@mcp-index/sdk 0.18.1 → 0.19.0

package/CHANGELOG.md

@@ -5,6 +5,16 @@ additive feature, patch = fix). Backward-compatible additions only in 0.2.0.
 
 ## [Unreleased]
 
+Version 0.19.0 in package.json. Not published yet.
+
+### Added
+
+- Lock mode, in three new subpaths. It follows mcp.lock draft 1, revision 1d, which is not stable: files carry `lockVersion: "1-draft"` and a later reader will refuse them. It is opt-in, and the root `@mcp-index/sdk` import does not load any of it.
+- `@mcp-index/sdk/lock`: reads and writes a lock in `.mcp/lock/` and `.mcp/contracts/`, checks each `tools/list` against it, and refuses calls to tools that are not approved with error -32011. `lockClient` and `LockedTransport` put it in front of the official MCP client. `FileLockStore` approves and revokes, verifies a signed manifest when a signer is configured, and refuses a `sequencePath` or `trustedRootPath` inside the lock's repository. Listing and refusal events go to a sink you pass.
+- `@mcp-index/sdk/lock/pg`: `PgLockStore`, a Postgres store with append-only hash-chained records, row-level security, `app-scoped` and `role-bound` tenancy, two roles, and an optional signed head that needs a sequence store.
+- `@mcp-index/sdk/ai`: `lockTransport` for `createMCPClient` from the Vercel AI SDK.
+- Optional peer dependencies: `@ai-sdk/mcp` for `/ai`, `pg` for `/lock/pg`, `sigstore` for signed locks. The package still has no runtime dependencies.
+
 ## 0.18.1 - 2026-10-13
 
 ### Changed

package/README.md

@@ -174,6 +174,184 @@ When enabled, each tool you pin and each contract drift sends **one one-way sign
 opt-in richer tier (it behaves identically today). The full notice is exported as
 `DRIFT_TELEMETRY_NOTICE`. Unset the variable any time to stop.
 
+## Lock mode (`@mcp-index/sdk/lock`)
+
+Lock mode checks every `tools/list` against an mcp.lock kept in your repository
+(`.mcp/lock/` and `.mcp/contracts/`, format: mcp.lock draft 1, revision 1e). The model sees
+only tools whose definition digest matches an approval, and a call to anything else is
+refused with JSON-RPC error -32011 before it reaches the server. Lock mode is opt-in and
+draft 1 is not stable. Nothing here runs unless you construct it, and the root
+`@mcp-index/sdk` import does not load it.
+
+Connect the official MCP client through `lockClient`:
+
+```ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { FileLockStore, lockClient } from "@mcp-index/sdk/lock";
+import type { Identity } from "@mcp-index/sdk/lock";
+
+const identity: Identity = { kind: "stdio", package: "npm:@example/docs-server" };
+const store = new FileLockStore({ root: process.cwd() }); // the directory that holds .mcp/
+const client = new Client({ name: "my-host", version: "1.0.0" });
+const transport = new StdioClientTransport({ command: "npx", args: ["-y", "@example/docs-server"] });
+const locked = await lockClient(client, transport, { store, identity, posture: "guard" });
+
+const { tools } = await client.listTools(); // approved tools only
+console.log(tools.map((t) => t.name), locked.decision?.withheld);
+```
+
+`posture` is `monitor` (show everything, report what does not match), `guard` (withhold it)
+or `strict` (same as guard in draft 1). Lock mode never approves a tool on first sight and
+never re-pins. The lock changes only through `store.approve` and `store.revoke`, or a
+reviewed edit to the lock files:
+
+```ts
+import { readFileSync } from "node:fs";
+
+// The Tool object exactly as the server sent it, saved for review. Not an SDK-parsed copy:
+// the SDK drops members it does not know, and the digest covers every member.
+const tool: unknown = JSON.parse(readFileSync("review/search.json", "utf8"));
+await store.approve({ identity, tool, subject: "github:you", via: "api", ref: "pr-42" });
+```
+
+The identity names the server, in one of three forms:
+
+```ts
+const remote: Identity = { kind: "remote", url: "https://mcp.example.com/v1/mcp" };
+const pkg: Identity = { kind: "stdio", package: "npm:@example/docs-server" }; // npm, pypi or oci
+const cmd: Identity = { kind: "stdio", command: "uvx", args: ["git+https://github.com/example/server"] };
+```
+
+`remoteIdentity`, `packageIdentity` and `commandIdentity` build them in normalized form.
+`commandIdentity` throws when an argument looks like a credential.
+
+A signed lock verifies `.mcp/lock/MANIFEST.json.sigstore` against a signer from your host
+configuration. It needs the optional `sigstore` peer, a trust root file, and a sequence file
+where the host keeps the highest manifest sequence it accepted, so an older signed manifest
+is refused after a newer one:
+
+```ts
+const signed = new FileLockStore({
+  root: "/srv/app",
+  signer: {
+    issuer: "https://token.actions.githubusercontent.com",
+    san: "https://github.com/acme/app/.github/workflows/lock.yml@refs/heads/main",
+  },
+  trustedRootPath: "/etc/mcplock/trusted_root.json",
+  sequencePath: "/var/lib/mcplock/sequence",
+});
+```
+
+Both paths must lie outside the repository that holds the lock, or the constructor throws
+`HostConfigError`. The repository is the nearest directory at or above `root` with a `.git`
+directory or a linked worktree's `.git` file; a submodule's `.git` file sends the search on to
+the superproject. The check compares directories by device and inode, so a case-folded
+spelling on macOS and a symlink followed by `..` are judged where they land, and a `..` in the
+part of a path that does not exist yet is refused. When no `.git` entry exists at or above
+`root`, only `root` itself is protected: a path beside it in the same untracked directory is
+accepted, so keep host files somewhere the lock's writers cannot reach. A signer without a sequence store makes every load
+`lock-signature-invalid`.
+
+## Postgres lock store (`@mcp-index/sdk/lock/pg`)
+
+`PgLockStore` keeps approvals in Postgres instead of files: append-only, hash-chained
+records per tenant, with row-level security on both tables. `pg` is an optional peer.
+
+The schema owner runs the migrations once. They are exported as SQL text:
+
+```ts
+import { writeFileSync } from "node:fs";
+import { MIGRATION_SQL, ROLE_BOUND_SQL, ROLE_SQL } from "@mcp-index/sdk/lock/pg";
+
+writeFileSync("mcplock-schema.sql", MIGRATION_SQL + ROLE_SQL);
+writeFileSync("mcplock-role-bound.sql", ROLE_BOUND_SQL); // only for role-bound tenancy
+// psql -v ON_ERROR_STOP=1 -f mcplock-schema.sql
+```
+
+`ROLE_SQL` creates two roles without login. `mcplock_runtime` may only read, and is what hosts
+in lock mode connect as. `mcplock_approver` may also append records and move the head, and
+belongs to the approval path only. Neither may update or delete a record. Grant each to its
+own login, and never connect as a superuser, since a superuser bypasses row-level security:
+
+```sql
+GRANT mcplock_runtime TO host_login;
+GRANT mcplock_approver TO approver_login;
+```
+
+Two tenancy modes:
+
+- `app-scoped` (the default, `MIGRATION_SQL` alone). The store sets the tenant from the
+  principal at the start of each transaction. This stops a query bug from reaching another
+  tenant. It does not stop someone holding a shared login, who can set any tenant.
+- `role-bound` (`ROLE_BOUND_SQL` after the other two). Each tenant gets its own logins, and
+  the administrator maps each login to its tenant in `mcplock.tenant_logins`. The policies
+  read the tenant from the login, so a login reaches only its own tenant. Use this before
+  sharing one database between tenants that do not trust each other.
+
+```ts
+import { PgLockStore, createPgPool } from "@mcp-index/sdk/lock/pg";
+
+const pool = await createPgPool(process.env.MCPLOCK_PG_URL ?? "postgres://host_login@127.0.0.1/app");
+const store = new PgLockStore({
+  pool,
+  principal: { tenantId: "acme", subject: "svc:docs-host" }, // from your own auth, never a header
+  tenancy: "app-scoped",
+});
+const snapshot = await store.loadSnapshot();
+console.log(snapshot.snapshotId);
+```
+
+With `headVerifier` set, each load checks a signature over the head row, and the store must
+also get a `sequenceStore`, for example `fileSequenceStore("/var/lib/mcplock/pg-sequence")`
+from `@mcp-index/sdk/lock`, or every load is `lock-signature-invalid`. Without a head
+signature, whoever can write the tables can rewrite the chain. Errors never carry the
+connection string unredacted.
+
+## Lock mode for the Vercel AI SDK (`@mcp-index/sdk/ai`)
+
+Wrap the transport you hand to `createMCPClient` from `@ai-sdk/mcp` (an optional peer). The
+wrapper reads the raw `tools/list` exchange, checks every tool against your mcp.lock, and the
+client only ever sees approved tools, through `tools()` or `listTools()` alike:
+
+```ts
+import { createMCPClient } from "@ai-sdk/mcp";
+import { Experimental_StdioMCPTransport } from "@ai-sdk/mcp/mcp-stdio";
+import { lockTransport } from "@mcp-index/sdk/ai";
+import { FileLockStore } from "@mcp-index/sdk/lock";
+import type { Identity } from "@mcp-index/sdk/lock";
+
+const identity: Identity = { kind: "stdio", package: "npm:@example/docs-server" };
+const store = new FileLockStore({ root: process.cwd() });
+const inner = new Experimental_StdioMCPTransport({ command: "npx", args: ["-y", "@example/docs-server"] });
+const transport = lockTransport(inner, { store, identity, posture: "guard" });
+const client = await createMCPClient({ transport });
+const tools = await client.tools(); // approved tools only
+console.log(Object.keys(tools));
+```
+
+A call to a withheld or unlisted tool never reaches the server. `callTool()` and the tool's
+`execute()` reject with an `MCPClientError` whose `code` is -32011 and `data.reason` says why;
+inside `generateText` that shows up as a `tool-error` part.
+
+Limits:
+
+- A digest says whether the contract changed. It says nothing about what the server does
+  when a tool runs.
+- The AI SDK client does not refetch on `notifications/tools/list_changed`. After an approval
+  or a server change, call `tools()` again; until then the previous allow-list holds. While a
+  listing is being collected, every call is refused with `no-listing`.
+- A tool's top-level `_meta` is not part of its digest. It reaches the client only when it
+  matches the `metaDigest` recorded at approval; otherwise, under guard, the tool is shown
+  without it and the decision reports `meta-changed` or `meta-unapproved`.
+- `@mcp-index/sdk/ai` imports only types from `@ai-sdk/mcp`, so loading it needs nothing at
+  runtime. The `@ai-sdk/mcp` peer itself needs Node >= 22; that is the only part with that
+  requirement, and the rest of the package runs on Node 20.
+- The AI SDK's own transports reject any message carrying a `__proto__` key before the wrapper
+  sees it, so such a listing never arrives and nothing is callable. The official SDK transports
+  pass it through and the lock withholds the tool. Instructions given to the client as
+  `initialInitializeResult` never cross the transport and are not checked.
+
 ## Related packages
 
 Three ways to bring mcpindex into an agent, for different surfaces:

package/dist/src/ai.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `@mcp-index/sdk/ai`: lock mode for the Vercel AI SDK MCP client
+ * (`createMCPClient` from `@ai-sdk/mcp`).
+ *
+ * The AI SDK client parses `tools/list` with its own zod schema and builds
+ * tools from what is left, so a digest over `client.listTools()` would not be
+ * a digest over what the server sent. lockTransport wraps the transport the
+ * client is given and works on JSON-RPC messages before the client sees them.
+ * The message work is LockedTransport from `../lock/rawList.ts`: every page of
+ * a listing is collected under private ids and digested raw, withheld tools
+ * are dropped, and the client gets one result with no cursor. `client.tools()`
+ * and `client.listTools()` + `toolsFromDefinitions()` both only ever see
+ * approved tools (under guard).
+ *
+ * Every `tools/call` is checked against the allow-list from the latest
+ * complete listing. A refused call is never sent; the client gets a JSON-RPC
+ * -32011 error with data.reason. In @ai-sdk/mcp 2.0.74 that rejects
+ * `callTool()` and the tool's `execute()` with an MCPClientError carrying
+ * code -32011 and data { reason, tool }; it is not retried (the client never
+ * retries an error with a JSON-RPC code). Inside generateText the throw
+ * becomes a `tool-error` part, so the model sees the refusal as a tool error.
+ *
+ * Limits, all from the AI SDK client as of 2.0.74:
+ *   - The client treats any server notification as "Unsupported message
+ *     type" and reports it to onUncaughtError, so it never refetches on
+ *     `notifications/tools/list_changed`. The wrapper still marks a listing
+ *     as due (`listingDue`) and keeps the old allow-list until a new complete
+ *     listing. The app has to call `tools()` again to see newly approved
+ *     tools, and to drop ones the server removed.
+ *   - The wrapper reports `supportsProtocolVersionDiscovery = false`, so the
+ *     client uses the `initialize` handshake. Server instructions then arrive
+ *     in the initialize result, where they are digested and, under guard,
+ *     stripped when they differ from the lock. Instructions passed to the
+ *     client as `initialInitializeResult` never cross the transport and are
+ *     not checked.
+ *   - The AI SDK's own stdio, SSE and HTTP transports parse with a secure
+ *     JSON parser that throws on a `__proto__` key. Such a message never
+ *     reaches the wrapper, so there is no listing and no tool is callable;
+ *     the official SDK transports keep the key and the lock withholds the tool.
+ *   - `@ai-sdk/mcp` needs Node >= 22. This module itself only imports types
+ *     from it.
+ *
+ * The check covers the tool contract the model reads, and nothing about what
+ * the server does when a tool runs.
+ */
+import type { JSONRPCMessage, MCPTransport, MCPTransportCloseOptions, MCPTransportSendOptions } from "@ai-sdk/mcp";
+import type { CallGate, Decision } from "./lock/check.js";
+import type { LockEventSink } from "./lock/events.js";
+import type { Identity, Posture } from "./lock/lock.js";
+import type { LockStore } from "./lock/store.js";
+/** Host settings that are not about which lock or which server. */
+export interface AiLockHostConfig {
+    /** The host name written into events. Default "mcpindex-sdk". */
+    readonly host?: string;
+    /** Age after which a call reloads the snapshot. Default 60 s. */
+    readonly maxStalenessMs?: number;
+    readonly now?: () => number;
+}
+export interface AiLockOptions {
+    readonly store: LockStore;
+    /** This server's identity (section 3), from host configuration. */
+    readonly identity: Identity;
+    /** monitor, guard, or strict (behaves as guard in draft 1). */
+    readonly posture: Posture;
+    readonly sink?: LockEventSink;
+    readonly hostConfig?: AiLockHostConfig;
+}
+export declare class AiLockTransport implements MCPTransport {
+    #private;
+    /** Forces the initialize handshake, where instructions are checked. */
+    readonly supportsProtocolVersionDiscovery = false;
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+    onmessage?: (message: JSONRPCMessage) => void;
+    constructor(inner: MCPTransport, options: AiLockOptions);
+    get supportsMcpToolParameterHeaders(): boolean | undefined;
+    get protocolVersion(): string | undefined;
+    set protocolVersion(version: string | undefined);
+    setProtocolVersion(version: string): void;
+    /** The per-connection allow-list. */
+    get gate(): CallGate;
+    /** The decision for the latest complete listing, or null before one. */
+    get decision(): Decision | null;
+    /** True after list_changed until the next complete listing (call tools() again). */
+    get listingDue(): boolean;
+    start(): Promise<void>;
+    send(message: JSONRPCMessage, options?: MCPTransportSendOptions): Promise<void>;
+    close(options?: MCPTransportCloseOptions): Promise<void>;
+}
+/**
+ * Wrap `inner` in lock mode for `createMCPClient({ transport })`.
+ * Lock mode has no auto-accept, first-use pin or re-pin; the lock changes
+ * only through LockStore.approve and revoke.
+ */
+export declare function lockTransport(inner: MCPTransport, options: AiLockOptions): AiLockTransport;
+//# sourceMappingURL=ai.d.ts.map

package/dist/src/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../src/ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACxC;AAuCD,qBAAa,eAAgB,YAAW,YAAY;;IAClD,uEAAuE;IACvE,QAAQ,CAAC,gCAAgC,SAAS;IAClD,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;gBAKlC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa;IAUvD,IAAI,+BAA+B,IAAI,OAAO,GAAG,SAAS,CAEzD;IAED,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAExC;IAED,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAE9C;IAED,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIzC,qCAAqC;IACrC,IAAI,IAAI,IAAI,QAAQ,CAEnB;IAED,wEAAwE;IACxE,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,CAE9B;IAED,oFAAoF;IACpF,IAAI,UAAU,IAAI,OAAO,CAExB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtB,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/E,KAAK,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,GAAG,eAAe,CAE1F"}

package/dist/src/ai.js

@@ -0,0 +1,151 @@
+/**
+ * `@mcp-index/sdk/ai`: lock mode for the Vercel AI SDK MCP client
+ * (`createMCPClient` from `@ai-sdk/mcp`).
+ *
+ * The AI SDK client parses `tools/list` with its own zod schema and builds
+ * tools from what is left, so a digest over `client.listTools()` would not be
+ * a digest over what the server sent. lockTransport wraps the transport the
+ * client is given and works on JSON-RPC messages before the client sees them.
+ * The message work is LockedTransport from `../lock/rawList.ts`: every page of
+ * a listing is collected under private ids and digested raw, withheld tools
+ * are dropped, and the client gets one result with no cursor. `client.tools()`
+ * and `client.listTools()` + `toolsFromDefinitions()` both only ever see
+ * approved tools (under guard).
+ *
+ * Every `tools/call` is checked against the allow-list from the latest
+ * complete listing. A refused call is never sent; the client gets a JSON-RPC
+ * -32011 error with data.reason. In @ai-sdk/mcp 2.0.74 that rejects
+ * `callTool()` and the tool's `execute()` with an MCPClientError carrying
+ * code -32011 and data { reason, tool }; it is not retried (the client never
+ * retries an error with a JSON-RPC code). Inside generateText the throw
+ * becomes a `tool-error` part, so the model sees the refusal as a tool error.
+ *
+ * Limits, all from the AI SDK client as of 2.0.74:
+ *   - The client treats any server notification as "Unsupported message
+ *     type" and reports it to onUncaughtError, so it never refetches on
+ *     `notifications/tools/list_changed`. The wrapper still marks a listing
+ *     as due (`listingDue`) and keeps the old allow-list until a new complete
+ *     listing. The app has to call `tools()` again to see newly approved
+ *     tools, and to drop ones the server removed.
+ *   - The wrapper reports `supportsProtocolVersionDiscovery = false`, so the
+ *     client uses the `initialize` handshake. Server instructions then arrive
+ *     in the initialize result, where they are digested and, under guard,
+ *     stripped when they differ from the lock. Instructions passed to the
+ *     client as `initialInitializeResult` never cross the transport and are
+ *     not checked.
+ *   - The AI SDK's own stdio, SSE and HTTP transports parse with a secure
+ *     JSON parser that throws on a `__proto__` key. Such a message never
+ *     reaches the wrapper, so there is no listing and no tool is callable;
+ *     the official SDK transports keep the key and the lock withholds the tool.
+ *   - `@ai-sdk/mcp` needs Node >= 22. This module itself only imports types
+ *     from it.
+ *
+ * The check covers the tool contract the model reads, and nothing about what
+ * the server does when a tool runs.
+ */
+import { LockedTransport } from "./lock/rawList.js";
+/**
+ * Adapts an AI SDK MCPTransport (or an official SDK transport, which has the
+ * same shape) to the Transport that LockedTransport drives.
+ */
+class InnerAdapter {
+    inner;
+    onclose;
+    onerror;
+    onmessage;
+    closeOptions;
+    constructor(inner) {
+        this.inner = inner;
+    }
+    async start() {
+        this.inner.onmessage = (message) => this.onmessage?.(message);
+        this.inner.onerror = (error) => this.onerror?.(error instanceof Error ? error : new Error(String(error)));
+        this.inner.onclose = () => this.onclose?.();
+        await this.inner.start();
+    }
+    async send(message, options) {
+        const m = message;
+        if (options === undefined)
+            await this.inner.send(m);
+        else
+            await this.inner.send(m, options);
+    }
+    async close() {
+        const options = this.closeOptions;
+        if (options === undefined)
+            await this.inner.close();
+        else
+            await this.inner.close(options);
+    }
+    setProtocolVersion(version) {
+        if (typeof this.inner.setProtocolVersion === "function")
+            this.inner.setProtocolVersion(version);
+        else
+            this.inner.protocolVersion = version;
+    }
+}
+export class AiLockTransport {
+    /** Forces the initialize handshake, where instructions are checked. */
+    supportsProtocolVersionDiscovery = false;
+    onclose;
+    onerror;
+    onmessage;
+    #adapter;
+    #locked;
+    constructor(inner, options) {
+        const { hostConfig, ...rest } = options;
+        // hostConfig goes first so it cannot replace store, identity or posture.
+        // Any key the core refuses (autoAccept, tofu, repin, ...) at either level
+        // reaches the LockedTransport constructor and throws there.
+        const lockOptions = { ...(hostConfig ?? {}), ...rest };
+        this.#adapter = new InnerAdapter(inner);
+        this.#locked = new LockedTransport(this.#adapter, lockOptions);
+    }
+    get supportsMcpToolParameterHeaders() {
+        return this.#adapter.inner.supportsMcpToolParameterHeaders;
+    }
+    get protocolVersion() {
+        return this.#adapter.inner.protocolVersion;
+    }
+    set protocolVersion(version) {
+        if (version !== undefined)
+            this.#adapter.setProtocolVersion(version);
+    }
+    setProtocolVersion(version) {
+        this.#adapter.setProtocolVersion(version);
+    }
+    /** The per-connection allow-list. */
+    get gate() {
+        return this.#locked.gate;
+    }
+    /** The decision for the latest complete listing, or null before one. */
+    get decision() {
+        return this.#locked.decision;
+    }
+    /** True after list_changed until the next complete listing (call tools() again). */
+    get listingDue() {
+        return this.#locked.listingDue;
+    }
+    async start() {
+        this.#locked.onmessage = (message) => this.onmessage?.(message);
+        this.#locked.onerror = (error) => this.onerror?.(error);
+        this.#locked.onclose = () => this.onclose?.();
+        await this.#locked.start();
+    }
+    async send(message, options) {
+        await this.#locked.send(message, options);
+    }
+    async close(options) {
+        this.#adapter.closeOptions = options;
+        await this.#locked.close();
+    }
+}
+/**
+ * Wrap `inner` in lock mode for `createMCPClient({ transport })`.
+ * Lock mode has no auto-accept, first-use pin or re-pin; the lock changes
+ * only through LockStore.approve and revoke.
+ */
+export function lockTransport(inner, options) {
+    return new AiLockTransport(inner, options);
+}
+//# sourceMappingURL=ai.js.map

package/dist/src/ai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.js","sourceRoot":"","sources":["../../src/ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAcH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAuBpD;;;GAGG;AACH,MAAM,YAAY;IAMK;IALrB,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAA8C;IACvD,YAAY,CAAuC;IAEnD,YAAqB,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAE5C,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAgC,CAAC,CAAC;QACvG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB,EAAE,OAA8B;QAC5D,MAAM,CAAC,GAAG,OAAoC,CAAC;QAC/C,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,OAAkC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,kBAAkB,CAAC,OAAe;QAChC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;;YAC3F,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAC1B,uEAAuE;IAC9D,gCAAgC,GAAG,KAAK,CAAC;IAClD,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAAqC;IAErC,QAAQ,CAAe;IACvB,OAAO,CAAkB;IAElC,YAAY,KAAmB,EAAE,OAAsB;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QACxC,yEAAyE;QACzE,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAiB,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,+BAA+B;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC;IAC7D,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;IAC7C,CAAC;IAED,IAAI,eAAe,CAAC,OAA2B;QAC7C,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,qCAAqC;IACrC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED,oFAAoF;IACpF,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAoC,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB,EAAE,OAAiC;QACnE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAgC,EAAE,OAA2C,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAkC;QAC5C,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,OAAO,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,OAAsB;IACvE,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/src/lock/check.d.ts

@@ -0,0 +1,143 @@
+/**
+ * The lock check (section 9): a pure decision over one complete listing, and a
+ * per-connection CallGate that allows `tools/call` only for names shown on the
+ * latest checked listing.
+ *
+ * Lock mode has no first-use pin, no auto-accept and no re-pin. Nothing here
+ * writes to a lock; the lock changes only through LockStore.approve/revoke.
+ */
+import { LockError } from "./lock.js";
+import type { Identity, Lock, LockErrorReason, Posture } from "./lock.js";
+export declare const LOCK_REFUSAL_CODE = -32011;
+export declare const LOCK_REFUSAL_MESSAGE = "Tool withheld by lock";
+export type ToolReason = "unlocked-server" | "duplicate-name" | "no-digest" | "new-tool" | "upstream-changed";
+/** Why a shown tool's top-level `_meta` was not relayed as approved (draft 1c). */
+export type MetaReason = "meta-changed" | "meta-unapproved";
+export type CallReason = ToolReason | LockErrorReason | "no-listing" | "not-listed" | "classifier-error" | "unreachable";
+export interface ToolOutcome {
+    readonly name: string;
+    readonly served: string | null;
+    readonly approved: string | null;
+    readonly decision: "shown" | "withheld";
+    readonly reason: ToolReason | LockErrorReason | null;
+    /** Section 9.2.3 flag for a shown tool's top-level `_meta`, else null. */
+    readonly meta: MetaReason | null;
+}
+/** Section 9.2.3 decision for one shown tool that has a top-level `_meta`. */
+export interface MetaDecision {
+    /** True when `_meta` reaches the client as served. */
+    readonly relay: boolean;
+    readonly flag: MetaReason | null;
+}
+export interface Decision {
+    readonly posture: Posture;
+    /** Names shown to the model, in listing order (a duplicate name under monitor repeats). */
+    readonly shown: readonly string[];
+    /** Name to reason, under guard (or for any lock failure). */
+    readonly withheld: ReadonlyMap<string, ToolReason | LockErrorReason>;
+    /** Name to reason, under monitor: shown but reported. */
+    readonly flagged: ReadonlyMap<string, ToolReason>;
+    readonly removed: readonly string[];
+    readonly instructions: "instructions-changed" | null;
+    readonly stripInstructions: boolean;
+    readonly lockError: LockErrorReason | null;
+    /** The allow-list for calls on this connection. */
+    readonly callable: ReadonlySet<string>;
+    /** Indexes into the listing's tools array of the entries the model may see. */
+    readonly shownIndexes: readonly number[];
+    /**
+     * Every shown tool with a top-level `_meta`: name to whether it is relayed
+     * and its flag. A served `_meta` that does not match the approved
+     * metaDigest is flagged; under guard it is removed before the tool is
+     * relayed (stripMeta), under monitor it is relayed and reported.
+     */
+    readonly meta: ReadonlyMap<string, MetaDecision>;
+    /** Indexes into the listing's tools array whose `_meta` is removed before relay. */
+    readonly stripMeta: ReadonlySet<number>;
+    /** One row per named listing entry, for the listing event. */
+    readonly tools: readonly ToolOutcome[];
+    readonly served: number;
+}
+export interface Listing {
+    readonly tools: readonly unknown[];
+    readonly instructions?: unknown;
+}
+export declare function isPosture(value: unknown): value is Posture;
+/**
+ * Check one complete listing against a lock, or against a whole-lock failure.
+ * `listing.tools` is the raw array as received; nothing is fetched again.
+ */
+export declare function checkListing(lock: Lock | LockError, identity: Identity, listing: Listing, posture: Posture): Decision;
+/** Decide instructions alone, for a host that sees them before any listing (initialize). */
+export declare function checkInstructions(lock: Lock | LockError, identity: Identity, instructions: unknown, posture: Posture): {
+    readonly reason: "instructions-changed" | LockErrorReason | null;
+    readonly strip: boolean;
+};
+/** 'allow', or the reason sent in data.reason of a -32011 error. */
+export declare function checkCall(decision: Decision | null, name: string): "allow" | CallReason;
+export interface RefusalError {
+    readonly code: typeof LOCK_REFUSAL_CODE;
+    readonly message: string;
+    /** `tool` is left out when the call's name was not a string, as in the Python host. */
+    readonly data: {
+        readonly reason: CallReason;
+        readonly tool?: string;
+    };
+}
+export declare function refusalError(name: string | null, reason: CallReason): RefusalError;
+/** Error thrown to callers who check through CallGate.enforce. */
+export declare class LockRefusal extends Error {
+    readonly code = -32011;
+    readonly reason: CallReason;
+    readonly tool: string;
+    constructor(tool: string, reason: CallReason);
+    toJsonRpcError(): RefusalError;
+}
+/** Default age after which a call first reloads the snapshot (section 9.8), as in the Python host. */
+export declare const DEFAULT_MAX_STALENESS_MS = 60000;
+export interface CallGateOptions {
+    /**
+     * Section 9.8: once the snapshot behind the decision is older than this, a
+     * call reloads it first (LockedTransport) and is refused with `lock-stale`
+     * when the reload fails. Default 60 s. Pass Infinity to never go stale.
+     */
+    readonly maxStalenessMs?: number;
+    readonly now?: () => number;
+}
+/**
+ * Per-connection allow-list. `record` replaces the decision only when a
+ * complete listing has been checked. A list_changed notification does not
+ * touch it. While a listing is in progress (section 9.2.1: `beginListing`
+ * until `record` or `markUnreachable`) every call is refused with
+ * `no-listing`, so nothing is called on the strength of a listing that is
+ * being replaced.
+ *
+ * Order of reasons (section 9.5): `no-listing` while a listing is in
+ * progress or before any listing has ended; then the whole-lock error of the
+ * latest completed listing, which a later failed listing does not clear;
+ * then `unreachable` after a failed listing; then `lock-stale`; then the
+ * per-name answer.
+ */
+export declare class CallGate {
+    #private;
+    constructor(options?: CallGateOptions);
+    get decision(): Decision | null;
+    get snapshotId(): string | null;
+    /** A listing started: the host asked for its first page. */
+    beginListing(): void;
+    /** The listing in progress ended without a decision and without failing. */
+    endListing(): void;
+    get listingInProgress(): boolean;
+    /** Install the decision for the latest complete listing. */
+    record(decision: Decision, snapshot: {
+        readonly snapshotId: string;
+        readonly loadedAt: number;
+    }): void;
+    /** The latest listing failed; refuse every call with `unreachable` until one completes. */
+    markUnreachable(): void;
+    get unreachable(): boolean;
+    isStale(): boolean;
+    check(name: string): "allow" | CallReason;
+    enforce(name: string): void;
+}
+//# sourceMappingURL=check.d.ts.map

package/dist/src/lock/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/lock/check.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,SAAS,EAAyB,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1E,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,kBAAkB,CAAC;AAC9G,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,iBAAiB,CAAC;AAC5D,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,YAAY,GAAG,YAAY,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAEzH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CAClC;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC;IACrE,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACrD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAE1D;AAYD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,CA4GrH;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,IAAI,GAAG,SAAS,EACtB,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE,OAAO,GACf;IAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,eAAe,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAK/F;AAED,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAKvF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,iBAAiB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,YAAY,CAGlF;AAED,kEAAkE;AAClE,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,UAAqB;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;IAM5C,cAAc,IAAI,YAAY;CAG/B;AAED,sGAAsG;AACtG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,QAAQ;;gBASP,OAAO,GAAE,eAAoB;IAOzC,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,CAE9B;IAED,IAAI,UAAU,IAAI,MAAM,GAAG,IAAI,CAE9B;IAED,4DAA4D;IAC5D,YAAY,IAAI,IAAI;IAIpB,4EAA4E;IAC5E,UAAU,IAAI,IAAI;IAIlB,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,4DAA4D;IAC5D,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAQtG,2FAA2F;IAC3F,eAAe,IAAI,IAAI;IAKvB,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,OAAO,IAAI,OAAO;IAKlB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU;IASzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAI5B"}