@mcp-index/sdk 0.18.1 → 0.19.1

package/dist/src/lock/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/lock/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG/E,eAAO,MAAM,YAAY,0BAA0B,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,SAAS;IACjB,QAAQ,CAAC,MAAM,EAAE,OAAO,YAAY,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1H,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC;QACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;QACrD,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AACpE,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAYD,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,CAwBpG;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,YAAY,CAE9F;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClF,aAAa,CAUf;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAO5E;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAIzD"}

package/dist/src/lock/events.js

@@ -0,0 +1,80 @@
+/**
+ * mcpindex.lock.event/1 records (section 10), handed to a sink the caller
+ * passes in. Nothing here opens a network connection; the only file sink is
+ * one the caller constructs with a path.
+ *
+ * Events carry tool names, digests and reason codes. They never carry call
+ * arguments, call results, descriptions, instructions text or credentials:
+ * builders take only those fields, so there is no object to leak from.
+ */
+import { appendFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { identityH16, slug } from "./lock.js";
+import { nowRfc3339 } from "./store.js";
+export const EVENT_SCHEMA = "mcpindex.lock.event/1";
+function base(ctx) {
+    return {
+        schema: EVENT_SCHEMA,
+        id: (ctx.newId ?? randomUUID)(),
+        time: nowRfc3339((ctx.now ?? (() => new Date()))()),
+        host: ctx.host,
+        server: { h16: identityH16(ctx.identity), slug: slug(ctx.identity) },
+    };
+}
+export function listingEvent(ctx, decision, snapshotId) {
+    // As in the Python host: every served entry that is not shown counts as
+    // withheld, entries without a string name included.
+    const withheld = decision.served - decision.shown.length;
+    return {
+        ...base(ctx),
+        type: "listing",
+        posture: decision.posture,
+        lockError: decision.lockError,
+        counts: { served: decision.served, shown: decision.shown.length, withheld, removed: decision.removed.length },
+        tools: decision.tools.map((t) => ({
+            name: t.name,
+            served: t.served,
+            approved: t.approved,
+            decision: t.decision,
+            reason: t.reason,
+            meta: t.meta,
+        })),
+        removed: [...decision.removed],
+        // Under a whole-lock failure the instructions are withheld with everything
+        // else and the event carries no instructions code, as in the Python host.
+        instructions: decision.lockError !== null ? null : decision.instructions,
+        snapshotId,
+    };
+}
+export function refusalEvent(ctx, tool, reason) {
+    return { ...base(ctx), type: "refusal", tool, reason };
+}
+export function approvalEvent(ctx, approval) {
+    return {
+        ...base(ctx),
+        type: "approval",
+        tool: approval.tool,
+        digest: approval.digest,
+        via: approval.via,
+        subject: approval.subject,
+        ref: approval.ref ?? null,
+    };
+}
+/** Call the sink and swallow its errors: an event failure never changes a decision. */
+export function emit(sink, event) {
+    if (sink === undefined)
+        return;
+    try {
+        sink(event);
+    }
+    catch {
+        // sink errors are the sink's problem
+    }
+}
+/** Append one JSON line per event to `path`. Only used when a caller builds it. */
+export function jsonlFileSink(path) {
+    return (event) => {
+        appendFileSync(path, JSON.stringify(event) + "\n", { encoding: "utf8", mode: 0o600 });
+    };
+}
+//# sourceMappingURL=events.js.map

package/dist/src/lock/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/lock/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AA2DpD,SAAS,IAAI,CAAC,GAAiB;IAC7B,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE;QAC/B,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,QAAkB,EAAE,UAAkB;IACpF,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACzD,OAAO;QACL,GAAG,IAAI,CAAC,GAAG,CAAC;QACZ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;QAC7G,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC9B,2EAA2E;QAC3E,0EAA0E;QAC1E,YAAY,EAAE,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY;QACxE,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,IAAY,EAAE,MAAkB;IAC9E,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAiB,EACjB,QAAmF;IAEnF,OAAO;QACL,GAAG,IAAI,CAAC,GAAG,CAAC;QACZ,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAAC,IAA+B,EAAE,KAAgB;IACpE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/lock/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@mcp-index/sdk/lock`: lock mode (mcp.lock draft 1). Opt-in; nothing here
+ * runs unless a host constructs it. The root `@mcp-index/sdk` import does not
+ * load this module. The Postgres store is a separate subpath,
+ * `@mcp-index/sdk/lock/pg`.
+ */
+export { CanonicalizationError, DIGEST_PREFIX, NUMBER_LIMIT, canonicalBody, canonicalize, hasLoneSurrogate, instructionsDigest, metaDigest, toolDigest, toolSetDigest, } from "./digest.js";
+export { ALIASES, FrozenMap, LOCK_VERSION, LockError, MANIFEST, POSTURES, REGISTRIES, SEQUENCE_MAX, SIGNATURE, commandIdentity, findDuplicateKey, findNonIntegerNumber, formatAliases, formatLockFile, formatManifest, formatShard, identityH16, identityKey, loadLock, normalizeUrl, packageIdentity, parseShard, remoteIdentity, resolveAlias, secretArgProblem, shardFilename, slug, strictJson, validateIdentity, } from "./lock.js";
+export type { Approval, Attributes, CommandIdentity, Identity, LoadedLock, Lock, LockErrorReason, ManifestVerifier, PackageIdentity, Posture, ReaderConfig, RemoteIdentity, Shard, SignerIdentity, ToolEntry, Via, } from "./lock.js";
+export { CallGate, DEFAULT_MAX_STALENESS_MS, LOCK_REFUSAL_CODE, LOCK_REFUSAL_MESSAGE, LockRefusal, checkCall, checkInstructions, checkListing, isPosture, refusalError, } from "./check.js";
+export type { CallGateOptions, CallReason, Decision, Listing, MetaReason, RefusalError, ToolOutcome, ToolReason } from "./check.js";
+export { FileLockStore, HostConfigError, fileSequenceStore, hostPathProblem, nowRfc3339, prepareTool, repositoryRoot } from "./store.js";
+export type { ApproveInstructionsRequest, ApproveRequest, ApproveToolRequest, FileLockStoreOptions, LockSnapshot, LockStore, RevokeRequest, SequenceStore, } from "./store.js";
+export { EVENT_SCHEMA, approvalEvent, jsonlFileSink, listingEvent, refusalEvent } from "./events.js";
+export type { ApprovalEvent, EventContext, ListingEvent, LockEvent, LockEventSink, RefusalEvent } from "./events.js";
+export { HANDSHAKE_METHODS, LockedTransport, MAX_LIST_PAGES, MAX_LIST_TOOLS, MAX_OUTSTANDING, REQUEST_TTL_MS, lockClient } from "./rawList.js";
+export type { ConnectableClient, LockOptions } from "./rawList.js";
+export { anchoredPattern, sigstoreVerifier } from "./signing.js";
+export type { SigstoreVerifierOptions } from "./signing.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/lock/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lock/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,OAAO,EACP,SAAS,EACT,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,IAAI,EACJ,UAAU,EACV,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,QAAQ,EACR,UAAU,EACV,eAAe,EACf,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,OAAO,EACP,YAAY,EACZ,cAAc,EACd,KAAK,EACL,cAAc,EACd,SAAS,EACT,GAAG,GACJ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,QAAQ,EACR,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACzI,YAAY,EACV,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,SAAS,EACT,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/I,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC"}

package/dist/src/lock/index.js

@@ -0,0 +1,14 @@
+/**
+ * `@mcp-index/sdk/lock`: lock mode (mcp.lock draft 1). Opt-in; nothing here
+ * runs unless a host constructs it. The root `@mcp-index/sdk` import does not
+ * load this module. The Postgres store is a separate subpath,
+ * `@mcp-index/sdk/lock/pg`.
+ */
+export { CanonicalizationError, DIGEST_PREFIX, NUMBER_LIMIT, canonicalBody, canonicalize, hasLoneSurrogate, instructionsDigest, metaDigest, toolDigest, toolSetDigest, } from "./digest.js";
+export { ALIASES, FrozenMap, LOCK_VERSION, LockError, MANIFEST, POSTURES, REGISTRIES, SEQUENCE_MAX, SIGNATURE, commandIdentity, findDuplicateKey, findNonIntegerNumber, formatAliases, formatLockFile, formatManifest, formatShard, identityH16, identityKey, loadLock, normalizeUrl, packageIdentity, parseShard, remoteIdentity, resolveAlias, secretArgProblem, shardFilename, slug, strictJson, validateIdentity, } from "./lock.js";
+export { CallGate, DEFAULT_MAX_STALENESS_MS, LOCK_REFUSAL_CODE, LOCK_REFUSAL_MESSAGE, LockRefusal, checkCall, checkInstructions, checkListing, isPosture, refusalError, } from "./check.js";
+export { FileLockStore, HostConfigError, fileSequenceStore, hostPathProblem, nowRfc3339, prepareTool, repositoryRoot } from "./store.js";
+export { EVENT_SCHEMA, approvalEvent, jsonlFileSink, listingEvent, refusalEvent } from "./events.js";
+export { HANDSHAKE_METHODS, LockedTransport, MAX_LIST_PAGES, MAX_LIST_TOOLS, MAX_OUTSTANDING, REQUEST_TTL_MS, lockClient } from "./rawList.js";
+export { anchoredPattern, sigstoreVerifier } from "./signing.js";
+//# sourceMappingURL=index.js.map

package/dist/src/lock/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lock/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,OAAO,EACP,SAAS,EACT,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,IAAI,EACJ,UAAU,EACV,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAmBnB,OAAO,EACL,QAAQ,EACR,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAWzI,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErG,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/I,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/src/lock/lock.d.ts

@@ -0,0 +1,195 @@
+/**
+ * Lock format draft 1 (spec/mcp-lock-draft-1.md in mcp-tool-pinning): server
+ * identity, the strict reader for `.mcp/lock` and `.mcp/contracts`, and a
+ * writer whose bytes match the Python generator (json.dumps indent=2 with
+ * ensure_ascii, trailing newline).
+ *
+ * The reader mirrors mcp_tool_pinning.lockref check for check and in the same
+ * order, so a lock with one fault gives the same reason code in both. Every
+ * file is read once; the manifest, signature and parse all use those bytes.
+ */
+export declare const LOCK_VERSION = "1-draft";
+export declare const POSTURES: readonly ["monitor", "guard", "strict"];
+export type Posture = (typeof POSTURES)[number];
+export declare const REGISTRIES: readonly ["npm", "pypi", "oci"];
+export type Registry = (typeof REGISTRIES)[number];
+export declare const MANIFEST = "MANIFEST.json";
+export declare const SIGNATURE = "MANIFEST.json.sigstore";
+export declare const ALIASES = "aliases.json";
+export declare const SLUG_MAX = 48;
+/** Largest manifest sequence; every reader parses it exactly. */
+export declare const SEQUENCE_MAX: number;
+export declare const SHARD_NAME: RegExp;
+export declare const CONTRACT_NAME: RegExp;
+export declare const DIGEST_FORM: RegExp;
+export declare const VIA: readonly ["pr", "runtime", "api", "migrated"];
+export type Via = (typeof VIA)[number];
+/** Whole-lock reason codes, plus `lock-stale` for a snapshot past its age limit. */
+export type LockErrorReason = "lock-unreadable" | "lock-unsupported" | "lock-signature-invalid" | "contract-mismatch" | "lock-stale";
+export declare class LockError extends Error {
+    readonly reason: LockErrorReason;
+    readonly detail: string;
+    constructor(reason: LockErrorReason, detail: string);
+}
+/** Read-only Map view. Snapshots hand these out so a holder cannot edit them. */
+export declare class FrozenMap<K, V> implements ReadonlyMap<K, V> {
+    #private;
+    constructor(entries: Iterable<readonly [K, V]>);
+    get size(): number;
+    get(key: K): V | undefined;
+    has(key: K): boolean;
+    forEach(fn: (value: V, key: K, map: ReadonlyMap<K, V>) => void): void;
+    entries(): MapIterator<[K, V]>;
+    keys(): MapIterator<K>;
+    values(): MapIterator<V>;
+    [Symbol.iterator](): MapIterator<[K, V]>;
+}
+export type RemoteIdentity = {
+    readonly kind: "remote";
+    readonly url: string;
+};
+export type PackageIdentity = {
+    readonly kind: "stdio";
+    readonly package: string;
+};
+export type CommandIdentity = {
+    readonly kind: "stdio";
+    readonly command: string;
+    readonly args: readonly string[];
+};
+export type Identity = RemoteIdentity | PackageIdentity | CommandIdentity;
+/** Section 3.1. Throws Error on a URL that cannot be an identity. */
+export declare function normalizeUrl(url: string): string;
+export declare function remoteIdentity(url: string): RemoteIdentity;
+export declare function packageIdentity(registry: string, name: string): PackageIdentity;
+/**
+ * Section 3.2 command form: the basename of the command and every argument
+ * verbatim. Throws for a command that is not a basename once its path is
+ * removed, and for secret-looking arguments (section 3.2.1), which an identity
+ * can neither keep nor strip. The message names the rule, never the value.
+ */
+export declare function commandIdentity(command: string, args?: readonly string[]): CommandIdentity;
+/** null if no argument is secret-looking under section 3.2.1, else what was found. */
+export declare function secretArgProblem(args: readonly string[]): string | null;
+/** Validate a parsed identity object. Returns a fresh frozen copy or throws LockError. */
+export declare function validateIdentity(value: unknown): Identity;
+/** RFC 8785 text of the identity (section 3.3). Compare identities by this string. */
+export declare function identityKey(identity: Identity): string;
+export declare function identityH16(identity: Identity): string;
+export declare function slug(identity: Identity): string;
+export declare function shardFilename(identity: Identity): string;
+/**
+ * Find a member name repeated within one object. JSON.parse keeps the last
+ * value silently, so this scans the text, which JSON.parse has already
+ * accepted, and compares decoded names (so "a" and "a" collide).
+ */
+/**
+ * Section 4.3: every number in a lock file is an integer token. JSON.parse
+ * turns 1.0 and 1e0 into 1, so the raw text is checked. Returns the first
+ * offending token, or null. Outside strings, a number is the only token that
+ * starts with `-` or a digit.
+ */
+export declare function findNonIntegerNumber(text: string): string | null;
+export declare function findDuplicateKey(text: string): string | null;
+/**
+ * Parse lock file bytes: UTF-8 (a BOM is kept and so rejected), JSON, no repeated
+ * member names, integer number tokens only. JSON.parse has no NaN or Infinity,
+ * so that rule needs no code.
+ */
+export declare function strictJson(data: Uint8Array, what: string): unknown;
+export interface Approval {
+    readonly subject: string;
+    readonly at: string;
+    readonly via: Via;
+    readonly ref?: string;
+}
+export interface ToolEntry {
+    readonly digest: string;
+    readonly contract: string;
+    /** Digest of the top-level `_meta` approved with the tool, when it had one. */
+    readonly metaDigest?: string;
+    readonly approval: Approval;
+}
+export interface Attributes {
+    readonly version?: string;
+    readonly audience?: string;
+    readonly command?: string;
+    readonly args?: readonly string[];
+    readonly env?: readonly string[];
+}
+export interface Shard {
+    readonly identity: Identity;
+    readonly attributes: Attributes | null;
+    /** Instructions digest, or null when the shard has none. */
+    readonly instructions: string | null;
+    /** Tool name to entry, in file order. */
+    readonly tools: ReadonlyMap<string, ToolEntry>;
+}
+export interface Lock {
+    /** Identity key to shard. */
+    readonly shards: ReadonlyMap<string, Shard>;
+    readonly aliases: ReadonlyMap<string, Identity>;
+    /** Manifest sequence, or null without a manifest. */
+    readonly sequence: number | null;
+}
+export interface SignerIdentity {
+    /** Certificate issuer, compared exactly. */
+    readonly issuer: string;
+    /** Certificate subject alternative name, compared exactly. */
+    readonly san: string;
+}
+/** Verifies a Sigstore bundle over the exact manifest bytes. Any throw counts as false. */
+export interface ManifestVerifier {
+    verify(manifest: Uint8Array, bundle: Uint8Array, signer: SignerIdentity): Promise<boolean>;
+}
+/** Host configuration. Never read from the lock repository or the environment. */
+export interface ReaderConfig {
+    readonly requireManifest?: boolean;
+    readonly signer?: SignerIdentity | null;
+    /**
+     * Section 8.2: true when the host keeps a sequence store. Required with a
+     * signer; `lastSequence` is the floor read from it (null when it holds none).
+     */
+    readonly sequenceStore?: boolean;
+    readonly lastSequence?: number | null;
+    readonly verifier?: ManifestVerifier | null;
+}
+/** Every file in `.mcp/lock`, read once. Names are checked as raw bytes for ASCII. */
+export declare function readLockDir(lockDir: string): Map<string, Buffer>;
+/** Section 6 binding: contract filename, presence, and sha256 of the bytes. */
+export type ContractReader = (filename: string) => Buffer | null;
+/** Parse and check one shard (section 5). `filename` must already match SHARD_NAME. */
+export declare function parseShard(filename: string, raw: Uint8Array, readContract: ContractReader): Shard;
+export interface LoadedLock {
+    readonly lock: Lock;
+    /** sha256 over the sorted (name, sha256) list of every file in `.mcp/lock`. */
+    readonly snapshotId: string;
+}
+/** Hash of the lock directory contents; contracts are bound through the shards. */
+export declare function lockFilesId(files: ReadonlyMap<string, Uint8Array>): string;
+/** Read and verify the whole lock under `root`. Any failure throws LockError. */
+export declare function loadLock(root: string, config?: ReaderConfig): Promise<LoadedLock>;
+/**
+ * Synchronous read for writers holding the file lock. Refuses a config with a
+ * signer, since signature checks are asynchronous; a writer does not need them.
+ */
+export declare function loadLockSync(root: string, config?: ReaderConfig): LoadedLock;
+/** The identity an alias names, if the lock maps it. */
+export declare function resolveAlias(lock: Lock, alias: string): Identity | null;
+/** An ordered JSON object for the writer: entries are written in this order. */
+export type Ordered = {
+    readonly entries: ReadonlyArray<readonly [string, WriterValue]>;
+};
+export type WriterValue = null | boolean | number | string | readonly WriterValue[] | Ordered;
+/** Bytes for a lock file: json.dumps(doc, indent=2) + "\n". */
+export declare function formatLockFile(doc: WriterValue): Buffer;
+/**
+ * Shard bytes. Member order is lockVersion, identity, attributes, instructions,
+ * tools; tools keep the order of `shard.tools` (a writer appends a newly approved
+ * name at the end), which is the order the Python generator writes.
+ */
+export declare function formatShard(shard: Shard): Buffer;
+export declare function formatAliases(aliases: ReadonlyMap<string, Identity>): Buffer;
+/** Manifest bytes over `files` (name to bytes), names sorted. */
+export declare function formatManifest(sequence: number, files: ReadonlyMap<string, Uint8Array>): Buffer;
+//# sourceMappingURL=lock.d.ts.map

package/dist/src/lock/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/lock/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,eAAO,MAAM,YAAY,YAAY,CAAC;AACtC,eAAO,MAAM,QAAQ,yCAA0C,CAAC;AAChE,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AAChD,eAAO,MAAM,UAAU,iCAAkC,CAAC;AAC1D,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AACxC,eAAO,MAAM,SAAS,2BAA2B,CAAC;AAClD,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,iEAAiE;AACjE,eAAO,MAAM,YAAY,QAA0B,CAAC;AAEpD,eAAO,MAAM,UAAU,QAAuD,CAAC;AAC/E,eAAO,MAAM,aAAa,QAAkC,CAAC;AAC7D,eAAO,MAAM,WAAW,QAA4B,CAAC;AAYrD,eAAO,MAAM,GAAG,+CAAgD,CAAC;AACjE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvC,oFAAoF;AACpF,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,wBAAwB,GACxB,mBAAmB,GACnB,YAAY,CAAC;AAEjB,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM;CAMpD;AAOD,iFAAiF;AACjF,qBAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAE,YAAW,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;;gBAE3C,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAI9C,IAAI,IAAI,IAAI,MAAM,CAEjB;IACD,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS;IAG1B,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAGpB,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,GAAG,IAAI;IAGrE,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAG9B,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC;IAGtB,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;IAGxB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAGzC;AAgCD,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/E,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACnF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AACrH,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,eAAe,GAAG,eAAe,CAAC;AA4D1E,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUhD;AAUD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAE1D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CAiB/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,eAAe,CAY9F;AAmDD,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAoBvE;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAiDzD;AAQD,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAItD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAEtD;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAuB/C;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAExD;AAMD;;;;GAIG;AACH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqBhE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4B5D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAkBlE;AAID,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,IAAI;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5F;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C;AAyGD,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhE;AAkID,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAoDjE,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,GAAG,KAAK,CA+BjG;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,CAM1E;AA+CD,iFAAiF;AACjF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,YAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAI3F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,YAAiB,GAAG,UAAU,CAGhF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAEvE;AAID,gFAAgF;AAChF,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA;CAAE,CAAC;AAC1F,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC;AAwD9F,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAEvD;AA0BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAsBhD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,CAS5E;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,CAa/F"}