@intentface/latch-mcp 0.17.1 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentface/latch-mcp",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "description": "Latch MCP host — connect to MCP servers as tools, with a per-tenant SSRF allowlist and vault-brokered auth.",
   "keywords": [
     "ai",
@@ -31,8 +31,8 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@intentface/latch-core": "^0.17.1",
-    "@intentface/latch-net": "^0.17.1"
+    "@intentface/latch-core": "^0.18.0",
+    "@intentface/latch-net": "^0.18.0"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": ">=2.0.0",
@@ -50,7 +50,7 @@
     "directory": "packages/mcp"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run"
   }

package/dist/approval.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=approval.test.d.ts.map

package/dist/approval.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval.test.d.ts","sourceRoot":"","sources":["../src/approval.test.ts"],"names":[],"mappings":""}

package/dist/approval.test.js

@@ -1,64 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { mcpApprovalValue, needsMcpApproval, nameHeuristicApproval, } from "./index.js";
-/**
- * The approval policy's two-level shape: a policy decides per TOOL (from its
- * descriptor/annotations), and may hand back a per-CALL function that decides
- * from the model's arguments. The call form exists for meta-tool servers —
- * one `execute_tool` multiplexing every operation carries a single annotation
- * set, so a per-tool boolean can only gate everything or nothing.
- */
-const READ_TOOL = {
-    name: "find_many_companies",
-    annotations: { readOnlyHint: true },
-};
-const WRITE_TOOL = {
-    name: "create_company",
-    annotations: { destructiveHint: true },
-};
-const META_TOOL = { name: "execute_tool" };
-describe("needsMcpApproval", () => {
-    it('"destructive" (default) keys on annotations', () => {
-        expect(needsMcpApproval(undefined, READ_TOOL)).toBe(false);
-        expect(needsMcpApproval(undefined, WRITE_TOOL)).toBe(true);
-        expect(needsMcpApproval("destructive", META_TOOL)).toBe(false); // no hints
-    });
-    it("passes a per-call function through from the predicate", () => {
-        const perCall = (input) => String(input?.toolName ?? "").startsWith("create_");
-        const gate = needsMcpApproval((tool) => (tool.name === "execute_tool" ? perCall : false), META_TOOL);
-        expect(gate).toBe(perCall);
-    });
-});
-describe("mcpApprovalValue — the SDK toolApproval map value", () => {
-    it("boolean policies map to 'user-approval' / undefined", () => {
-        expect(mcpApprovalValue("all", READ_TOOL)).toBe("user-approval");
-        expect(mcpApprovalValue("none", WRITE_TOOL)).toBeUndefined();
-        expect(mcpApprovalValue(undefined, WRITE_TOOL)).toBe("user-approval");
-        expect(mcpApprovalValue(undefined, READ_TOOL)).toBeUndefined();
-    });
-    it("a per-call policy gates by ARGUMENTS at call time", async () => {
-        const value = mcpApprovalValue((tool) => tool.name === "execute_tool"
-            ? (input) => /^(create|update|delete)_/.test(String(input?.toolName ?? ""))
-            : false, META_TOOL);
-        expect(typeof value).toBe("function");
-        const decide = value;
-        // The read that finding 1.2 saw gated — through the meta-tool — runs free…
-        expect(await decide({ toolName: "find_many_companies" })).toBeUndefined();
-        // …while the mutating operations still stop for a human.
-        expect(await decide({ toolName: "create_person" })).toBe("user-approval");
-        expect(await decide({ toolName: "delete_company" })).toBe("user-approval");
-    });
-    it("supports an async per-call decision", async () => {
-        const value = mcpApprovalValue(() => async () => true, META_TOOL);
-        const decide = value;
-        expect(await decide({})).toBe("user-approval");
-    });
-});
-describe("nameHeuristicApproval (unchanged behavior)", () => {
-    it("annotations stay authoritative; verb heuristic only without hints", () => {
-        const policy = nameHeuristicApproval();
-        expect(policy(READ_TOOL)).toBe(false); // readOnlyHint wins
-        expect(policy({ name: "create_deal" })).toBe(true); // verb, no hints
-        expect(policy({ name: "list_deals" })).toBe(false);
-    });
-});
-//# sourceMappingURL=approval.test.js.map

package/dist/approval.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval.test.js","sourceRoot":"","sources":["../src/approval.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,YAAY,CAAC;AAEpB;;;;;;GAMG;AAEH,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;CACpC,CAAC;AACF,MAAM,UAAU,GAAgB;IAC9B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;CACvC,CAAC;AACF,MAAM,SAAS,GAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAExD,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CACjC,MAAM,CAAE,KAA+B,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,gBAAgB,CAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAC1D,SAAS,CACV,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,gBAAgB,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,cAAc;YAC1B,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,0BAA0B,CAAC,IAAI,CAC7B,MAAM,CAAE,KAA+B,EAAE,QAAQ,IAAI,EAAE,CAAC,CACzD;YACL,CAAC,CAAC,KAAK,EACX,SAAS,CACV,CAAC;QACF,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,KAAiE,CAAC;QACjF,2EAA2E;QAC3E,MAAM,CAAC,MAAM,MAAM,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1E,yDAAyD;QACzD,MAAM,CAAC,MAAM,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,KAAiE,CAAC;QACjF,MAAM,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB;QAC3D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;QACrE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/connections-auth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=connections-auth.test.d.ts.map

package/dist/connections-auth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connections-auth.test.d.ts","sourceRoot":"","sources":["../src/connections-auth.test.ts"],"names":[],"mappings":""}

package/dist/connections-auth.test.js

@@ -1,34 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { bearer, bearerHeader } from "./index.js";
-/**
- * `bearer` is the one auth strategy whose header is COMPUTED per caller. The
- * default is the OAuth-style `Authorization: Bearer <token>`; a server keyed on
- * its own header (`X-API-Key: <key>`) names it explicitly. Pinned here because
- * the header is assembled at egress, out of sight of any integration test.
- */
-describe("bearerHeader", () => {
-    it("defaults to Authorization: Bearer <token>", () => {
-        expect(bearerHeader({}, "tok")).toEqual({ Authorization: "Bearer tok" });
-    });
-    it("sends the token in a custom header with no prefix", () => {
-        expect(bearerHeader({ header: "X-API-Key", prefix: "" }, "k1")).toEqual({
-            "X-API-Key": "k1",
-        });
-    });
-    it("keeps a custom prefix on the default header", () => {
-        expect(bearerHeader({ prefix: "Token " }, "abc")).toEqual({
-            Authorization: "Token abc",
-        });
-    });
-});
-describe("bearer()", () => {
-    it("omits header/prefix unless given, so the defaults apply", () => {
-        const auth = bearer({ getToken: () => "t" });
-        expect(auth).toEqual({ kind: "bearer", getToken: expect.any(Function) });
-    });
-    it("carries header/prefix through to the strategy", () => {
-        const auth = bearer({ getToken: () => "t", header: "X-API-Key", prefix: "" });
-        expect(auth).toMatchObject({ kind: "bearer", header: "X-API-Key", prefix: "" });
-    });
-});
-//# sourceMappingURL=connections-auth.test.js.map

package/dist/connections-auth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connections-auth.test.js","sourceRoot":"","sources":["../src/connections-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;GAKG;AACH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACtE,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YACxD,aAAa,EAAE,WAAW;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/guarded-fetch.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=guarded-fetch.test.d.ts.map

package/dist/guarded-fetch.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"guarded-fetch.test.d.ts","sourceRoot":"","sources":["../src/guarded-fetch.test.ts"],"names":[],"mappings":""}

package/dist/guarded-fetch.test.js

@@ -1,153 +0,0 @@
-/**
- * The fetch behind every MCP request — transport and OAuth alike.
- *
- * What is asserted here is the difference between "we checked the hostname"
- * and "we connected to the address we checked": the vetting happens inside the
- * lookup the socket itself uses, so a name cannot answer public to the check
- * and private to the connect. Plus the two things this wrapper adds on top of
- * the pinned fetch — redirects refused, and a `Request` unpacked rather than
- * handed to undici, which rejects one built by another fetch implementation.
- */
-import { createServer } from "node:http";
-import { afterEach, describe, expect, it } from "vitest";
-import { createGuardedFetch } from "./guarded-fetch.js";
-const A = (address, family = 4) => ({ address, family });
-const cleanups = [];
-afterEach(async () => {
-    while (cleanups.length)
-        await cleanups.pop()();
-});
-function guarded(...args) {
-    const f = createGuardedFetch(...args);
-    cleanups.push(() => f.close());
-    return f;
-}
-async function listen(server) {
-    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-    cleanups.push(() => new Promise((resolve) => server.close(resolve)));
-    return server.address().port;
-}
-/** A lookup backed by a mutable table — no real DNS in any test. */
-const tableLookup = (table) => (hostname, _options, cb) => {
-    const addrs = table[hostname];
-    if (!addrs)
-        return cb(Object.assign(new Error(`ENOTFOUND ${hostname}`), { code: "ENOTFOUND" }));
-    cb(null, addrs);
-};
-async function rejection(p) {
-    try {
-        await p;
-    }
-    catch (err) {
-        const parts = [];
-        const walk = (e) => {
-            if (!e)
-                return;
-            if (e instanceof AggregateError)
-                e.errors.forEach(walk);
-            if (e instanceof Error) {
-                parts.push(e.message);
-                walk(e.cause);
-            }
-        };
-        walk(err);
-        return parts.join(" <- ");
-    }
-    throw new Error("expected the fetch to reject");
-}
-describe("address vetting", () => {
-    it("refuses a name that resolves to an internal address", async () => {
-        // The cloud metadata endpoint, reached through a name the MCP server's
-        // metadata could perfectly well have pointed at.
-        const f = guarded({
-            lookup: tableLookup({ "auth.evil.example": [A("169.254.169.254")] }),
-        });
-        expect(await rejection(f("http://auth.evil.example/.well-known/openid-configuration"))).toMatch(/Blocked private\/internal address: auth\.evil\.example -> 169\.254\.169\.254/);
-    });
-    it("refuses a name that answers public first and private when the socket opens", async () => {
-        // DNS rebinding: the open-time check would pass, the connect would land
-        // inside. The vetting is in the lookup the socket uses, so there is no gap.
-        const table = { "rebind.example": [A("93.184.216.34")] };
-        const f = guarded({ lookup: tableLookup(table) });
-        table["rebind.example"] = [A("127.0.0.1")];
-        expect(await rejection(f("http://rebind.example/mcp"))).toMatch(/Blocked private\/internal address: rebind\.example -> 127\.0\.0\.1/);
-    });
-    it("permits a loopback server when the connection opted in", async () => {
-        // A developer's `http://localhost:3999/mcp`, and an in-cluster server.
-        const port = await listen(createServer((_req, res) => {
-            res.writeHead(200, { "content-type": "application/json" });
-            res.end('{"ok":true}');
-        }));
-        const f = guarded({ allowPrivateHost: true });
-        const res = await f(`http://127.0.0.1:${port}/mcp`);
-        expect(res.status).toBe(200);
-        expect(await res.json()).toEqual({ ok: true });
-    });
-});
-describe("what the wrapper adds", () => {
-    it("refuses to follow a redirect, even when the caller asks for one", async () => {
-        // A 302 names an address nothing vetted; no MCP or OAuth leg needs one.
-        const port = await listen(createServer((_req, res) => {
-            res.writeHead(302, { location: "http://169.254.169.254/latest/meta-data/" });
-            res.end();
-        }));
-        const f = guarded({ allowPrivateHost: true });
-        expect(await rejection(f(`http://127.0.0.1:${port}/`, { redirect: "follow" }))).toMatch(/redirect/i);
-    });
-    it("carries the Request's abort signal, so a cancelled call releases its socket", async () => {
-        // Without this the reconstruction drops `signal` and an aborted MCP or
-        // OAuth call keeps its socket until the server finally answers.
-        let release;
-        const held = new Promise((resolve) => (release = resolve));
-        cleanups.push(() => release());
-        const port = await listen(createServer(async (_req, res) => {
-            await held; // never answers until the test lets it
-            res.writeHead(200);
-            res.end("late");
-        }));
-        const f = guarded({ allowPrivateHost: true });
-        const controller = new AbortController();
-        const inflight = f(new Request(`http://127.0.0.1:${port}/slow`, { signal: controller.signal }));
-        controller.abort();
-        expect(await rejection(inflight)).toMatch(/abort/i);
-    });
-    it("an explicit init signal replaces the Request's", async () => {
-        const port = await listen(createServer((_req, res) => {
-            res.writeHead(200);
-            res.end("ok");
-        }));
-        const f = guarded({ allowPrivateHost: true });
-        const requestSide = new AbortController();
-        requestSide.abort(); // already aborted — must NOT decide the outcome
-        const res = await f(new Request(`http://127.0.0.1:${port}/`, { signal: requestSide.signal }), {
-            signal: new AbortController().signal,
-        });
-        expect(res.status).toBe(200);
-    });
-    it("unpacks a Request rather than handing it to undici", async () => {
-        // undici rejects a Request built by another fetch implementation
-        // (cross-realm brand check), so a caller passing one must not silently
-        // bypass the guard — method, headers and body have to survive.
-        let seen = {};
-        const port = await listen(createServer((req, res) => {
-            let body = "";
-            req.on("data", (c) => (body += c));
-            req.on("end", () => {
-                seen = { method: req.method, auth: req.headers.authorization, body };
-                res.writeHead(200, { "content-type": "application/json" });
-                res.end('{"ok":true}');
-            });
-        }));
-        const f = guarded({ allowPrivateHost: true });
-        const res = await f(new Request(`http://127.0.0.1:${port}/token`, {
-            method: "POST",
-            headers: { authorization: "Bearer t0ken", "content-type": "application/json" },
-            body: '{"grant_type":"authorization_code"}',
-        }));
-        expect(res.status).toBe(200);
-        expect(seen.method).toBe("POST");
-        expect(seen.auth).toBe("Bearer t0ken");
-        expect(seen.body).toBe('{"grant_type":"authorization_code"}');
-    });
-});
-//# sourceMappingURL=guarded-fetch.test.js.map

package/dist/guarded-fetch.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guarded-fetch.test.js","sourceRoot":"","sources":["../src/guarded-fetch.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAG3E,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,MAAM,GAAG,CAAC,EAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAEvE,MAAM,QAAQ,GAA4C,EAAE,CAAC;AAC7D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,OAAO,QAAQ,CAAC,MAAM;QAAE,MAAM,QAAQ,CAAC,GAAG,EAAG,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,GAAG,IAA2C;IAC7D,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAc;IAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,OAAQ,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,MAAM,WAAW,GACf,CAAC,KAA6B,EAAE,EAAE,CAClC,CACE,QAAgB,EAChB,QAAiB,EACjB,EAA+D,EACzD,EAAE;IACR,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAChG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAClB,CAAC,CAAC;AAEJ,KAAK,UAAU,SAAS,CAAC,CAAmB;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,CAAC;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;YAChC,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,IAAI,CAAC,YAAY,cAAc;gBAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAClD,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,CAAC,GAAG,OAAO,CAAC;YAChB,MAAM,EAAE,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAU;SAC9E,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,CAAC,OAAO,CAC7F,8EAA8E,CAC/E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,KAAK,GAA2B,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAU,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,OAAO,CAC7D,oEAAoE,CACrE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,oBAAoB,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,wEAAwE;QACxE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC7E,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CACJ,MAAM,SAAS,CAAC,CAAC,CAAC,oBAAoB,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CACxE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,OAAoB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC/B,MAAM,IAAI,CAAC,CAAC,uCAAuC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,CAAC,CAChB,IAAI,OAAO,CAAC,oBAAoB,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAC5E,CAAC;QACF,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;QAC1C,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,gDAAgD;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,oBAAoB,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE;YAC5F,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,IAAI,GAAsD,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;gBACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CACjB,IAAI,OAAO,CAAC,oBAAoB,IAAI,QAAQ,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC9E,IAAI,EAAE,qCAAqC;SAC5C,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/host-output.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=host-output.test.d.ts.map

package/dist/host-output.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-output.test.d.ts","sourceRoot":"","sources":["../src/host-output.test.ts"],"names":[],"mappings":""}

package/dist/host-output.test.js

@@ -1,51 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { withStructuredContentFallback } from "./host.js";
-const call = (output, original) => withStructuredContentFallback(original)({ toolCallId: "c1", input: {}, output });
-describe("withStructuredContentFallback", () => {
-    it("returns structuredContent as JSON when content is empty (Airtable-style)", () => {
-        const output = {
-            content: [],
-            structuredContent: { bases: [{ id: "app1", name: "ATS" }] },
-            isError: false,
-        };
-        expect(call(output)).toEqual({
-            type: "json",
-            value: { bases: [{ id: "app1", name: "ATS" }] },
-        });
-    });
-    it("falls back when content only holds blank text parts", () => {
-        const output = {
-            content: [{ type: "text", text: "  " }],
-            structuredContent: { ok: true },
-        };
-        expect(call(output)).toEqual({ type: "json", value: { ok: true } });
-    });
-    it("keeps the SDK mapping when content carries real text", () => {
-        const output = {
-            content: [{ type: "text", text: "3 bases found" }],
-            structuredContent: { bases: [] },
-        };
-        const original = () => ({ type: "content", value: [{ type: "text", text: "3 bases found" }] });
-        expect(call(output, original)).toEqual({
-            type: "content",
-            value: [{ type: "text", text: "3 bases found" }],
-        });
-    });
-    it("keeps the SDK mapping for non-text parts (images)", () => {
-        const output = {
-            content: [{ type: "image", data: "…", mimeType: "image/png" }],
-            structuredContent: { alt: "chart" },
-        };
-        const original = () => "sdk";
-        expect(call(output, original)).toBe("sdk");
-    });
-    it("leaves errors alone even with structuredContent present", () => {
-        const output = { content: [], structuredContent: { reason: "x" }, isError: true };
-        const original = () => "sdk-error-path";
-        expect(call(output, original)).toBe("sdk-error-path");
-    });
-    it("passes plain results through as JSON when no original mapper exists", () => {
-        expect(call({ anything: 1 })).toEqual({ type: "json", value: { anything: 1 } });
-    });
-});
-//# sourceMappingURL=host-output.test.js.map

package/dist/host-output.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-output.test.js","sourceRoot":"","sources":["../src/host-output.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAE1D,MAAM,IAAI,GAAG,CAAC,MAAe,EAAE,QAAmC,EAAE,EAAE,CACpE,6BAA6B,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAEnF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,EAAE;YACX,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;YAC3D,OAAO,EAAE,KAAK;SACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3B,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,iBAAiB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SAChC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAClD,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;SACjC,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YACrC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC9D,iBAAiB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;SACpC,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/oauth-fetch.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oauth-fetch.test.d.ts.map

package/dist/oauth-fetch.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-fetch.test.d.ts","sourceRoot":"","sources":["../src/oauth-fetch.test.ts"],"names":[],"mappings":""}

package/dist/oauth-fetch.test.js

@@ -1,25 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createOAuthDiscoveryFetch } from "./oauth-fetch.js";
-/** A fetch that serves one discovery document for every URL. */
-const serving = (doc) => async () => new Response(JSON.stringify(doc), { status: 200, headers: { "content-type": "application/json" } });
-describe("createOAuthDiscoveryFetch", () => {
-    it("forces https on a proxied server's discovery, and strips the issuer's trailing slash", async () => {
-        const f = createOAuthDiscoveryFetch({
-            forceScheme: "https",
-            baseFetch: serving({ issuer: "http://mcp.example.com/", token_endpoint: "http://mcp.example.com/token" }),
-        });
-        const doc = await (await f("https://mcp.example.com/.well-known/oauth-authorization-server")).json();
-        expect(doc).toMatchObject({ issuer: "https://mcp.example.com", token_endpoint: "https://mcp.example.com/token" });
-    });
-    it.each(["localhost", "127.0.0.1", "[::1]"])("leaves a local server's http scheme alone (%s)", async (host) => {
-        const f = createOAuthDiscoveryFetch({
-            forceScheme: "https",
-            baseFetch: serving({ resource: `http://${host}:3011/mcp`, authorization_servers: [`http://${host}:3011/api/auth/`] }),
-        });
-        const doc = await (await f(`http://${host}:3011/.well-known/oauth-protected-resource/mcp`)).json();
-        // The SDK compares `resource` with the URL it connected to; https here broke every local server.
-        expect(doc.resource).toBe(`http://${host}:3011/mcp`);
-        expect(doc.authorization_servers[0]).toMatch(/^http:\/\//);
-    });
-});
-//# sourceMappingURL=oauth-fetch.test.js.map

package/dist/oauth-fetch.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-fetch.test.js","sourceRoot":"","sources":["../src/oauth-fetch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,gEAAgE;AAChE,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAEtG,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,CAAC,GAAG,yBAAyB,CAAC;YAClC,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,cAAc,EAAE,8BAA8B,EAAE,CAAC;SAC1G,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrG,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,gDAAgD,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5G,MAAM,CAAC,GAAG,yBAAyB,CAAC;YAClC,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,IAAI,WAAW,EAAE,qBAAqB,EAAE,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;SACtH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,IAAI,gDAAgD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnG,iGAAiG;QACjG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/oauth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oauth.test.d.ts.map

package/dist/oauth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.test.d.ts","sourceRoot":"","sources":["../src/oauth.test.ts"],"names":[],"mappings":""}

package/dist/oauth.test.js

@@ -1,275 +0,0 @@
-import { describe, expect, it, vi, beforeEach } from "vitest";
-/**
- * `scope` may be a function, resolved per caller at flow time.
- *
- * This is a correctness requirement rather than API sugar: a single `McpOAuth`
- * is shared across callers (UI-added connections are cached by connection
- * NAME, while the connection record — and therefore its requested scopes —
- * lives in each caller's own Vault). A static scope string would send one
- * caller's scopes on another caller's authorize request, which for a
- * *restriction* scope like Loredex's `private_only` means silently handing
- * someone a broader grant than their connection asked for.
- */
-const authMock = vi.hoisted(() => vi.fn());
-vi.mock("@ai-sdk/mcp", () => ({
-    auth: authMock,
-}));
-const { createMcpOAuth, decodeOAuthState } = await import("./oauth.js");
-/** Minimal in-memory Vault, keyed by principal so callers stay separate. */
-function fakeVault() {
-    const store = new Map();
-    const k = (p, key) => `${p.userId}::${key}`;
-    return {
-        async set(p, key, value) {
-            store.set(k(p, key), value);
-        },
-        async get(p, key) {
-            return store.get(k(p, key));
-        },
-        async has(p, key) {
-            return store.has(k(p, key));
-        },
-        async delete(p, key) {
-            store.delete(k(p, key));
-        },
-        async list(p) {
-            return [...store.keys()].filter((x) => x.startsWith(`${p.userId}::`));
-        },
-        resolver: {},
-        _store: store,
-    };
-}
-function build(scope, vault = fakeVault()) {
-    return {
-        vault,
-        oauth: createMcpOAuth({
-            vault: vault,
-            config: {
-                name: "loredex",
-                serverUrl: "https://loredex.example/ws/mcp",
-                redirectUrl: "https://latch.example/cb",
-                clientMetadata: {
-                    client_name: "Latch (loredex)",
-                    redirect_uris: ["https://latch.example/cb"],
-                },
-                scope: scope,
-            },
-        }),
-    };
-}
-/** The `scope` value handed to the SDK on the most recent `start()`. */
-const lastScope = () => authMock.mock.calls.at(-1)?.[1]?.scope;
-beforeEach(() => {
-    authMock.mockReset();
-    authMock.mockResolvedValue("AUTHORIZED");
-});
-describe("createMcpOAuth scope resolution", () => {
-    it("passes a static scope through unchanged", async () => {
-        const { oauth } = build("private_only");
-        await oauth.start({ userId: "u1" });
-        expect(lastScope()).toBe("private_only");
-    });
-    it("omits the scope entirely when unset", async () => {
-        // Connections that request nothing must keep their previous, scope-less
-        // authorize request — adding an empty `scope=` would change the ask.
-        const { oauth } = build(undefined);
-        await oauth.start({ userId: "u1" });
-        expect(lastScope()).toBeUndefined();
-    });
-    it("resolves a function scope per caller", async () => {
-        // The core requirement: two callers of the SAME connection get their own
-        // scopes, because the record is per-caller while the client is shared.
-        const scopes = {
-            u1: "private_only",
-            u2: undefined,
-        };
-        const { oauth } = build((p) => scopes[p.userId]);
-        await oauth.start({ userId: "u1" });
-        expect(lastScope()).toBe("private_only");
-        await oauth.start({ userId: "u2" });
-        expect(lastScope()).toBeUndefined();
-        // ...and back again, so nothing was cached from the first resolution.
-        await oauth.start({ userId: "u1" });
-        expect(lastScope()).toBe("private_only");
-    });
-    it("awaits an async scope resolver", async () => {
-        // The real resolver reads the connection out of the Vault, so it is async.
-        const { oauth } = build(async (p) => p.userId === "u1" ? "mcp:read private_only" : undefined);
-        await oauth.start({ userId: "u1" });
-        expect(lastScope()).toBe("mcp:read private_only");
-    });
-});
-describe("authorizationParams", () => {
-    // Providers like Google need extra authorize params the SDK doesn't model
-    // (`access_type=offline&prompt=consent` for a refresh token). They are
-    // appended to the SDK-built redirect URL in start().
-    it("appends the configured params to the authorization URL", async () => {
-        const vault = fakeVault();
-        const oauth = createMcpOAuth({
-            vault: vault,
-            config: {
-                name: "gcal",
-                serverUrl: "https://calendarmcp.example/mcp/v1",
-                redirectUrl: "https://latch.example/cb",
-                clientMetadata: {
-                    client_name: "Latch (gcal)",
-                    redirect_uris: ["https://latch.example/cb"],
-                },
-                authorizationParams: { access_type: "offline", prompt: "consent" },
-            },
-        });
-        // Simulate the SDK asking for a browser redirect.
-        authMock.mockImplementationOnce(async (provider) => {
-            provider.redirectToAuthorization(new URL("https://idp.example/authorize?client_id=abc"));
-            return "REDIRECT";
-        });
-        const res = await oauth.start({ userId: "u1" });
-        if (res.status !== "redirect")
-            throw new Error("expected redirect");
-        const url = new URL(res.authorizationUrl);
-        expect(url.searchParams.get("client_id")).toBe("abc"); // SDK params kept
-        expect(url.searchParams.get("access_type")).toBe("offline");
-        expect(url.searchParams.get("prompt")).toBe("consent");
-    });
-});
-describe("state encoding", () => {
-    it("round-trips app context (incl. a pinned principal) through decodeOAuthState", async () => {
-        // The handler pins the resolved principal into the flow state at
-        // authorize time; the callback must recover it byte-for-byte.
-        const { oauth } = build(undefined);
-        const stateData = {
-            returnTo: "/chat/c1",
-            __latch: { p: { orgId: "org_a", userId: "u1" }, iat: 1_700_000_000_000 },
-        };
-        let sent;
-        authMock.mockImplementationOnce(async (provider) => {
-            sent = provider.state();
-            await provider.saveState(sent);
-            provider.redirectToAuthorization(new URL("https://idp.example/authorize"));
-            return "REDIRECT";
-        });
-        await oauth.start({ userId: "u1" }, { state: stateData });
-        expect(decodeOAuthState(sent)).toEqual(stateData);
-    });
-    it("returns undefined for a bare csrf or garbage", () => {
-        expect(decodeOAuthState("deadbeef")).toBeUndefined();
-        expect(decodeOAuthState("deadbeef.%%%not-b64%%%")).toBeUndefined();
-        expect(decodeOAuthState(null)).toBeUndefined();
-    });
-});
-describe("finish", () => {
-    it("deletes the spent state + verifier but keeps tokens/client/as_info", async () => {
-        // Single-use flow state: a replayed callback URL must find no stored flow
-        // material — while the durable credential parts survive.
-        const { vault, oauth } = build(undefined);
-        const p = { userId: "u1" };
-        for (const part of ["tokens", "verifier", "state", "client", "as_info"]) {
-            await vault.set(p, `mcp_oauth:loredex:${part}`, "x");
-        }
-        authMock.mockResolvedValueOnce("AUTHORIZED");
-        await oauth.finish(p, { code: "abc", state: "deadbeef" });
-        expect(await vault.has(p, "mcp_oauth:loredex:state")).toBe(false);
-        expect(await vault.has(p, "mcp_oauth:loredex:verifier")).toBe(false);
-        expect(await vault.has(p, "mcp_oauth:loredex:tokens")).toBe(true);
-        expect(await vault.has(p, "mcp_oauth:loredex:client")).toBe(true);
-        expect(await vault.has(p, "mcp_oauth:loredex:as_info")).toBe(true);
-    });
-    it("does not delete flow state when the exchange throws", async () => {
-        // A transient exchange failure must leave the flow re-tryable.
-        const { vault, oauth } = build(undefined);
-        const p = { userId: "u1" };
-        await vault.set(p, "mcp_oauth:loredex:state", "s");
-        await vault.set(p, "mcp_oauth:loredex:verifier", "v");
-        authMock.mockRejectedValueOnce(new Error("exchange failed"));
-        await expect(oauth.finish(p, { code: "abc", state: "s" })).rejects.toThrow();
-        expect(await vault.has(p, "mcp_oauth:loredex:state")).toBe(true);
-        expect(await vault.has(p, "mcp_oauth:loredex:verifier")).toBe(true);
-    });
-});
-describe("invalidateCredentials", () => {
-    it("clears the DCR client as well as the tokens", async () => {
-        // A scope change re-runs registration: the stored client was registered
-        // under the old scope, so keeping it would re-request the old grant.
-        const { vault, oauth } = build("private_only");
-        const p = { userId: "u1" };
-        for (const part of ["tokens", "verifier", "state", "client", "as_info"]) {
-            await vault.set(p, `mcp_oauth:loredex:${part}`, "x");
-        }
-        await oauth.provider(p).invalidateCredentials?.("all");
-        expect(await vault.list(p)).toEqual([]);
-    });
-    it("leaves another caller's tokens alone", async () => {
-        const { vault, oauth } = build("private_only");
-        const mine = { userId: "u1" };
-        const theirs = { userId: "u2" };
-        await vault.set(mine, "mcp_oauth:loredex:tokens", "mine");
-        await vault.set(theirs, "mcp_oauth:loredex:tokens", "theirs");
-        await oauth.provider(mine).invalidateCredentials?.("all");
-        expect(await vault.get(theirs, "mcp_oauth:loredex:tokens")).toBe("theirs");
-    });
-});
-/**
- * The authorization-server allowlist.
- *
- * An MCP server's protected-resource metadata NAMES its authorization server,
- * and Latch then fetches that server's metadata, registers a client with it and
- * posts the code to it. Unbounded, that is "connect to whatever address the
- * server operator writes down" — an SSRF whose errors carry the response back
- * to whoever added the connection. So the bound defaults to the MCP server's
- * own origin, and delegating elsewhere has to be declared.
- */
-describe("authorization-server allowlist", () => {
-    const principal = { userId: "u1" };
-    const serverUrl = "https://loredex.example/ws/mcp";
-    function providerFor(allowedAuthorizationServers) {
-        const vault = fakeVault();
-        return createMcpOAuth({
-            vault: vault,
-            config: {
-                name: "loredex",
-                serverUrl,
-                redirectUrl: "https://latch.example/cb",
-                clientMetadata: {
-                    client_name: "Latch (loredex)",
-                    redirect_uris: ["https://latch.example/cb"],
-                },
-                ...(allowedAuthorizationServers ? { allowedAuthorizationServers } : {}),
-            },
-        }).provider(principal);
-    }
-    const validate = (p, as) => p.validateAuthorizationServerURL(serverUrl, as);
-    it("undeclared, an authorization server on another origin is refused", () => {
-        // The whole attack in one line: the metadata names an internal address.
-        expect(() => validate(providerFor(), "http://10.0.0.7:8500/register")).toThrow(/authorization server http:\/\/10\.0\.0\.7:8500 is not allowed/);
-    });
-    it("undeclared, the MCP server's own origin is allowed", () => {
-        // The common case — a server that is its own authorization server — keeps
-        // working with no host configuration at all.
-        expect(() => validate(providerFor(), "https://loredex.example/oauth/authorize")).not.toThrow();
-    });
-    it("a declared third-party authorization server is allowed", () => {
-        const p = providerFor(["https://accounts.google.com"]);
-        expect(() => validate(p, "https://accounts.google.com/o/oauth2/v2/auth")).not.toThrow();
-        // …and declaring one does not re-admit everything else.
-        expect(() => validate(p, "http://169.254.169.254/")).toThrow(/is not allowed/);
-    });
-    it("an empty list allows nothing, rather than everything", () => {
-        // The old reading of `[]` was "not configured → allow any", which is how
-        // the guard came to be dead code.
-        expect(() => validate(providerFor([]), "https://loredex.example/oauth/authorize")).toThrow(/is not allowed/);
-    });
-    it("the refusal names the origin and quotes no response body", () => {
-        let message = "";
-        try {
-            validate(providerFor(), "http://10.0.0.7:8500/register");
-        }
-        catch (e) {
-            message = e.message;
-        }
-        expect(message).toContain("http://10.0.0.7:8500");
-        expect(message).toContain("allowedAuthorizationServers");
-        // The SDK's own errors embed `Raw body: …`; ours must never grow one.
-        expect(message).not.toMatch(/raw body|<html|\{"error"/i);
-    });
-});
-//# sourceMappingURL=oauth.test.js.map

package/dist/oauth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.test.js","sourceRoot":"","sources":["../src/oauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAE3C,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,IAAI,EAAE,QAAQ;CACf,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAMxE,4EAA4E;AAC5E,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;IACvD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,KAAa;YACxC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,CAAI,EAAE,GAAW;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAI;YACb,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,QAAQ,EAAE,EAAW;QACrB,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAK,GAAG,SAAS,EAAE;IAChD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,cAAc,CAAI;YACvB,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,gCAAgC;gBAC3C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,iBAAiB;oBAC9B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,KAAK,EAAE,KAAc;aACtB;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;AAE/D,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,CAAC,SAAS,EAAE,CAAC;IACrB,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAuC;YACjD,EAAE,EAAE,cAAc;YAClB,EAAE,EAAE,SAAS;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpD,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEzC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,2EAA2E;QAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAI,EAAE,EAAE,CACrC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc,CAAI;YAC9B,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,oCAAoC;gBAC/C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,cAAc;oBAC3B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,mBAAmB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;aACnE;SACF,CAAC,CAAC;QACH,kDAAkD;QAClD,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAEtC,EAAE,EAAE;YACH,QAAQ,CAAC,uBAAuB,CAC9B,IAAI,GAAG,CAAC,6CAA6C,CAAC,CACvD,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QACzE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;SACzE,CAAC;QACF,IAAI,IAAwB,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAItC,EAAE,EAAE;YACH,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3E,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,+DAA+D;QAC/D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACtD,QAAQ,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,MAAM,SAAS,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,gCAAgC,CAAC;IAEnD,SAAS,WAAW,CAAC,2BAAsC;QACzD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAI;YACvB,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,iBAAiB;oBAC9B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF,CAAC,CAAC,QAAQ,CAAC,SAAS,CAEpB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAiC,EAAE,EAAU,EAAE,EAAE,CACjE,CAAC,CAAC,8BAA8B,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAElD,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,wEAAwE;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAC5E,+DAA+D,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,yCAAyC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,8CAA8C,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACxF,wDAAwD;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,yCAAyC,CAAC,CAAC,CAAC,OAAO,CACxF,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,CAAC,WAAW,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAI,CAAW,CAAC,OAAO,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACzD,sEAAsE;QACtE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}