@kietdev/taiga-mcp 0.0.0-stage → 0.4.0

package/dist/remote/app.js

@@ -0,0 +1,238 @@
+import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
+import { getOAuthProtectedResourceMetadataUrl, mcpAuthRouter, } from '@modelcontextprotocol/sdk/server/auth/router.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import express, {} from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { fileURLToPath } from 'node:url';
+import { createServer } from '../server.js';
+import { TaigaClient } from '../taiga/client.js';
+import { TaigaError } from '../taiga/http.js';
+import { guardedFetch } from './guard.js';
+import { expiredPage, homePage, loginPage, SCRIPT_HASH } from './pages.js';
+import { READ, TaigaOAuthProvider, WRITE } from './provider.js';
+import { Sealer } from './seal.js';
+import { TaigaAuth } from './taiga-auth.js';
+const EXPIRED_HINT = 'The Taiga sign-in behind this connection has expired. Disconnect the Taiga connector and connect it again to sign in.';
+/** The icons, the preview image and robots.txt. From src/remote and from dist/remote it is two folders up. */
+const PUBLIC_DIR = fileURLToPath(new URL('../../public', import.meta.url));
+/** The language a link asked for with `?lang=`, if it is one the pages are written in. */
+function chosenLang(req) {
+    const { lang } = req.query;
+    return lang === 'vi' || lang === 'en' ? lang : undefined;
+}
+/**
+ * The language of a link that names one; otherwise Vietnamese for a browser that prefers it
+ * over English, and English for everyone else.
+ */
+function langOf(req) {
+    const chosen = chosenLang(req);
+    if (chosen !== undefined)
+        return chosen;
+    for (const tag of req.acceptsLanguages()) {
+        const language = tag.toLowerCase().split('-')[0];
+        if (language === 'vi' || language === 'en')
+            return language;
+    }
+    return 'en';
+}
+/**
+ * Pages with a password field: never cached, never framed, nothing loaded from elsewhere
+ * (the only thing loaded at all is this server's own icon). The only script allowed is the copy
+ * buttons' on the front page, by its hash; the sign-in page carries none.
+ */
+function sendPage(res, status, html) {
+    res
+        .status(status)
+        .set({
+        'Cache-Control': 'no-store',
+        'Content-Security-Policy': `default-src 'none'; script-src ${SCRIPT_HASH}; style-src 'unsafe-inline'; img-src 'self'; base-uri 'none'; frame-ancestors 'none'`,
+        // The same address answers in English or Vietnamese.
+        Vary: 'Accept-Language',
+        'Referrer-Policy': 'no-referrer',
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'DENY',
+    })
+        .type('html')
+        .send(html);
+}
+/**
+ * The hosted server: the same tools over HTTP, for many people at once.
+ *
+ * Each person signs in with their own Taiga account through the OAuth pages, and every request
+ * to `/mcp` is answered with that person's Taiga token, so they see what Taiga lets them see.
+ * The server is set up either for one Taiga, or (`anyTaiga`) for whichever Taiga each person names.
+ * Nothing is kept between requests: no sessions, no stored tokens, no cache shared by two people.
+ */
+export function createApp(options) {
+    const anyTaiga = options.anyTaiga === true;
+    const allowWrites = options.allowWrites === true;
+    const fixedTaiga = anyTaiga ? undefined : options.taigaUrl;
+    if (!anyTaiga && fixedTaiga === undefined)
+        throw new Error('taigaUrl is required unless anyTaiga is set');
+    const fixedHost = fixedTaiga === undefined ? undefined : new URL(fixedTaiga).host;
+    // Requests to an address a stranger typed never leave the public internet.
+    const fetchImpl = options.fetch ?? (anyTaiga ? guardedFetch : fetch);
+    const now = options.now ?? (() => new Date());
+    const seconds = () => Math.floor(now().getTime() / 1000);
+    const mcpUrl = new URL('/mcp', options.publicUrl);
+    const provider = new TaigaOAuthProvider({
+        sealer: new Sealer(options.secret, seconds),
+        taigaAt: (baseUrl) => new TaigaAuth(baseUrl, fetchImpl),
+        fixedTaiga,
+        resource: mcpUrl,
+        allowWrites,
+        now: seconds,
+        showLogin: (res, view) => sendPage(res, 200, loginPage({ lang: langOf(res.req), fixedHost, address: options.taigaUrl, ...view })),
+    });
+    const app = express();
+    app.disable('x-powered-by');
+    app.set('trust proxy', options.trustProxy ?? 0);
+    /* ------------------------------ signing in ------------------------------ */
+    // /authorize, /token, /register and the two discovery documents.
+    app.use(mcpAuthRouter({
+        provider,
+        issuerUrl: options.publicUrl,
+        resourceServerUrl: mcpUrl,
+        scopesSupported: allowWrites ? [READ, WRITE] : [READ],
+        resourceName: `Taiga${fixedHost === undefined ? '' : ` at ${fixedHost}`}${allowWrites ? '' : ' (read-only)'}`,
+    }));
+    const showLoginAgain = (req, res, status, error) => {
+        const { request, username, address, write } = req.body;
+        const asker = provider.describeLogin(request);
+        if (asker === undefined) {
+            sendPage(res, 400, expiredPage(langOf(req)));
+            return;
+        }
+        sendPage(res, status, loginPage({
+            lang: langOf(req),
+            fixedHost,
+            address,
+            ...asker,
+            request,
+            error,
+            username,
+            write: write === 'on',
+        }));
+    };
+    app.post('/login', express.urlencoded({ extended: false, limit: '16kb' }), (req, res, next) => {
+        const body = (req.body ?? {});
+        if (typeof body['request'] !== 'string' || body['request'] === '') {
+            sendPage(res, 400, expiredPage(langOf(req)));
+            return;
+        }
+        next();
+    }, 
+    // Taiga throttles sign-ins too; this keeps a guesser from using the server as a relay.
+    rateLimit({
+        windowMs: 15 * 60 * 1000,
+        limit: 10,
+        standardHeaders: true,
+        legacyHeaders: false,
+        handler: (req, res) => showLoginAgain(req, res, 429, 'tooMany'),
+    }), async (req, res) => {
+        const { request, username, password, address, write } = req.body;
+        if (typeof username !== 'string' || typeof password !== 'string' || !username || !password) {
+            showLoginAgain(req, res, 400, 'rejected');
+            return;
+        }
+        try {
+            const outcome = await provider.completeLogin(request, username.trim(), password, typeof address === 'string' ? address : undefined, 
+            // A ticked checkbox sends "on"; an unticked one sends nothing.
+            write === 'on');
+            if (outcome.kind === 'redirect') {
+                res.set('Cache-Control', 'no-store').redirect(302, outcome.url);
+            }
+            else if (outcome.kind === 'rejected') {
+                showLoginAgain(req, res, 401, 'rejected');
+            }
+            else if (outcome.kind === 'badAddress') {
+                showLoginAgain(req, res, 400, 'badAddress');
+            }
+            else {
+                sendPage(res, 400, expiredPage(langOf(req)));
+            }
+        }
+        catch (error) {
+            // The reason may name the Taiga host; it never contains the username or the password.
+            console.error(`taiga-mcp: sign-in could not be checked: ${String(error)}`);
+            // At a typed address, anything but "busy" or "broken" most likely means it is not a Taiga.
+            const busy = error instanceof TaigaError && (error.status === 429 || (error.status ?? 0) >= 500);
+            if (anyTaiga && !busy)
+                showLoginAgain(req, res, 400, 'badAddress');
+            else
+                showLoginAgain(req, res, 502, 'unavailable');
+        }
+    });
+    /* ------------------------------- the tools ------------------------------- */
+    const bearer = requireBearerAuth({
+        verifier: provider,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpUrl),
+        expectedResource: mcpUrl,
+    });
+    // Tokens travel in a header, never in a cookie, so any web page may call the endpoint.
+    app.use('/mcp', (req, res, next) => {
+        res.set({
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Headers': 'Authorization, Content-Type, Accept, Mcp-Protocol-Version, Mcp-Session-Id',
+            'Access-Control-Allow-Methods': 'POST, OPTIONS',
+            'Access-Control-Expose-Headers': 'WWW-Authenticate, Mcp-Session-Id',
+        });
+        if (req.method === 'OPTIONS') {
+            res.status(204).end();
+            return;
+        }
+        next();
+    });
+    app.post('/mcp', bearer, express.json({ limit: '1mb' }), async (req, res) => {
+        const { taigaUrl: baseUrl, taigaToken: token, write } = req.auth?.extra ?? {};
+        if (typeof baseUrl !== 'string' || typeof token !== 'string') {
+            res.status(401).json({ error: 'invalid_token' });
+            return;
+        }
+        // A server and a Taiga client per request: nothing one person reads is kept for the next.
+        const server = createServer(new TaigaClient({ baseUrl, token, expiredHint: EXPIRED_HINT, write: write === true }, fetchImpl, now), allowWrites && write !== true
+            ? {
+                howToAllowWrites: 'disconnect the Taiga connector, connect it again, and tick the box on the sign-in page that allows changes.',
+            }
+            : {});
+        const transport = new StreamableHTTPServerTransport({ enableJsonResponse: true });
+        res.on('close', () => {
+            void transport.close();
+            void server.close();
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+    });
+    // No sessions and no server-sent stream: the endpoint only answers POST.
+    app.all('/mcp', (_req, res) => {
+        res
+            .status(405)
+            .set('Allow', 'POST')
+            .json({ jsonrpc: '2.0', error: { code: -32000, message: 'Method not allowed. Use POST.' }, id: null });
+    });
+    /* -------------------------------- the rest -------------------------------- */
+    app.get('/', (req, res) => {
+        sendPage(res, 200, homePage(langOf(req), fixedHost, options.publicUrl, chosenLang(req), allowWrites));
+    });
+    // Hosts that serve `public/` themselves (Vercel) answer these before the app is asked.
+    app.use(express.static(PUBLIC_DIR, { index: false, maxAge: '1d' }));
+    app.get('/healthz', (_req, res) => {
+        res.json({ ok: true });
+    });
+    app.use((_req, res) => {
+        res.status(404).json({ error: 'not_found' });
+    });
+    // Express tells an error handler from a route by its four parameters.
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    app.use((error, _req, res, _next) => {
+        const status = typeof error === 'object' && error !== null && 'status' in error && typeof error.status === 'number'
+            ? error.status
+            : 500;
+        if (status >= 500)
+            console.error(`taiga-mcp: request failed: ${String(error)}`);
+        if (!res.headersSent)
+            res.status(status).json({ error: status >= 500 ? 'server_error' : 'bad_request' });
+    });
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/remote/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/remote/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACnG,OAAO,EACL,oCAAoC,EACpC,aAAa,GACd,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,EAAE,EAAgE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAA8B,MAAM,YAAY,CAAC;AACvG,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,MAAM,YAAY,GAChB,uHAAuH,CAAC;AAE1H,8GAA8G;AAC9G,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3E,0FAA0F;AAC1F,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAC3B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAa,EAAE,MAAc,EAAE,IAAY;IAC3D,GAAG;SACA,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC;QACH,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EAAE,kCAAkC,WAAW,sFAAsF;QAC9J,qDAAqD;QACrD,IAAI,EAAE,iBAAiB;QACvB,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;SACD,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC;IACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAClF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC;QACtC,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC;QACvD,UAAU;QACV,QAAQ,EAAE,MAAM;QAChB,WAAW;QACX,GAAG,EAAE,OAAO;QACZ,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CACvB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;KAC1G,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IAEhD,8EAA8E;IAE9E,iEAAiE;IACjE,GAAG,CAAC,GAAG,CACL,aAAa,CAAC;QACZ,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,MAAM;QACzB,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,YAAY,EAAE,QAAQ,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;KAC9G,CAAC,CACH,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,MAAc,EAAE,KAAiB,EAAE,EAAE;QACxF,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAEjD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,QAAQ,CACN,GAAG,EACH,MAAM,EACN,SAAS,CAAC;YACR,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;YACjB,SAAS;YACT,OAAO;YACP,GAAG,KAAK;YACR,OAAO;YACP,KAAK;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,KAAK,IAAI;SACtB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EACtD,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IACD,uFAAuF;IACvF,SAAS,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;QACxB,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC;KAChE,CAAC,EACF,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAA+B,CAAC;QAC5F,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3F,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAC1C,OAAiB,EACjB,QAAQ,CAAC,IAAI,EAAE,EACf,QAAQ,EACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACjD,+DAA+D;YAC/D,KAAK,KAAK,IAAI,CACf,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACvC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC5C,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACzC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,OAAO,CAAC,KAAK,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3E,2FAA2F;YAC3F,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACjG,IAAI,QAAQ,IAAI,CAAC,IAAI;gBAAE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;;gBAC9D,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,+EAA+E;IAE/E,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,QAAQ,EAAE,QAAQ;QAClB,mBAAmB,EAAE,oCAAoC,CAAC,MAAM,CAAC;QACjE,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAC;IAEH,uFAAuF;IACvF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAClE,GAAG,CAAC,GAAG,CAAC;YACN,6BAA6B,EAAE,GAAG;YAClC,8BAA8B,EAC5B,2EAA2E;YAC7E,8BAA8B,EAAE,eAAe;YAC/C,+BAA+B,EAAE,kCAAkC;SACpE,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7F,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC9E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EACrG,WAAW,IAAI,KAAK,KAAK,IAAI;YAC3B,CAAC,CAAC;gBACE,gBAAgB,EACd,6GAA6G;aAChH;YACH,CAAC,CAAC,EAAE,CACP,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC/C,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;aACpB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAEhF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACnD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC5E,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAClG,CAAC,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC,GAAG,CAAC;QACV,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/remote/config.js

@@ -0,0 +1,52 @@
+import { ConfigError, flag, normalizeBaseUrl, read } from '../config.js';
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1']);
+function wholeNumber(env, key, fallback) {
+    const raw = read(env, key);
+    if (raw === undefined)
+        return fallback;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 0)
+        throw new ConfigError(`${key} must be a whole number.`);
+    return value;
+}
+export function loadRemoteConfig(env = process.env) {
+    const anyTaiga = flag(env, 'ANY_TAIGA');
+    const allowWrites = flag(env, 'ALLOW_WRITES');
+    const rawTaiga = read(env, 'TAIGA_URL');
+    if (!rawTaiga && !anyTaiga) {
+        throw new ConfigError('TAIGA_URL is not set. Set it to your Taiga API host, e.g. https://api.taiga.io, or set ANY_TAIGA=true to let each person name their own Taiga.');
+    }
+    const rawPublic = read(env, 'PUBLIC_URL');
+    if (!rawPublic) {
+        throw new ConfigError('PUBLIC_URL is not set. Set it to the address people reach this server at, e.g. https://taiga-mcp.example.com');
+    }
+    let publicUrl;
+    try {
+        publicUrl = new URL(rawPublic);
+    }
+    catch {
+        throw new ConfigError(`PUBLIC_URL is not a valid address: "${rawPublic}".`);
+    }
+    const local = LOCAL_HOSTS.has(publicUrl.hostname);
+    if (publicUrl.protocol !== 'https:' && !(local && publicUrl.protocol === 'http:')) {
+        throw new ConfigError('PUBLIC_URL must start with https:// (http:// is accepted for localhost only).');
+    }
+    if (publicUrl.pathname !== '/' || publicUrl.search || publicUrl.hash) {
+        throw new ConfigError('PUBLIC_URL must be the bare address, without a path: https://taiga-mcp.example.com');
+    }
+    const secret = read(env, 'MCP_SECRET');
+    if (secret === undefined || secret.length < 32) {
+        throw new ConfigError('MCP_SECRET must be set to a random value of at least 32 characters, e.g. the output of `openssl rand -base64 48`.');
+    }
+    return {
+        taigaUrl: rawTaiga ? normalizeBaseUrl(rawTaiga) : undefined,
+        anyTaiga,
+        allowWrites,
+        publicUrl,
+        secret,
+        port: wholeNumber(env, 'PORT', 3000),
+        // A hosted server sits behind the host's proxy; a local one is reached directly.
+        trustProxy: wholeNumber(env, 'TRUST_PROXY', local ? 0 : 1),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/remote/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/remote/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAY,MAAM,cAAc,CAAC;AAyBnF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAExD,SAAS,WAAW,CAAC,GAAQ,EAAE,GAAW,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,GAAG,0BAA0B,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAW,OAAO,CAAC,GAAG;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CACnB,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,uCAAuC,SAAS,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,WAAW,CAAC,+EAA+E,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CACnB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CACnB,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,QAAQ;QACR,WAAW;QACX,SAAS;QACT,MAAM;QACN,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;QACpC,iFAAiF;QACjF,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC"}

package/dist/remote/guard.js

@@ -0,0 +1,120 @@
+import { lookup as dnsLookup } from 'node:dns';
+import { BlockList, isIP } from 'node:net';
+import { Agent, buildConnector, fetch as undiciFetch } from 'undici';
+/**
+ * When people may type the address of their own Taiga, the server makes requests to hosts
+ * chosen by strangers. This file keeps those requests on the public internet: a typed address
+ * must not be a way to reach the machine the server runs on, or the network around it.
+ */
+const NOT_PUBLIC = new BlockList();
+for (const [network, prefix] of [
+    ['0.0.0.0', 8], // "this network"
+    ['10.0.0.0', 8], // private
+    ['100.64.0.0', 10], // carrier-grade NAT
+    ['127.0.0.0', 8], // loopback
+    ['169.254.0.0', 16], // link-local, where cloud hosts keep their metadata service
+    ['172.16.0.0', 12], // private
+    ['192.0.0.0', 24], // protocol assignments
+    ['192.0.2.0', 24], // documentation
+    ['192.168.0.0', 16], // private
+    ['198.18.0.0', 15], // benchmarking
+    ['198.51.100.0', 24], // documentation
+    ['203.0.113.0', 24], // documentation
+    ['224.0.0.0', 4], // multicast
+    ['240.0.0.0', 4], // reserved, and broadcast
+]) {
+    NOT_PUBLIC.addSubnet(network, prefix, 'ipv4');
+}
+for (const [network, prefix] of [
+    ['::', 128], // unspecified
+    ['::1', 128], // loopback
+    ['64:ff9b::', 96], // NAT64: an IPv4 address in disguise
+    ['2001:db8::', 32], // documentation
+    ['fc00::', 7], // unique local
+    ['fe80::', 10], // link-local
+    ['ff00::', 8], // multicast
+]) {
+    NOT_PUBLIC.addSubnet(network, prefix, 'ipv6');
+}
+/** Whether an IP address (not a name) is one a stranger may send the server to. */
+export function isPublicAddress(address) {
+    const family = isIP(address);
+    if (family === 0)
+        return false;
+    // An IPv4 address written as IPv6 (::ffff:10.0.0.1) is checked against the IPv4 list too.
+    return !NOT_PUBLIC.check(address, family === 4 ? 'ipv4' : 'ipv6');
+}
+/** Taiga cloud is opened at one address and answers its API at another. */
+const TAIGA_CLOUD = new Set(['taiga.io', 'www.taiga.io', 'tree.taiga.io', 'api.taiga.io']);
+/**
+ * The API host for what a person typed as "the address of my Taiga", or `undefined` when it
+ * cannot be one. People paste whatever is in their address bar, so the scheme may be missing
+ * and a path may follow; only a host name reached over HTTPS is kept.
+ */
+export function taigaAddress(typed) {
+    const text = typed.trim();
+    if (text === '' || text.length > 300)
+        return undefined;
+    let url;
+    try {
+        url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(text) ? text : `https://${text}`);
+    }
+    catch {
+        return undefined;
+    }
+    // A password is never sent over plain HTTP: http:// is read as https://.
+    if (url.protocol === 'http:')
+        url.protocol = 'https:';
+    if (url.protocol !== 'https:' || url.username !== '' || url.password !== '')
+        return undefined;
+    const host = url.hostname.toLowerCase();
+    // Names only: no bare IP addresses, no single-label names such as "localhost".
+    if (isIP(host.replace(/^\[|\]$/g, '')) !== 0 || !/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host))
+        return undefined;
+    if (TAIGA_CLOUD.has(host))
+        return 'https://api.taiga.io';
+    return url.origin;
+}
+class NotPublicError extends Error {
+    name = 'NotPublicError';
+    constructor(host) {
+        super(`${host} is not an address on the public internet`);
+    }
+}
+/**
+ * Name resolution for the guarded connections: a name is refused if any address it resolves
+ * to is not public. Checking here, at the moment of connecting, also covers redirects and a
+ * name that changes its answer between two look-ups.
+ */
+function guardedLookup(hostname, options, callback) {
+    dnsLookup(hostname, { ...options, all: true }, (error, addresses) => {
+        if (error) {
+            callback(error, []);
+        }
+        else if (addresses.length === 0 || addresses.some(({ address }) => !isPublicAddress(address))) {
+            callback(new NotPublicError(hostname), []);
+        }
+        else if (options.all) {
+            callback(null, addresses);
+        }
+        else {
+            const [first] = addresses;
+            callback(null, first.address, first.family);
+        }
+    });
+}
+const connect = buildConnector({ lookup: guardedLookup });
+const agent = new Agent({
+    connect: (options, callback) => {
+        // A literal IP address is connected to without a look-up, so it is checked here.
+        const host = options.hostname.replace(/^\[|\]$/g, '');
+        if (isIP(host) !== 0 && !isPublicAddress(host)) {
+            callback(new NotPublicError(host), null);
+            return;
+        }
+        connect(options, callback);
+    },
+});
+/** `fetch` that only ever connects to public addresses. */
+export const guardedFetch = ((input, init) => undiciFetch(input, { ...init, dispatcher: agent }));
+//# sourceMappingURL=guard.js.map

package/dist/remote/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/remote/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAsB,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErE;;;;GAIG;AAEH,MAAM,UAAU,GAAG,IAAI,SAAS,EAAE,CAAC;AACnC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,iBAAiB;IACjC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,UAAU;IAC3B,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,oBAAoB;IACxC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,4DAA4D;IACjF,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,UAAU;IAC9B,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,uBAAuB;IAC1C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACnC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,UAAU;IAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACtC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACrC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,0BAA0B;CACpC,EAAE,CAAC;IACX,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,cAAc;IAC3B,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW;IACzB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,qCAAqC;IACxD,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACpC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,eAAe;IAC9B,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,aAAa;IAC7B,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,YAAY;CACnB,EAAE,CAAC;IACX,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,0FAA0F;IAC1F,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3F;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yEAAyE;IACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,+EAA+E;IAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5G,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACzD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,cAAe,SAAQ,KAAK;IACd,IAAI,GAAG,gBAAgB,CAAC;IAC1C,YAAY,IAAY;QACtB,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;IAC5D,CAAC;CACF;AAQD;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,OAA0B,EAAE,QAAwB;IAC3F,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAClE,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,GAAG,SAAgD,CAAC;YACjE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC,CAAC;AAEnE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;IACtB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7B,iFAAiF;QACjF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAC3B,KAAwC,EACxC,IAAwC,EACxC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAA4B,CAAC"}