@maadb/core 0.0.1 → 0.7.9

package/dist/mcp/transport/http.d.ts

@@ -0,0 +1,62 @@
+import { type Server as HttpServer } from 'node:http';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { TokenStore } from '../../auth/token-store.js';
+import type { SessionRegistry } from '../../instance/session.js';
+import type { InstanceConfig } from '../../instance/config.js';
+export interface HttpTransportOptions {
+    host: string;
+    port: number;
+    /**
+     * 0.7.5 (fup-2026-148) — When set, the server binds to this Unix domain
+     * socket path instead of host:port. Same MCP protocol over a different
+     * socket, so all auth/session/SSE plumbing is reused unchanged. Intended
+     * deployment: trusted-app-process colocated with the engine, socket file
+     * mode gates access at the filesystem layer (defense-in-depth on top of
+     * the bearer auth that's still required). `host`/`port`/`trustProxy` are
+     * ignored when this is set.
+     */
+    socketPath?: string | undefined;
+    /** Octal file mode applied to the socket after bind. Default 0o660. */
+    socketMode?: number | undefined;
+    maxBodyBytes: number;
+    headersTimeoutMs: number;
+    requestTimeoutMs: number;
+    keepAliveTimeoutMs: number;
+    trustProxy: boolean;
+    /**
+     * Per-session idle threshold. A session with no inbound client request for
+     * this many milliseconds is evicted by the idle sweeper. Defaults to 30 min.
+     * Outbound SSE pushes from the server do NOT count as activity — server
+     * activity != client activity.
+     */
+    idleMs: number;
+    /**
+     * 0.7.0 — Token registry for scoped auth. Production HTTP mode requires a
+     * non-null store with ≥1 active token (server.ts enforces via
+     * checkHttpAuthAtBoot before this transport is even instantiated). Tests
+     * and dev convenience may pass undefined to bypass auth entirely; when
+     * undefined, every request is accepted without a bearer check.
+     */
+    tokens?: TokenStore | undefined;
+    /**
+     * Session registry for protocol-level state. HTTP transport fires destroy()
+     * on its close, which fans out to whatever close handlers the server
+     * wired in (rate-limit dispose, audit log, etc.).
+     */
+    sessions: SessionRegistry;
+    /**
+     * Instance config — needed for X-Maad-Pin-Project header validation.
+     * The pin validator checks values against instance.projects[].name and
+     * skips validation entirely for synthetic (legacy single-project) mode.
+     */
+    instance: InstanceConfig;
+    /** Factory called once per new session to produce a fresh McpServer with tools registered. */
+    serverFactory: () => McpServer;
+}
+export interface HttpTransportHandle {
+    httpServer: HttpServer;
+    close: () => Promise<void>;
+    activeSessionCount: () => number;
+}
+export declare function startHttpTransport(opts: HttpTransportOptions): Promise<HttpTransportHandle>;
+//# sourceMappingURL=http.d.ts.map

package/dist/mcp/transport/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/http.ts"],"names":[],"mappings":"AAUA,OAAO,EAAoC,KAAK,MAAM,IAAI,UAAU,EAA6C,MAAM,WAAW,CAAC;AAInI,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAK/D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC;;;;OAIG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAC;IACzB,8FAA8F;IAC9F,aAAa,EAAE,MAAM,SAAS,CAAC;CAChC;AASD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,kBAAkB,EAAE,MAAM,MAAM,CAAC;CAClC;AA8BD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoTjG"}

package/dist/mcp/transport/http.js

@@ -0,0 +1,357 @@
+// ============================================================================
+// HTTP/SSE transport for MCP (0.5.0 R1 — transport scaffold, no auth yet)
+//
+// Creates a node:http server, routes /mcp POST/GET/DELETE through the SDK's
+// StreamableHTTPServerTransport. One transport instance per session, stored
+// in a session-keyed map. node:http timeouts are set explicitly (slowloris +
+// hung-request defense). Response hardening headers injected on every response.
+// Auth layers in R2, session registry fan-out in R3.
+// ============================================================================
+import { createServer as createHttpServer } from 'node:http';
+import { existsSync, unlinkSync, chmodSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { logger } from '../../engine/logger.js';
+import { logAuthFailure, logPinRejected } from '../../logging.js';
+import { resolveToken } from './auth.js';
+import { validatePinHeader } from './pin.js';
+import { recordIdleSweep, recordSessionOpen } from './telemetry.js';
+import { isShuttingDown } from '../shutdown.js';
+import { registerNotifier, unregisterNotifier } from '../notifications.js';
+function remoteAddrFor(req, trustProxy) {
+    if (trustProxy) {
+        const xff = req.headers['x-forwarded-for'];
+        if (typeof xff === 'string' && xff.length > 0)
+            return xff.split(',')[0].trim();
+        if (Array.isArray(xff) && xff.length > 0)
+            return xff[0].trim();
+    }
+    return req.socket.remoteAddress ?? 'unknown';
+}
+function writeJsonError(res, status, code, message) {
+    if (!res.headersSent) {
+        res.statusCode = status;
+        res.setHeader('Content-Type', 'application/json');
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+    }
+    res.end(JSON.stringify({ ok: false, errors: [{ code, message }] }));
+}
+function applyResponseHardening(res, kind) {
+    // SDK emits Cache-Control: no-cache (or no-cache, no-transform) on SSE and some JSON paths.
+    // We layer in no-store on JSON responses and nosniff on all responses.
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    if (kind === 'json') {
+        res.setHeader('Cache-Control', 'no-store');
+    }
+}
+export async function startHttpTransport(opts) {
+    const entries = new Map();
+    // Fire `pin_ignored_legacy` at most once per process so operators see the
+    // signal without getting log spam when a legacy deployment is being probed.
+    let legacyPinWarned = false;
+    const httpServer = createHttpServer(async (req, res) => {
+        try {
+            // Body-size pre-check via Content-Length. Streaming bypass is possible but
+            // stretches the threat model — clients that chunk around this cap are
+            // already hostile, and 0.5.0's rate limiter catches sustained abuse.
+            const contentLength = Number.parseInt(req.headers['content-length'] ?? '0', 10);
+            if (Number.isFinite(contentLength) && contentLength > opts.maxBodyBytes) {
+                writeJsonError(res, 413, 'PAYLOAD_TOO_LARGE', `Request body exceeds ${opts.maxBodyBytes} bytes`);
+                return;
+            }
+            const url = new URL(req.url ?? '/', `http://${opts.host}`);
+            // Liveness probe — unauthenticated, minimal, no state leak. Routed
+            // BEFORE auth so container runtimes and orchestrators can probe the
+            // process without holding a copy of the bearer token. Returns 503
+            // SHUTTING_DOWN during drain so an orchestrator's failing probe during
+            // deploy signals "process is exiting" rather than "process is broken".
+            if (url.pathname === '/healthz' && req.method === 'GET') {
+                const draining = isShuttingDown();
+                res.statusCode = draining ? 503 : 200;
+                res.setHeader('Content-Type', 'application/json');
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                if (draining) {
+                    res.end(JSON.stringify({ ok: false, errors: [{ code: 'SHUTTING_DOWN', message: 'server is draining' }] }));
+                }
+                else {
+                    res.end(JSON.stringify({ ok: true }));
+                }
+                return;
+            }
+            if (url.pathname !== '/mcp') {
+                writeJsonError(res, 404, 'NOT_FOUND', 'Unknown path');
+                return;
+            }
+            // Middleware step 1: auth. Runs BEFORE session resolution so an
+            // unauthenticated caller can never discover whether a session id
+            // exists (404 SESSION_NOT_FOUND is reserved for authenticated callers).
+            // 0.7.0 — resolveToken replaces shared-secret validateBearer. Every
+            // failure reason maps to a plain 401; distinct codes surface only in
+            // the ops log. Success returns the TokenRecord, which we capture for
+            // session-creation binding below. If tokens is undefined (test/dev
+            // bypass), we skip auth entirely — production boot enforces presence.
+            let authedToken = null;
+            if (opts.tokens !== undefined) {
+                const authOutcome = resolveToken(req, opts.tokens);
+                if (!authOutcome.ok) {
+                    logAuthFailure({
+                        remote_addr: remoteAddrFor(req, opts.trustProxy),
+                        reason: authOutcome.reason === 'missing' ? 'missing' : 'invalid',
+                    });
+                    writeJsonError(res, 401, 'UNAUTHORIZED', 'missing or invalid bearer token');
+                    return;
+                }
+                authedToken = authOutcome.record;
+            }
+            // Middleware step 2: X-Maad-Pin-Project (0.6.8) — trusted-gateway
+            // session pinning for multi-tenant hosted deployments. Runs AFTER auth
+            // (rejections need an authenticated context) and BEFORE session
+            // resolution (pin is a session-creation property). Silent skip in
+            // synthetic/legacy single-project mode per spec §Interaction with
+            // existing features.
+            let pinnedProjectName;
+            if (opts.instance.source === 'synthetic') {
+                if (req.headers['x-maad-pin-project'] !== undefined && !legacyPinWarned) {
+                    logger.info('mcp', 'http', 'X-Maad-Pin-Project received on synthetic single-project instance; ignoring (pin_ignored_legacy)');
+                    legacyPinWarned = true;
+                }
+            }
+            else {
+                const pin = validatePinHeader(req, opts.instance);
+                if (pin.status === 'rejected') {
+                    const pinValueRaw = req.headers['x-maad-pin-project'];
+                    const pinValue = typeof pinValueRaw === 'string' ? pinValueRaw : null;
+                    logPinRejected({
+                        remote_addr: remoteAddrFor(req, opts.trustProxy),
+                        code: pin.code,
+                        project: pinValue,
+                    });
+                    writeJsonError(res, 400, pin.code, pin.message);
+                    return;
+                }
+                if (pin.status === 'valid') {
+                    pinnedProjectName = pin.projectName;
+                }
+            }
+            const sessionIdHeader = req.headers['mcp-session-id'];
+            const sessionId = typeof sessionIdHeader === 'string' ? sessionIdHeader : undefined;
+            // Existing session — route to its transport
+            if (sessionId && entries.has(sessionId)) {
+                const entry = entries.get(sessionId);
+                // Inbound client request — bump transport-level lastActivityAt. This
+                // is the clock the idle sweeper uses. We intentionally do NOT update
+                // it on outbound SSE pushes; those are server activity, not client.
+                entry.lastActivityAt = Date.now();
+                applyResponseHardening(res, req.method === 'GET' ? 'sse' : 'json');
+                await entry.transport.handleRequest(req, res);
+                return;
+            }
+            // Unknown session ID on non-initialize request — 404
+            if (sessionId) {
+                writeJsonError(res, 404, 'SESSION_NOT_FOUND', 'Unknown session');
+                return;
+            }
+            // No session ID: must be POST for initialize
+            if (req.method !== 'POST') {
+                writeJsonError(res, 400, 'BAD_REQUEST', 'Mcp-Session-Id header required');
+                return;
+            }
+            // New session: transport delegates ID generation to us (128-bit CSPRNG)
+            const remoteAddr = remoteAddrFor(req, opts.trustProxy);
+            const pinForClosure = pinnedProjectName;
+            const tokenForClosure = authedToken;
+            // Forward-reference to the McpServer built below. Captured by the
+            // onsessioninitialized closure so 0.6.11 live-notification registration
+            // can fire `sendResourceUpdated` through the right per-session server.
+            let mcpServerRef = null;
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomBytes(16).toString('base64url'),
+                onsessioninitialized: (sid) => {
+                    const now = Date.now();
+                    entries.set(sid, { transport, createdAt: now, lastActivityAt: now, remoteAddr });
+                    // Register protocol-level state so registry.destroy(sid) has
+                    // something to destroy — otherwise the fan-out chain (rate-limit
+                    // dispose, audit handlers) never runs. withSession may also
+                    // create(sid) lazily on first tool call; create() is idempotent.
+                    const state = opts.sessions.create(sid);
+                    // 0.7.0 — Attach the authed token BEFORE any bindSingle/bindMulti
+                    // call so the three-cap effective-role composition sees it. Subsequent
+                    // requests on this session re-validate their bearer at the middleware
+                    // layer; the state.token is a snapshot at initialize time for
+                    // consistent effective-role resolution.
+                    if (tokenForClosure !== null)
+                        state.token = tokenForClosure;
+                    // Gateway pin (0.6.8): if the pin header validated, bind the session
+                    // synchronously before any tool call can reach a handler. Rebind
+                    // protection lives in SessionRegistry.bindSingle (SESSION_PINNED
+                    // error on subsequent maad_use_project calls).
+                    if (pinForClosure !== undefined) {
+                        const pinBind = opts.sessions.bindSingle(sid, pinForClosure, { source: 'gateway_pin' });
+                        if (!pinBind.ok) {
+                            // Should be impossible — we validated the project exists before
+                            // session creation. Log loudly if it ever fires.
+                            const msg = pinBind.errors.map(e => `${e.code}: ${e.message}`).join('; ');
+                            logger.error('mcp', 'http', `gateway pin bind failed for session ${sid}: ${msg}`);
+                        }
+                    }
+                    // 0.6.11 — register per-session notifier keyed on this sid. Fires
+                    // `notifications/resources/updated` with a synthetic maad://records/
+                    // URI plus extra params carrying the full ChangeEvent shape.
+                    // MCP clients that only read `uri` still get a valid notification;
+                    // clients that read params get the typed event.
+                    if (mcpServerRef) {
+                        const capturedServer = mcpServerRef;
+                        registerNotifier(sid, async (event) => {
+                            await capturedServer.server.sendResourceUpdated({
+                                uri: `maad://records/${event.docId}`,
+                                ...{ action: event.action, docId: event.docId, docType: event.docType, project: event.project, updatedAt: event.updatedAt },
+                            });
+                        });
+                    }
+                    const ua = req.headers['user-agent'];
+                    const openFields = {
+                        session_id: sid,
+                        remote_addr: remoteAddr,
+                        user_agent: typeof ua === 'string' ? ua : null,
+                        transport: 'http',
+                    };
+                    if (pinForClosure !== undefined)
+                        openFields.binding_source = 'gateway_pin';
+                    recordSessionOpen(openFields);
+                },
+            });
+            transport.onclose = () => {
+                const sid = transport.sessionId;
+                if (sid && entries.has(sid)) {
+                    entries.delete(sid);
+                    // 0.6.11 — drop the notifier before destroy so it can't race with
+                    // in-flight writes. destroy() itself fires close handlers but the
+                    // notifier lives outside that registry.
+                    unregisterNotifier(sid);
+                    // Fan out to the registry — this fires close handlers the server
+                    // wired in (rate-limit dispose, session_close audit, etc.).
+                    opts.sessions.destroy(sid, 'transport');
+                }
+            };
+            const mcpServer = opts.serverFactory();
+            mcpServerRef = mcpServer;
+            // SDK's StreamableHTTPServerTransport declares onclose/onerror/onmessage
+            // as optional, but Server.connect's Transport interface declares them
+            // non-optional under exactOptionalPropertyTypes. Widening cast is the
+            // least invasive workaround; the runtime shape is identical.
+            await mcpServer.connect(transport);
+            applyResponseHardening(res, 'json');
+            await transport.handleRequest(req, res);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            logger.error('mcp', 'http', `request error: ${msg}`);
+            if (!res.headersSent) {
+                writeJsonError(res, 500, 'INTERNAL', 'Internal server error');
+            }
+            else {
+                try {
+                    res.end();
+                }
+                catch { /* best-effort */ }
+            }
+        }
+    });
+    httpServer.headersTimeout = opts.headersTimeoutMs;
+    httpServer.requestTimeout = opts.requestTimeoutMs;
+    httpServer.keepAliveTimeout = opts.keepAliveTimeoutMs;
+    // 0.7.5 (fup-2026-148) — bind to Unix socket when configured; otherwise TCP.
+    // Stale-socket cleanup before listen() handles the common case where a
+    // crashed prior process left the socket file behind. Socket mode (default
+    // 0o660) chmod-applied after listen so transient world-readable race is
+    // bounded by listen-then-chmod (well under any real attacker window for
+    // the trusted-host deploy this targets).
+    if (opts.socketPath) {
+        try {
+            if (existsSync(opts.socketPath))
+                unlinkSync(opts.socketPath);
+        }
+        catch (e) {
+            throw new Error(`failed to remove stale Unix socket at ${opts.socketPath}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        await new Promise((resolve, reject) => {
+            httpServer.once('error', reject);
+            httpServer.listen(opts.socketPath, () => {
+                httpServer.off('error', reject);
+                const mode = opts.socketMode ?? 0o660;
+                try {
+                    chmodSync(opts.socketPath, mode);
+                }
+                catch (e) {
+                    logger.bestEffort('mcp', 'http.unix.chmod', `chmod ${mode.toString(8)} on ${opts.socketPath} failed`, { error: e instanceof Error ? e.message : String(e) });
+                }
+                resolve();
+            });
+        });
+        logger.info('mcp', 'http', `Server started on unix:${opts.socketPath}/mcp (mode ${(opts.socketMode ?? 0o660).toString(8)})`);
+    }
+    else {
+        await new Promise((resolve, reject) => {
+            httpServer.once('error', reject);
+            httpServer.listen(opts.port, opts.host, () => {
+                httpServer.off('error', reject);
+                resolve();
+            });
+        });
+        logger.info('mcp', 'http', `Server started on http://${opts.host}:${opts.port}/mcp`);
+    }
+    // Idle sweeper — walks the entries map every ~60s and evicts transports
+    // whose lastActivityAt is past the idle threshold. Unref'd so the interval
+    // alone doesn't keep the event loop alive; tick cadence is capped at
+    // idleMs so tiny idle thresholds don't produce microsecond spins in tests.
+    const sweepIntervalMs = Math.max(1_000, Math.min(60_000, Math.floor(opts.idleMs / 2) || 60_000));
+    const idleSweeper = setInterval(() => {
+        const now = Date.now();
+        const threshold = now - opts.idleMs;
+        let swept = 0;
+        for (const [sid, entry] of entries) {
+            if (entry.lastActivityAt < threshold) {
+                // Mark the registry first so the fan-out reason reflects WHY it
+                // closed. The transport.onclose below would otherwise fire with
+                // reason=transport. Destroy is idempotent so calling it twice is safe.
+                opts.sessions.destroy(sid, 'idle');
+                entries.delete(sid);
+                // Close the SSE transport — frees sockets and triggers SDK cleanup.
+                void entry.transport.close().catch(() => { });
+                swept += 1;
+            }
+        }
+        if (swept > 0) {
+            recordIdleSweep({ swept, remaining: entries.size });
+        }
+    }, sweepIntervalMs);
+    idleSweeper.unref?.();
+    return {
+        httpServer,
+        activeSessionCount: () => entries.size,
+        close: async () => {
+            clearInterval(idleSweeper);
+            await new Promise((resolve) => httpServer.close(() => resolve()));
+            for (const [sid, entry] of entries) {
+                try {
+                    await entry.transport.close();
+                }
+                catch { /* best-effort */ }
+                opts.sessions.destroy(sid, 'shutdown');
+            }
+            entries.clear();
+            // 0.7.5 — UDS cleanup. Best-effort: if a fast SIGKILL beat us here,
+            // the next startup's stale-socket unlink will catch it.
+            if (opts.socketPath) {
+                try {
+                    if (existsSync(opts.socketPath))
+                        unlinkSync(opts.socketPath);
+                }
+                catch { /* best-effort */ }
+            }
+        },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/mcp/transport/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/mcp/transport/http.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,qDAAqD;AACrD,+EAA+E;AAE/E,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAwE,MAAM,WAAW,CAAC;AACnI,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAoB,MAAM,qBAAqB,CAAC;AAkE7F,SAAS,aAAa,CAAC,GAAoB,EAAE,UAAmB;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACxF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;QACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAmB,EAAE,IAAoB;IACvE,4FAA4F;IAC5F,uEAAuE;IACvE,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA0B;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,IAAI,CAAC;YACH,2EAA2E;YAC3E,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAChF,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAC1C,wBAAwB,IAAI,CAAC,YAAY,QAAQ,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAE3D,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACxD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;gBAClC,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7G,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC5B,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,gEAAgE;YAChE,iEAAiE;YACjE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,WAAW,GAAuB,IAAI,CAAC;YAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;oBACpB,cAAc,CAAC;wBACb,WAAW,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;wBAChD,MAAM,EAAE,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;qBACjE,CAAC,CAAC;oBACH,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;oBAC5E,OAAO;gBACT,CAAC;gBACD,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC;YACnC,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,qBAAqB;YACrB,IAAI,iBAAqC,CAAC;YAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACzC,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;oBACxE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,iGAAiG,CAAC,CAAC;oBAC9H,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;oBACtD,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtE,cAAc,CAAC;wBACb,WAAW,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;wBAChD,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,QAAQ;qBAClB,CAAC,CAAC;oBACH,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC3B,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAEpF,4CAA4C;YAC5C,IAAI,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBACtC,qEAAqE;gBACrE,qEAAqE;gBACrE,oEAAoE;gBACpE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,SAAS,EAAE,CAAC;gBACd,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,6CAA6C;YAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,gCAAgC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,wEAAwE;YACxE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,aAAa,GAAG,iBAAiB,CAAC;YACxC,MAAM,eAAe,GAAG,WAAW,CAAC;YACpC,kEAAkE;YAClE,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,YAAY,GAAqB,IAAI,CAAC;YAC1C,MAAM,SAAS,GAAkC,IAAI,6BAA6B,CAAC;gBACjF,kBAAkB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC/D,oBAAoB,EAAE,CAAC,GAAW,EAAE,EAAE;oBACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;oBACjF,6DAA6D;oBAC7D,iEAAiE;oBACjE,4DAA4D;oBAC5D,iEAAiE;oBACjE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,8DAA8D;oBAC9D,wCAAwC;oBACxC,IAAI,eAAe,KAAK,IAAI;wBAAE,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;oBAC5D,qEAAqE;oBACrE,iEAAiE;oBACjE,iEAAiE;oBACjE,+CAA+C;oBAC/C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;wBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;wBACxF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;4BAChB,gEAAgE;4BAChE,iDAAiD;4BACjD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BAC1E,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,uCAAuC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;wBACpF,CAAC;oBACH,CAAC;oBACD,kEAAkE;oBAClE,qEAAqE;oBACrE,6DAA6D;oBAC7D,mEAAmE;oBACnE,gDAAgD;oBAChD,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,cAAc,GAAG,YAAY,CAAC;wBACpC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAkB,EAAiB,EAAE;4BAChE,MAAM,cAAc,CAAC,MAAM,CAAC,mBAAmB,CAAC;gCAC9C,GAAG,EAAE,kBAAkB,KAAK,CAAC,KAAK,EAAE;gCACpC,GAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAA8B;6BACzJ,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACrC,MAAM,UAAU,GAA4C;wBAC1D,UAAU,EAAE,GAAG;wBACf,WAAW,EAAE,UAAU;wBACvB,UAAU,EAAE,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;wBAC9C,SAAS,EAAE,MAAM;qBAClB,CAAC;oBACF,IAAI,aAAa,KAAK,SAAS;wBAAE,UAAU,CAAC,cAAc,GAAG,aAAa,CAAC;oBAC3E,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBAChC,CAAC;aACF,CAAC,CAAC;YACH,SAAS,CAAC,OAAO,GAAG,GAAS,EAAE;gBAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;gBAChC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACpB,kEAAkE;oBAClE,kEAAkE;oBAClE,wCAAwC;oBACxC,kBAAkB,CAAC,GAAG,CAAC,CAAC;oBACxB,iEAAiE;oBACjE,4DAA4D;oBAC5D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,YAAY,GAAG,SAAS,CAAC;YACzB,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,SAAS,CAAC,OAAO,CAAC,SAA+D,CAAC,CAAC;YAEzF,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,GAAG,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAClD,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAClD,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAEtD,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,UAAU,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE;gBACtC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;gBACtC,IAAI,CAAC;oBAAC,SAAS,CAAC,IAAI,CAAC,UAAW,EAAE,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACpD,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,iBAAiB,EACxC,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,SAAS,EACxD,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,0BAA0B,IAAI,CAAC,UAAU,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/H,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC3C,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC;IACvF,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,cAAc,GAAG,SAAS,EAAE,CAAC;gBACrC,gEAAgE;gBAChE,gEAAgE;gBAChE,uEAAuE;gBACvE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpB,oEAAoE;gBACpE,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAC;gBAChE,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EAAE,eAAe,CAAC,CAAC;IACpB,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;IAEtB,OAAO;QACL,UAAU;QACV,kBAAkB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI;QACtC,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC;oBAAC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,oEAAoE;YACpE,wDAAwD;YACxD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;wBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp/transport/pin.d.ts

@@ -0,0 +1,15 @@
+import type { IncomingMessage } from 'node:http';
+import type { InstanceConfig } from '../../instance/config.js';
+export type PinFailureCode = 'PIN_PROJECT_INVALID' | 'PIN_PROJECT_NOT_FOUND' | 'PIN_ON_EXISTING_SESSION';
+export type PinResult = {
+    status: 'absent';
+} | {
+    status: 'valid';
+    projectName: string;
+} | {
+    status: 'rejected';
+    code: PinFailureCode;
+    message: string;
+};
+export declare function validatePinHeader(req: IncomingMessage, instance: InstanceConfig): PinResult;
+//# sourceMappingURL=pin.d.ts.map

package/dist/mcp/transport/pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/pin.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,MAAM,cAAc,GACtB,qBAAqB,GACrB,uBAAuB,GACvB,yBAAyB,CAAC;AAE9B,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAOlE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,SAAS,CAgB3F"}

package/dist/mcp/transport/pin.js

@@ -0,0 +1,71 @@
+// ============================================================================
+// X-Maad-Pin-Project header validation for HTTP transport (0.6.8)
+//
+// Gateway-enforced session pinning: a trusted upstream gateway sets
+// X-Maad-Pin-Project: <project-name> on the MCP initialize request, and the
+// engine pins the session to that project irrevocably. Server-side rebind
+// rejection lives in SessionRegistry.bindSingle/bindMulti (emits SESSION_PINNED
+// when bindingSource === 'gateway_pin').
+//
+// Validation rules (applied at every HTTP request BEFORE session resolution):
+//   - Header absent  → status 'absent', proceed unpinned
+//   - Multiple values → PIN_PROJECT_INVALID (spec §Interface #3)
+//   - Empty or regex-failing value → PIN_PROJECT_INVALID
+//   - Header present AND Mcp-Session-Id present → PIN_ON_EXISTING_SESSION
+//     (pin is a session-creation property; not valid on existing sessions)
+//   - Value not in instance.projects[].name → PIN_PROJECT_NOT_FOUND
+//
+// This module is PURE — no side effects, no logging. Caller (http.ts) handles
+// HTTP response + logging so remote_addr and trust-proxy policy stay in the
+// transport layer.
+// ============================================================================
+// Same regex as instance.yaml project names (src/instance/config.ts).
+// Kept local to avoid importing internals; drift-risk is minimal — the spec
+// locks this regex as the project-name contract.
+const VALID_PROJECT_NAME = /^[a-z][a-z0-9_-]*$/;
+export function validatePinHeader(req, instance) {
+    const raw = req.headers['x-maad-pin-project'];
+    if (raw === undefined)
+        return { status: 'absent' };
+    // Node normalizes repeated headers to string[]. Per spec, exactly one value.
+    if (Array.isArray(raw)) {
+        if (raw.length !== 1) {
+            return {
+                status: 'rejected',
+                code: 'PIN_PROJECT_INVALID',
+                message: 'X-Maad-Pin-Project header present multiple times; exactly one value required',
+            };
+        }
+        return validateSingle(raw[0], req, instance);
+    }
+    return validateSingle(raw, req, instance);
+}
+function validateSingle(value, req, instance) {
+    // Pin is a session-creation property. Presence on a request carrying an
+    // Mcp-Session-Id means the client is trying to mid-session rebind via the
+    // header, which is nonsensical — pin is irrevocable for the session's life.
+    if (req.headers['mcp-session-id']) {
+        return {
+            status: 'rejected',
+            code: 'PIN_ON_EXISTING_SESSION',
+            message: 'X-Maad-Pin-Project is only valid at session initialize; open a new session without Mcp-Session-Id to change the pin',
+        };
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || !VALID_PROJECT_NAME.test(trimmed)) {
+        return {
+            status: 'rejected',
+            code: 'PIN_PROJECT_INVALID',
+            message: `X-Maad-Pin-Project value ${JSON.stringify(value)} is not a valid project name (expected /^[a-z][a-z0-9_-]*$/)`,
+        };
+    }
+    if (!instance.projects.some(p => p.name === trimmed)) {
+        return {
+            status: 'rejected',
+            code: 'PIN_PROJECT_NOT_FOUND',
+            message: `X-Maad-Pin-Project value "${trimmed}" does not match any project in this instance`,
+        };
+    }
+    return { status: 'valid', projectName: trimmed };
+}
+//# sourceMappingURL=pin.js.map

package/dist/mcp/transport/pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../../src/mcp/transport/pin.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,8EAA8E;AAC9E,yDAAyD;AACzD,iEAAiE;AACjE,yDAAyD;AACzD,0EAA0E;AAC1E,2EAA2E;AAC3E,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mBAAmB;AACnB,+EAA+E;AAe/E,sEAAsE;AACtE,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,QAAwB;IAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEnD,6EAA6E;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,8EAA8E;aACxF,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,GAAoB,EAAE,QAAwB;IACnF,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,qHAAqH;SAC/H,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,8DAA8D;SACzH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,6BAA6B,OAAO,+CAA+C;SAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC"}

package/dist/mcp/transport/telemetry.d.ts

@@ -0,0 +1,79 @@
+import type { BindingSource, SessionCloseReason } from '../../instance/session.js';
+export type TransportKind = 'stdio' | 'http' | 'unix';
+export interface TransportInfo {
+    kind: TransportKind;
+    host?: string | undefined;
+    port?: number | undefined;
+    /** 0.7.5 (fup-2026-148) — unix transport socket path. */
+    socketPath?: string | undefined;
+    startedAt: string;
+}
+export interface SessionCounters {
+    openedTotal: number;
+    closedTotal: number;
+    lastOpenedAt: string | null;
+    lastClosedAt: string | null;
+    idleSweepLastRunAt: string | null;
+}
+export interface SessionsBlock extends SessionCounters {
+    active: number;
+    /**
+     * Count of currently-active sessions bound via X-Maad-Pin-Project header
+     * (bindingSource === 'gateway_pin'). 0 on stdio and on HTTP deployments
+     * that don't use gateway pinning. Operators track this to confirm their
+     * gateway is actually applying the pin.
+     */
+    pinned: number;
+}
+export interface TransportSnapshot {
+    transport: {
+        kind: TransportKind;
+        host?: string | undefined;
+        port?: number | undefined;
+        socketPath?: string | undefined;
+        uptimeSeconds: number;
+    };
+    sessions: SessionsBlock;
+}
+export declare function initTransportTelemetry(info: {
+    kind: TransportKind;
+    host?: string | undefined;
+    port?: number | undefined;
+    socketPath?: string | undefined;
+}): void;
+/**
+ * Test hook — resets telemetry state so each test starts clean.
+ */
+export declare function __resetTransportTelemetry(): void;
+export interface SessionOpenFields {
+    session_id: string;
+    remote_addr: string;
+    user_agent: string | null;
+    transport: TransportKind;
+    /**
+     * 0.6.8 — present when the session was pinned at initialize via the
+     * X-Maad-Pin-Project header. Omitted (undefined) when the session was
+     * created unbound; a later maad_use_project tool call does NOT emit an
+     * additional session_open event (binding_source at session_open captures
+     * the gateway-pin signal, not the eventual client bind).
+     */
+    binding_source?: BindingSource;
+}
+export declare function recordSessionOpen(fields: SessionOpenFields): void;
+export interface SessionCloseFields {
+    session_id: string;
+    reason: SessionCloseReason;
+    duration_ms: number;
+}
+export declare function recordSessionClose(args: {
+    session_id: string;
+    reason: SessionCloseReason;
+}): void;
+export interface IdleSweepFields {
+    swept: number;
+    remaining: number;
+}
+export declare function recordIdleSweep(fields: IdleSweepFields): void;
+export declare function getTransportSnapshot(activeSessions: number, pinnedSessions?: number): TransportSnapshot;
+export declare function isInitialized(): boolean;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/mcp/transport/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/telemetry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGnF,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QACT,IAAI,EAAE,aAAa,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,EAAE,aAAa,CAAC;CACzB;AAWD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GAAG,IAAI,CAoBP;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAGD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,aAAa,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAUjE;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG,IAAI,CAcjG;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAI7D;AAED,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,SAAI,GAAG,iBAAiB,CAoBlG;AAED,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}