@maadb/core 0.12.1 → 0.12.2

package/dist/auth/token-store.d.ts

@@ -16,7 +16,23 @@ export declare class TokenStore {
     private byHash;
     private byId;
     private records;
+    /**
+     * Tail of the mutation chain. issue/revoke/rotate serialize against this so
+     * a mutation always builds on the previous one's committed state.
+     *
+     * Without it, two interleaved mutations can each snapshot `records`, and
+     * whichever renames last wins — silently dropping the other's record from
+     * disk while it stays live in the in-memory indexes until restart. A unique
+     * temp path alone does not close that; the serialization does.
+     *
+     * In-process only. Two processes mutating the same tokens.yaml can still
+     * clobber each other — the multi-process lease is not built yet, so the
+     * supported contract remains a single control-plane writer.
+     */
+    private mutations;
     private constructor();
+    /** Queue `fn` behind any in-flight mutation. Rejections do not break the chain. */
+    private runExclusive;
     /**
      * Load tokens.yaml from `<instanceRoot>/_auth/tokens.yaml`. Returns an empty
      * store if the file is absent — caller decides whether HTTP mode can boot
@@ -58,12 +74,16 @@ export declare class TokenStore {
      * plaintext is never recoverable after this call.
      */
     issue(spec: IssueSpec): Promise<Result<IssuedToken>>;
+    /** Unlocked body of `issue`. Callers must already hold the mutation chain. */
+    private issueInner;
     /**
      * Mark a token as revoked. Sets revokedAt; the record stays in the registry
      * so audit queries can resolve historic token IDs. Idempotent — revoking
      * an already-revoked record is a no-op and returns the existing record.
      */
     revoke(id: TokenId): Promise<Result<TokenRecord>>;
+    /** Unlocked body of `revoke`. Callers must already hold the mutation chain. */
+    private revokeInner;
     /**
      * Rotate a token: issue a new token with the SAME capabilities (role,
      * projects, agentId, userId, expiresAt, name) and revoke the old one.
@@ -73,9 +93,19 @@ export declare class TokenStore {
      */
     rotate(id: TokenId): Promise<Result<IssuedToken>>;
     /**
-     * Atomic write via `<path>.tmp` + rename. Creates `_auth/` if missing.
-     * Errors don't leak partial state because writeFile+rename is atomic on
-     * both POSIX and Windows.
+     * Unlocked body of `rotate`. Calls issueInner directly — going through the
+     * public `issue` would queue behind the chain entry rotate itself holds.
+     */
+    private rotateInner;
+    /**
+     * Atomic write via a unique temp file + rename. Creates `_auth/` if missing.
+     *
+     * The temp name carries a random suffix: a fixed `<path>.tmp` is shared
+     * state, so two overlapping persists write the same file and the second
+     * rename fails ENOENT once the first has moved it away. Rename gives
+     * atomic *visibility* — a reader sees the old or new file, never a partial
+     * one — but not crash durability; there is no fsync of the file or its
+     * directory yet, so a power loss just after rename can still lose the write.
      */
     private persist;
 }

package/dist/auth/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,WAAW,EAGjB,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,oBAAoB,QAAoC,CAAC;AAEtE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAItD;AAMD,qBAAa,UAAU;IAMnB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,YAAY;IANtB,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,IAAI,CAAmC;IAC/C,OAAO,CAAC,OAAO,CAAqB;IAEpC,OAAO;IAKP;;;;;;;;OAQG;WACU,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAmCpE,yCAAyC;IACzC,IAAI,IAAI,MAAM;IAEd;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA0ClE,+DAA+D;IAC/D,IAAI,IAAI,MAAM,GAAG,SAAS;IAE1B,uCAAuC;IACvC,IAAI,IAAI,MAAM;IAEd,8DAA8D;IAC9D,WAAW,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM;IAM3C,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS;IAItD,2DAA2D;IAC3D,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS;IAIhD,+DAA+D;IAC/D,IAAI,IAAI,WAAW,EAAE;IAErB;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAsC1D;;;;OAIG;IACG,MAAM,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAcvD;;;;;;OAMG;IACG,MAAM,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAiCvD;;;;OAIG;YACW,OAAO;CA4BtB"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,WAAW,EAGjB,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,oBAAoB,QAAoC,CAAC;AAEtE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAItD;AAMD,qBAAa,UAAU;IAqBnB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,YAAY;IArBtB,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,IAAI,CAAmC;IAC/C,OAAO,CAAC,OAAO,CAAqB;IAEpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS,CAAuC;IAExD,OAAO;IAKP,mFAAmF;IACnF,OAAO,CAAC,YAAY;IAMpB;;;;;;;;OAQG;WACU,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAmCpE,yCAAyC;IACzC,IAAI,IAAI,MAAM;IAEd;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA0ClE,+DAA+D;IAC/D,IAAI,IAAI,MAAM,GAAG,SAAS;IAE1B,uCAAuC;IACvC,IAAI,IAAI,MAAM;IAEd,8DAA8D;IAC9D,WAAW,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM;IAM3C,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS;IAItD,2DAA2D;IAC3D,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS;IAIhD,+DAA+D;IAC/D,IAAI,IAAI,WAAW,EAAE;IAErB;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAI1D,8EAA8E;YAChE,UAAU;IA4CxB;;;;OAIG;IACG,MAAM,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAIvD,+EAA+E;YACjE,WAAW;IAczB;;;;;;OAMG;IACG,MAAM,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAIvD;;;OAGG;YACW,WAAW;IAiCzB;;;;;;;;;OASG;YACW,OAAO;CA+BtB"}

package/dist/auth/token-store.js

@@ -18,7 +18,7 @@
 //   - CLI + admin MCP tools that call issue/revoke/rotate — P3
 // ============================================================================
 import { existsSync } from 'node:fs';
-import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { readFile, writeFile, rename, mkdir, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { createHash, randomBytes } from 'node:crypto';
 import yaml from 'js-yaml';
@@ -56,10 +56,30 @@ export class TokenStore {
     byHash = new Map();
     byId = new Map();
     records = [];
+    /**
+     * Tail of the mutation chain. issue/revoke/rotate serialize against this so
+     * a mutation always builds on the previous one's committed state.
+     *
+     * Without it, two interleaved mutations can each snapshot `records`, and
+     * whichever renames last wins — silently dropping the other's record from
+     * disk while it stays live in the in-memory indexes until restart. A unique
+     * temp path alone does not close that; the serialization does.
+     *
+     * In-process only. Two processes mutating the same tokens.yaml can still
+     * clobber each other — the multi-process lease is not built yet, so the
+     * supported contract remains a single control-plane writer.
+     */
+    mutations = Promise.resolve();
     constructor(filePath, registryName) {
         this.filePath = filePath;
         this.registryName = registryName;
     }
+    /** Queue `fn` behind any in-flight mutation. Rejections do not break the chain. */
+    runExclusive(fn) {
+        const run = this.mutations.then(fn, fn);
+        this.mutations = run.then(() => undefined, () => undefined);
+        return run;
+    }
     /**
      * Load tokens.yaml from `<instanceRoot>/_auth/tokens.yaml`. Returns an empty
      * store if the file is absent — caller decides whether HTTP mode can boot
@@ -178,6 +198,10 @@ export class TokenStore {
      * plaintext is never recoverable after this call.
      */
     async issue(spec) {
+        return this.runExclusive(() => this.issueInner(spec));
+    }
+    /** Unlocked body of `issue`. Callers must already hold the mutation chain. */
+    async issueInner(spec) {
         const plaintext = generatePlaintext();
         const hash = hashPlaintext(plaintext);
         // Defensive: SHA-256 collisions are astronomically unlikely but we still
@@ -206,7 +230,14 @@ export class TokenStore {
         const persisted = await this.persist();
         if (!persisted.ok) {
             // Roll back in-memory state so the store stays consistent with disk.
-            this.records.pop();
+            // Remove by identity, not by position: `pop()` drops whatever landed
+            // last, which under concurrent issuance is another caller's committed
+            // record. That evicted record would stay in byHash/byId (still
+            // authenticating) while vanishing from the next serialization of
+            // `records` — a token erased from disk but live in memory until restart.
+            const at = this.records.indexOf(record);
+            if (at !== -1)
+                this.records.splice(at, 1);
             this.byHash.delete(record.hash);
             this.byId.delete(record.id);
             return persisted;
@@ -219,6 +250,10 @@ export class TokenStore {
      * an already-revoked record is a no-op and returns the existing record.
      */
     async revoke(id) {
+        return this.runExclusive(() => this.revokeInner(id));
+    }
+    /** Unlocked body of `revoke`. Callers must already hold the mutation chain. */
+    async revokeInner(id) {
         const record = this.byId.get(id);
         if (!record)
             return singleErr('TOKEN_NOT_FOUND', `No token with id ${id}`);
@@ -240,6 +275,13 @@ export class TokenStore {
      * revokedAt set.
      */
     async rotate(id) {
+        return this.runExclusive(() => this.rotateInner(id));
+    }
+    /**
+     * Unlocked body of `rotate`. Calls issueInner directly — going through the
+     * public `issue` would queue behind the chain entry rotate itself holds.
+     */
+    async rotateInner(id) {
         const existing = this.byId.get(id);
         if (!existing)
             return singleErr('TOKEN_NOT_FOUND', `No token with id ${id}`);
@@ -260,7 +302,7 @@ export class TokenStore {
             spec.userId = existing.userId;
         if (existing.expiresAt !== undefined)
             spec.expiresAt = existing.expiresAt;
-        const issued = await this.issue(spec);
+        const issued = await this.issueInner(spec);
         if (!issued.ok)
             return issued;
         // Mark the old record revoked after the new one persists so a crash mid-rotate
@@ -274,9 +316,14 @@ export class TokenStore {
         return issued;
     }
     /**
-     * Atomic write via `<path>.tmp` + rename. Creates `_auth/` if missing.
-     * Errors don't leak partial state because writeFile+rename is atomic on
-     * both POSIX and Windows.
+     * Atomic write via a unique temp file + rename. Creates `_auth/` if missing.
+     *
+     * The temp name carries a random suffix: a fixed `<path>.tmp` is shared
+     * state, so two overlapping persists write the same file and the second
+     * rename fails ENOENT once the first has moved it away. Rename gives
+     * atomic *visibility* — a reader sees the old or new file, never a partial
+     * one — but not crash durability; there is no fsync of the file or its
+     * directory yet, so a power loss just after rename can still lose the write.
      */
     async persist() {
         // Serialized shape uses snake_case keys for on-disk yaml; the in-memory
@@ -294,12 +341,18 @@ export class TokenStore {
         catch (e) {
             return singleErr('TOKENS_FILE_INVALID', `Failed to create ${dir}: ${e instanceof Error ? e.message : String(e)}`);
         }
-        const tmp = `${this.filePath}.tmp`;
+        const tmp = `${this.filePath}.${randomBytes(6).toString('hex')}.tmp`;
         try {
             await writeFile(tmp, yamlText, { encoding: 'utf8', mode: 0o600 });
             await rename(tmp, this.filePath);
         }
         catch (e) {
+            // Best-effort sweep so a failed persist doesn't strand a temp file
+            // holding token material next to the registry.
+            try {
+                await unlink(tmp);
+            }
+            catch { /* already gone or never created */ }
             return singleErr('TOKENS_FILE_INVALID', `Failed to persist tokens.yaml at ${this.filePath}: ${e instanceof Error ? e.message : String(e)}`);
         }
         return ok(undefined);

package/dist/auth/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,qEAAqE;AACrE,8BAA8B;AAC9B,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,qBAAqB;AACrB,EAAE;AACF,wBAAwB;AACxB,kDAAkD;AAClD,mDAAmD;AACnD,wCAAwC;AACxC,oEAAoE;AACpE,EAAE;AACF,oCAAoC;AACpC,+FAA+F;AAC/F,wDAAwD;AACxD,+DAA+D;AAC/D,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,EAAE,EAAE,SAAS,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,OAAO,IAAI,SAAS,EACpB,SAAS,IAAI,WAAW,GAQzB,MAAM,YAAY,CAAC;AAEpB,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAC3C,MAAM,4BAA4B,GAAG,EAAE,CAAC,CAAG,0BAA0B;AACrE,MAAM,qBAAqB,GAAG,CAAC,CAAC,CAAY,yBAAyB;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEtE;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,GAAG,sBAAsB,GAAG,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,SAAS,CAAC,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,OAAO,UAAU;IAMX;IACA;IANF,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC3C,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IACvC,OAAO,GAAkB,EAAE,CAAC;IAEpC,YACU,QAAgB,EAChB,YAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,iBAAY,GAAZ,YAAY,CAAoB;IACvC,CAAC;IAEJ;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAoB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,iCAAiC,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,0EAA0E;QAC1E,oBAAoB;QACpB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAyB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAExD,uCAAuC;IACvC,IAAI,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,8DAA8D;IAC9D,WAAW,CAAC,MAAY,IAAI,IAAI,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,kEAAkE;IAClE,YAAY,CAAC,IAAe;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,2DAA2D;IAC3D,UAAU,CAAC,EAAW;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAoB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnD;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAe;QACzB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAEtC,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,iBAAiB,EAChC,oDAAoD,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,qEAAqE;YACrE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,EAAW;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,EAAY,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,SAAS,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,EAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,EAAY,EAAE,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC,eAAe,EAC9B,SAAS,EAAY,sDAAsD,CAAC,CAAC;QACjF,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,IAAI,GAAc;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACjD,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3D,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAE9B,+EAA+E;QAC/E,gEAAgE;QAChE,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,SAAS,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO;QACnB,wEAAwE;QACxE,sEAAsE;QACtE,6BAA6B;QAC7B,MAAM,KAAK,GAA4B;YACrC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;SAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,oBAAoB,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,oCAAoC,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;CACF;AAED,8EAA8E;AAE9E,SAAS,aAAa,CAAC,IAAa,EAAE,QAAgB;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,+BAA+B;QAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC,qBAAqB,EACpC,kBAAkB,QAAQ,2BAA2B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAgC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACjD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,QAAiB,EAA8B,EAAE;QAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,QAAQ;gBAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IACzE,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEtF,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAM,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC,qBAAqB,EACpC,GAAG,GAAG,CAAC,MAAM,CAAC,4CAA4C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChF,OAAO,SAAS,CAAC,qBAAqB,EACpC,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,KAAsC,CAAC;QACpD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,KAAM,CAAC;QACxB,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAM,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,KAA6B;QAC3C,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,KAAM;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;IACvD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAChE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,oEAAoE;IACpE,kCAAkC;IAClC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,MAAM,GAAG,GAA4B;QACnC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvG,UAAU,EAAE,CAAC,CAAC,SAAS;KACxB,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAc,EAAE,GAAS;IACzC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,qEAAqE;AACrE,8BAA8B;AAC9B,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,qBAAqB;AACrB,EAAE;AACF,wBAAwB;AACxB,kDAAkD;AAClD,mDAAmD;AACnD,wCAAwC;AACxC,oEAAoE;AACpE,EAAE;AACF,oCAAoC;AACpC,+FAA+F;AAC/F,wDAAwD;AACxD,+DAA+D;AAC/D,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,EAAE,EAAE,SAAS,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,OAAO,IAAI,SAAS,EACpB,SAAS,IAAI,WAAW,GAQzB,MAAM,YAAY,CAAC;AAEpB,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAC3C,MAAM,4BAA4B,GAAG,EAAE,CAAC,CAAG,0BAA0B;AACrE,MAAM,qBAAqB,GAAG,CAAC,CAAC,CAAY,yBAAyB;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEtE;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,GAAG,sBAAsB,GAAG,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,SAAS,CAAC,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,OAAO,UAAU;IAqBX;IACA;IArBF,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC3C,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IACvC,OAAO,GAAkB,EAAE,CAAC;IAEpC;;;;;;;;;;;;OAYG;IACK,SAAS,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAExD,YACU,QAAgB,EAChB,YAAgC;QADhC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,iBAAY,GAAZ,YAAY,CAAoB;IACvC,CAAC;IAEJ,mFAAmF;IAC3E,YAAY,CAAI,EAAoB;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAoB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,iCAAiC,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,8BAA8B,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,0EAA0E;QAC1E,oBAAoB;QACpB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAyB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAExD,uCAAuC;IACvC,IAAI,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,8DAA8D;IAC9D,WAAW,CAAC,MAAY,IAAI,IAAI,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,kEAAkE;IAClE,YAAY,CAAC,IAAe;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,2DAA2D;IAC3D,UAAU,CAAC,EAAW;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAoB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnD;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAe;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,UAAU,CAAC,IAAe;QACtC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAEtC,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,iBAAiB,EAChC,oDAAoD,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,+DAA+D;YAC/D,iEAAiE;YACjE,yEAAyE;YACzE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,EAAW;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,WAAW,CAAC,EAAW;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,EAAY,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,SAAS,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,EAAW;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,EAAW;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,EAAY,EAAE,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC,eAAe,EAC9B,SAAS,EAAY,sDAAsD,CAAC,CAAC;QACjF,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,IAAI,GAAc;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACjD,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3D,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAE9B,+EAA+E;QAC/E,gEAAgE;QAChE,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,SAAS,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,OAAO;QACnB,wEAAwE;QACxE,sEAAsE;QACtE,6BAA6B;QAC7B,MAAM,KAAK,GAA4B;YACrC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;SAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,qBAAqB,EACpC,oBAAoB,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,mEAAmE;YACnE,+CAA+C;YAC/C,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;YACxE,OAAO,SAAS,CAAC,qBAAqB,EACpC,oCAAoC,IAAI,CAAC,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;CACF;AAED,8EAA8E;AAE9E,SAAS,aAAa,CAAC,IAAa,EAAE,QAAgB;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,+BAA+B;QAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC,qBAAqB,EACpC,kBAAkB,QAAQ,2BAA2B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAgC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACjD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,QAAiB,EAA8B,EAAE;QAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,QAAQ;gBAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IACzE,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEtF,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAM,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC,qBAAqB,EACpC,GAAG,GAAG,CAAC,MAAM,CAAC,4CAA4C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,qBAAqB,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChF,OAAO,SAAS,CAAC,qBAAqB,EACpC,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,KAAsC,CAAC;QACpD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,KAAM,CAAC;QACxB,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAM,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,KAA6B;QAC3C,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,KAAM;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;IACvD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAChE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,oEAAoE;IACpE,kCAAkC;IAClC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,MAAM,GAAG,GAA4B;QACnC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvG,UAAU,EAAE,CAAC,CAAC,SAAS;KACxB,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAc,EAAE,GAAS;IACzC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp/tools/discover.d.ts

@@ -1,4 +1,38 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { InstanceCtx } from '../ctx.js';
+/** Outcome of gating a maad_scan target against the project root. */
+export type ScanTarget = {
+    ok: true;
+    absTarget: string;
+    kind: 'file' | 'directory';
+} | {
+    ok: false;
+    code: 'PATH_OUTSIDE_PROJECT' | 'PATH_NOT_FOUND';
+};
+/**
+ * Resolve and gate a caller-supplied scan path.
+ *
+ * Two gates, in this order:
+ *
+ *  1. Lexical containment — rejects `../` traversal without touching the disk.
+ *  2. Canonical containment — rejects paths that resolve outside the root
+ *     through a symlink or a Windows junction. The lexical check compares
+ *     strings, so `<root>/link/secret.md` passes it while reading from
+ *     wherever `link` points; statSync and readFile both follow links, so
+ *     containment has to be proven against the real path before any content
+ *     is opened.
+ *
+ * The canonical gate runs after the stat so a genuinely missing file still
+ * reports PATH_NOT_FOUND rather than being misreported as an escape —
+ * realpath throws on a path that does not exist.
+ *
+ * Residual: a link retargeted between this check and the subsequent read is
+ * not covered. Closing that needs open-then-verify on a handle, which is
+ * tracked with the scanner budget work.
+ *
+ * Exported so the gate is directly testable — the escape it prevents is not
+ * observable from the tool's success path.
+ */
+export declare function resolveScanTarget(projectRoot: string, requestedPath: string): ScanTarget;
 export declare function register(server: McpServer, ctx: InstanceCtx): number;
 //# sourceMappingURL=discover.d.ts.map

package/dist/mcp/tools/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/discover.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAI7C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAuFpE"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/discover.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAI7C,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,sBAAsB,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,UAAU,CAkBxF;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAkFpE"}

package/dist/mcp/tools/discover.js

@@ -3,11 +3,53 @@
 // ============================================================================
 import { z } from 'zod';
 import path from 'node:path';
+import { statSync } from 'node:fs';
 import { scanFile, scanDirectory } from '../../scanner.js';
 import { successResponse, errorResponse, getProvenanceMode } from '../response.js';
-import { isContainedIn } from '../../engine/pathguard.js';
+import { isContainedIn, isReallyContainedIn } from '../../engine/pathguard.js';
 import { withEngine } from '../with-session.js';
 import { checkProject } from '../../instructions/manifest.js';
+/**
+ * Resolve and gate a caller-supplied scan path.
+ *
+ * Two gates, in this order:
+ *
+ *  1. Lexical containment — rejects `../` traversal without touching the disk.
+ *  2. Canonical containment — rejects paths that resolve outside the root
+ *     through a symlink or a Windows junction. The lexical check compares
+ *     strings, so `<root>/link/secret.md` passes it while reading from
+ *     wherever `link` points; statSync and readFile both follow links, so
+ *     containment has to be proven against the real path before any content
+ *     is opened.
+ *
+ * The canonical gate runs after the stat so a genuinely missing file still
+ * reports PATH_NOT_FOUND rather than being misreported as an escape —
+ * realpath throws on a path that does not exist.
+ *
+ * Residual: a link retargeted between this check and the subsequent read is
+ * not covered. Closing that needs open-then-verify on a handle, which is
+ * tracked with the scanner budget work.
+ *
+ * Exported so the gate is directly testable — the escape it prevents is not
+ * observable from the tool's success path.
+ */
+export function resolveScanTarget(projectRoot, requestedPath) {
+    const absTarget = path.resolve(projectRoot, requestedPath);
+    if (!isContainedIn(absTarget, projectRoot)) {
+        return { ok: false, code: 'PATH_OUTSIDE_PROJECT' };
+    }
+    let stat;
+    try {
+        stat = statSync(absTarget);
+    }
+    catch {
+        return { ok: false, code: 'PATH_NOT_FOUND' };
+    }
+    if (!isReallyContainedIn(absTarget, projectRoot)) {
+        return { ok: false, code: 'PATH_OUTSIDE_PROJECT' };
+    }
+    return { ok: true, absTarget, kind: stat.isFile() ? 'file' : 'directory' };
+}
 export function register(server, ctx) {
     server.registerTool('maad_scan', {
         description: 'Analyze raw markdown structure. Works without registry. Use for onboarding new files. Pass a file path for detailed analysis or a directory for corpus-level patterns.',
@@ -16,23 +58,18 @@ export function register(server, ctx) {
             project: z.string().optional().describe('Project name (multi-project mode only)'),
         }),
     }, async (args, extra) => withEngine(ctx, extra, 'maad_scan', args, async ({ projectRoot }) => {
-        const absTarget = path.resolve(projectRoot, args.path);
-        if (!isContainedIn(absTarget, projectRoot)) {
-            return errorResponse([{ code: 'PATH_OUTSIDE_PROJECT', message: `Scan path must be within the project root: ${args.path}` }]);
-        }
-        const { statSync } = await import('node:fs');
-        let stat;
-        try {
-            stat = statSync(absTarget);
-        }
-        catch {
-            return errorResponse([{ code: 'PATH_NOT_FOUND', message: `Not found: ${args.path}` }]);
+        const target = resolveScanTarget(projectRoot, args.path);
+        if (!target.ok) {
+            const message = target.code === 'PATH_NOT_FOUND'
+                ? `Not found: ${args.path}`
+                : `Scan path must be within the project root: ${args.path}`;
+            return errorResponse([{ code: target.code, message }]);
         }
-        if (stat.isFile()) {
-            return successResponse(await scanFile(absTarget));
+        if (target.kind === 'file') {
+            return successResponse(await scanFile(target.absTarget));
         }
         else {
-            return successResponse(await scanDirectory(absTarget));
+            return successResponse(await scanDirectory(target.absTarget));
         }
     }));
     server.registerTool('maad_summary', {

package/dist/mcp/tools/discover.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/mcp/tools/discover.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0DAA0D;AAC1D,+EAA+E;AAE/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,MAAM,UAAU,QAAQ,CAAC,MAAiB,EAAE,GAAgB;IAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC/B,WAAW,EAAE,wKAAwK;QACrL,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;YACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QAC5F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,8CAA8C,IAAI,CAAC,IAAI,EAAE,EAAS,CAAC,CAAC,CAAC;QACtI,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,EAAE,EAAS,CAAC,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,eAAe,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE;QAClC,WAAW,EAAE,wJAAwJ;QACrK,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,qEAAqE;QACrE,6DAA6D;QAC7D,6CAA6C;QAC7C,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;aAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAC1C,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE;YAC1D,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,OAAO,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,sBAAsB,GAAG,QAAQ,KAAK,QAAQ;YAClD,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,YAAY,EAAE;oBACZ,yDAAyD;oBACzD,iEAAiE;oBACjE,uCAAuC;oBACvC,6DAA6D;oBAC7D,sDAAsD;oBACtD,oFAAoF;oBACpF,6EAA6E;iBAC9E;aACF;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE;oBACZ,gCAAgC;oBAChC,wCAAwC;oBACxC,uCAAuC;oBACvC,kEAAkE;oBAClE,6EAA6E;iBAC9E;aACF,CAAC;QAEN,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,iJAAiJ;QAC9J,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACrF,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/mcp/tools/discover.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0DAA0D;AAC1D,+EAA+E;AAE/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAO9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,aAAqB;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAiB,EAAE,GAAgB;IAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC/B,WAAW,EAAE,wKAAwK;QACrL,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;YACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QAC5F,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,gBAAgB;gBAC9C,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,EAAE;gBAC3B,CAAC,CAAC,8CAA8C,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,OAAO,eAAe,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE;QAClC,WAAW,EAAE,wJAAwJ;QACrK,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,qEAAqE;QACrE,6DAA6D;QAC7D,6CAA6C;QAC7C,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;aAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAC1C,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE;YAC1D,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,OAAO,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,sBAAsB,GAAG,QAAQ,KAAK,QAAQ;YAClD,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,YAAY,EAAE;oBACZ,yDAAyD;oBACzD,iEAAiE;oBACjE,uCAAuC;oBACvC,6DAA6D;oBAC7D,sDAAsD;oBACtD,oFAAoF;oBACpF,6EAA6E;iBAC9E;aACF;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE;oBACZ,gCAAgC;oBAChC,wCAAwC;oBACxC,uCAAuC;oBACvC,kEAAkE;oBAClE,6EAA6E;iBAC9E;aACF,CAAC;QAEN,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,iJAAiJ;QAC9J,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACrF,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maadb/core",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Markdown As A Database — treats markdown as the canonical data store, builds a queryable index, and gives LLMs deterministic read/write access.",
   "repository": {
     "type": "git",