAC/E,wBAAwB,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAE1D,0CAA0C;IAC1C,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC9C,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEvC,iCAAiC;IACjC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrF,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAE9B,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjD,yFAAyF;IACzF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpE,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,MAAM;QACN,YAAY,EAAE;YACZ,gFAAgF;YAChF,6EAA6E;YAC7E,6DAA6D;YAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;gBACxE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9D,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC5C,MAAM,OAAO,GAAG,0BAA0B,CACxC,OAAO,EACP,QAAQ,CAAC,OAAiC,CAC3C,CAAC;oBACD,QAAgD,CAAC,OAAO,GAAG,OAAO,CAAC;gBACtE,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,2CAA2C;YAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;SACF;KACF,CAAC,CAAC;IACH,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,UAAU,GAAG,aAAa;QAC9B,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC;QAC7F,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAEpC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACpD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,+DAA+D,EAC/D,QAAQ,CACT,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1D,qCAAqC,EACrC,cAAc,EACd,OAAO,EACP,QAAQ,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE/B,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1F,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IACpF,gBAAgB,CAAC;QACf,aAAa,EAAE,MAAM;QACrB,wEAAwE;QACxE,kEAAkE;QAClE,2EAA2E;QAC3E,+BAA+B;QAC/B,cAAc,EAAE,kBAAkB,IAAI,UAAU,cAAc,IAAI,OAAO,EAAE;KAC5E,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,MAAM;QACN,OAAO;QACP,QAAQ;QACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,aAAa,EAAE,MAAM;QACrB,aAAa,EAAE,oBAAoB;QACnC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,cAAc,EAAE,GAAoB,EAAE;YACpC,MAAM,MAAM,GAA8B,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,CAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,GAAG;oBAChB,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAC9D,CAAC;YACJ,CAAC;YACD,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,SAAS,GAAG,0BAA0B,EAAE,CAAC;YAClD,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;gBACzB,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,+DAA+D,EAC/D,OAAO,CACR,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EACzD,sBAAsB,EACtB,cAAc,EACd,OAAO,EACP,OAAO,CACR,CAAC;QAEF,sDAAsD;QACtD,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1F,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,UAAU,GAAG,kBAAkB;gBACnC,CAAC,CAAC,GAAG,kBAAkB,cAAc,IAAI,EAAE;gBAC3C,CAAC,CAAC,UAAU,WAAW,IAAI,OAAO,cAAc,IAAI,EAAE,CAAC;YAEzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE3B,yEAAyE;YACzE,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAEjC,CAAC;oBACF,MAAM;yBACH,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;yBACvD,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE;wBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC3B,CAAC,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE;wBACV,wCAAwC;oBAC1C,CAAC,CAAC,CAAC;gBACP,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE3B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACxF,MAAM,aAAa,GAAG,kBAAkB,IAAI,UAAU,eAAe,IAAI,OAAO,EAAE,CAAC;IACnF,sFAAsF;IACtF,2FAA2F;IAC3F,MAAM,gBAAgB,GACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC;YACE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,IAAI,OAAQ,CAAC,CAAC,WAAuC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC/E,MAAM,IAAI,KAAK,CACb,gBAAgB,CAAC,CAAC,IAAI,yDAAyD,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,+BAA+B,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,CAA8B,CAAC;YACxC,CAAC,CAAC;SACH;QACH,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,MAAM;QACN,sBAAsB,EAAE,aAAa;QACrC,UAAU,EAAE,gBAAgB;QAC5B,kBAAkB;QAClB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,0EAA0E;QAC1E,2DAA2D;QAC3D,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;gBACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACJ,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IAEH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,+DAA+D,EAC/D,OAAO,CACR,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EACzD,8BAA8B,EAC9B,cAAc,EACd,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACxC,QAAQ;QACR,WAAW;QACX,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACvD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,WAAW,EAAE,EACrB,+DAA+D,EAC/D,WAAW,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EAC7D,6CAA6C,EAC7C,cAAc,EACd,OAAO,EACP,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4BAA4B;IAC5B,QAAQ,GAAG,cAAc,CAAC;QACxB,UAAU;QACV,SAAS;QACT,SAAS;QACT,aAAa;QACb,qBAAqB;QACrB,qBAAqB;QACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAC;IAEH,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,wFAAwF;AACxF,qBAAqB,EAAE,CAAC;AAExB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/shutdown.d.ts CHANGED Viewed

@@ -4,13 +4,13 @@ interface Closeable {
 }
 /** Resources that must be cleaned up during graceful shutdown. */
 export interface ShutdownContext {
-    /** The HTTP/2 gRPC server. */
+    /** The HTTP/2 gRPC server (cleartext, or h2-over-TLS when GRACKLE_TLS_* is set). */
     grpcServer: Closeable;
-    /** The HTTP/1.1 web + WebSocket server. */
+    /** The web + WebSocket server (HTTP/1.1 cleartext, or h2-over-TLS via createSecureServer). */
     webServer: Closeable;
-    /** The HTTP/1.1 MCP server. */
+    /** The MCP server (HTTP/1.1 cleartext, or h2-over-TLS via createSecureServer). */
     mcpServer: Closeable;
-    /** The HTTP/1.1 MCP Apps widget sandbox server. */
+    /** The MCP Apps widget sandbox server (HTTP/1.1 cleartext, or h2-over-TLS). */
     sandboxServer: Closeable;
     /** The reconciliation manager (cron, orphan, lifecycle phases). */
     reconciliationManager: {

package/dist/shutdown.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../src/shutdown.ts"],"names":[],"mappings":"AAWA,oFAAoF;AACpF,UAAU,SAAS;IACjB,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,IAAI,CAAC;CAC5C;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,~~8BAA8B~~;~~IAC9B~~,UAAU,EAAE,SAAS,CAAC;IACtB,~~2CAA2C~~;~~IAC3C~~,SAAS,EAAE,SAAS,CAAC;IACrB~~,+BAA+B~~;~~IAC/B~~,SAAS,EAAE,SAAS,CAAC;IACrB~~,mDAAmD~~;~~IACnD~~,aAAa,EAAE,SAAS,CAAC;IACzB,mEAAmE;IACnE,qBAAqB,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACrD,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACtD,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAkF5E"}
1	+ {"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../src/shutdown.ts"],"names":[],"mappings":"AAWA,oFAAoF;AACpF,UAAU,SAAS;IACjB,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,IAAI,CAAC;CAC5C;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,UAAU,EAAE,SAAS,CAAC;IACtB,8FAA8F;IAC9F,SAAS,EAAE,SAAS,CAAC;IACrB,kFAAkF;IAClF,SAAS,EAAE,SAAS,CAAC;IACrB,+EAA+E;IAC/E,aAAa,EAAE,SAAS,CAAC;IACzB,mEAAmE;IACnE,qBAAqB,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACrD,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACtD,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAkF5E"}

package/dist/tls.d.ts ADDED Viewed

@@ -0,0 +1,29 @@
+import type { Logger } from "pino";
+import type { TlsConfig } from "./config.js";
+/**
+ * Loaded native-TLS material ready to hand to `http2.createSecureServer`.
+ *
+ * The `cert` buffer already includes any intermediate-chain content from
+ * `GRACKLE_TLS_CHAIN` appended via {@link loadSecureContext}, so callers do not
+ * need to set a separate `ca` field on the secure-server options.
+ */
+export interface SecureContext {
+    /** PEM cert (possibly concatenated with CA chain). */
+    cert: Buffer;
+    /** PEM private key. */
+    key: Buffer;
+}
+/**
+ * Read cert/key (and optional intermediate-CA bundle) from disk and produce a
+ * {@link SecureContext} suitable for `http2.createSecureServer`.
+ *
+ * The intermediate-CA bundle is appended to the leaf certificate so the full
+ * chain is served to clients. This is the common deployment pattern (internal
+ * PKI / Let's Encrypt with intermediates); operators who need mTLS client
+ * verification can re-purpose the variable later behind a feature flag.
+ *
+ * The cert's subject + expiry are logged at info level so the operator sees
+ * which material is in use without parsing the PEM by hand.
+ */
+export declare function loadSecureContext(tls: TlsConfig, logger: Logger): SecureContext;
+//# sourceMappingURL=tls.d.ts.map

package/dist/tls.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../src/tls.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAmD/E"}

package/dist/tls.js ADDED Viewed

@@ -0,0 +1,63 @@
+import { readFileSync } from "node:fs";
+import { X509Certificate } from "node:crypto";
+/**
+ * Read cert/key (and optional intermediate-CA bundle) from disk and produce a
+ * {@link SecureContext} suitable for `http2.createSecureServer`.
+ *
+ * The intermediate-CA bundle is appended to the leaf certificate so the full
+ * chain is served to clients. This is the common deployment pattern (internal
+ * PKI / Let's Encrypt with intermediates); operators who need mTLS client
+ * verification can re-purpose the variable later behind a feature flag.
+ *
+ * The cert's subject + expiry are logged at info level so the operator sees
+ * which material is in use without parsing the PEM by hand.
+ */
+export function loadSecureContext(tls, logger) {
+    let cert;
+    try {
+        cert = readFileSync(tls.certPath);
+    }
+    catch (err) {
+        throw new Error(`Failed to read GRACKLE_TLS_CERT at "${tls.certPath}": ${describe(err)}`);
+    }
+    let key;
+    try {
+        key = readFileSync(tls.keyPath);
+    }
+    catch (err) {
+        throw new Error(`Failed to read GRACKLE_TLS_KEY at "${tls.keyPath}": ${describe(err)}`);
+    }
+    if (tls.chainPath) {
+        let chain;
+        try {
+            chain = readFileSync(tls.chainPath);
+        }
+        catch (err) {
+            throw new Error(`Failed to read GRACKLE_TLS_CHAIN at "${tls.chainPath}": ${describe(err)}`);
+        }
+        // Ensure a newline separator so two PEM blocks don't run together.
+        const sep = cert.length > 0 && cert[cert.length - 1] !== 0x0a ? Buffer.from("\n") : Buffer.alloc(0);
+        cert = Buffer.concat([cert, sep, chain]);
+    }
+    // Best-effort: parse the leaf cert for observability. Never let a malformed
+    // cert here mask the real downstream TLS error.
+    try {
+        const x509 = new X509Certificate(cert);
+        logger.info({
+            subject: x509.subject,
+            validFrom: x509.validFrom,
+            validTo: x509.validTo,
+            certPath: tls.certPath,
+            keyPath: tls.keyPath,
+            chainPath: tls.chainPath,
+        }, "TLS enabled — terminating TLS in-process on all listeners");
+    }
+    catch (err) {
+        logger.warn({ err, certPath: tls.certPath }, "TLS enabled but could not parse leaf certificate for diagnostics");
+    }
+    return { cert, key };
+}
+function describe(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=tls.js.map

package/dist/tls.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tls.js","sourceRoot":"","sources":["../src/tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAc,EAAE,MAAc;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,QAAQ,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,OAAO,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,SAAS,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,mEAAmE;QACnE,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CACT;YACE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,EACD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAC/B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@grackle-ai/server",
-  "version": "0.135.2",
+  "version": "0.136.0",
   "description": "Grackle server orchestrator — spawns and wires core (gRPC), web-server (HTTP), MCP, and PowerLine",
   "license": "MIT",
   "repository": {
@@ -31,23 +31,23 @@
     "@connectrpc/connect-node": "^2.0.0",
     "pino": "^10.3.1",
     "qrcode": "^1.5.4",
-    "@grackle-ai/adapter-codespace": "0.135.2",
-    "@grackle-ai/adapter-docker": "0.135.2",
-    "@grackle-ai/adapter-sdk": "0.135.2",
-    "@grackle-ai/adapter-ssh": "0.135.2",
-    "@grackle-ai/adapter-local": "0.135.2",
-    "@grackle-ai/auth": "0.135.2",
-    "@grackle-ai/core": "0.135.2",
-    "@grackle-ai/plugin-core": "0.135.2",
-    "@grackle-ai/plugin-orchestration": "0.135.2",
-    "@grackle-ai/database": "0.135.2",
-    "@grackle-ai/common": "0.135.2",
-    "@grackle-ai/plugin-knowledge": "0.135.2",
-    "@grackle-ai/mcp": "0.135.2",
-    "@grackle-ai/plugin-scheduling": "0.135.2",
-    "@grackle-ai/plugin-sdk": "0.135.2",
-    "@grackle-ai/powerline": "0.135.2",
-    "@grackle-ai/web-server": "0.135.2"
+    "@grackle-ai/adapter-codespace": "0.136.0",
+    "@grackle-ai/adapter-docker": "0.136.0",
+    "@grackle-ai/adapter-sdk": "0.136.0",
+    "@grackle-ai/adapter-ssh": "0.136.0",
+    "@grackle-ai/adapter-local": "0.136.0",
+    "@grackle-ai/auth": "0.136.0",
+    "@grackle-ai/core": "0.136.0",
+    "@grackle-ai/plugin-core": "0.136.0",
+    "@grackle-ai/plugin-knowledge": "0.136.0",
+    "@grackle-ai/common": "0.136.0",
+    "@grackle-ai/plugin-orchestration": "0.136.0",
+    "@grackle-ai/database": "0.136.0",
+    "@grackle-ai/mcp": "0.136.0",
+    "@grackle-ai/plugin-sdk": "0.136.0",
+    "@grackle-ai/powerline": "0.136.0",
+    "@grackle-ai/web-server": "0.136.0",
+    "@grackle-ai/plugin-scheduling": "0.136.0"
   },
   "devDependencies": {
     "@rushstack/heft": "1.2.7",