@mcpmake/core 0.2.4 → 0.3.0

package/dist/emitter/site-templates/browser-manager.ts.hbs

@@ -6,6 +6,7 @@
 import { chromium } from 'playwright';
 import type { Browser, BrowserContext, Page } from 'playwright';
 import type { BrowserConfig } from './config.js';
+import * as telemetry from './telemetry.js';
 
 interface BrowserSession {
   context: BrowserContext;
@@ -18,6 +19,16 @@ const sessions = new Map<string, BrowserSession>();
 let idleTimer: ReturnType<typeof setInterval> | undefined;
 let config: BrowserConfig;
 
+// In-flight session creations, keyed by session id. Single-flighting per id
+// means concurrent no-ID calls (which all resolve to DEFAULT_SESSION) and
+// repeated calls with the same explicit id share one Chromium context instead
+// of racing to create several.
+const sessionCreations = new Map<string, Promise<{ page: Page; sessionId: string }>>();
+
+// Single-flight the browser launch so concurrent cold starts can't spawn
+// multiple Chromium processes.
+let browserLaunch: Promise<Browser> | undefined;
+
 const DEFAULT_SESSION = '__default__';
 
 /**
@@ -78,10 +89,37 @@ export async function resolveSelector(
   }
 }
 
+/**
+ * Launch the shared browser, single-flighting concurrent cold starts so two
+ * simultaneous requests can never spawn two Chromium processes.
+ */
+async function getBrowser(): Promise<Browser> {
+  if (browser && browser.isConnected()) return browser;
+  if (browserLaunch) return browserLaunch;
+
+  // Only disable sandbox when running as root in a container.
+  const isRoot = process.getuid?.() === 0;
+  browserLaunch = chromium
+    .launch({
+      headless: config.headless,
+      args: isRoot ? ['--no-sandbox', '--disable-setuid-sandbox'] : [],
+    })
+    .then((b) => {
+      browser = b;
+      return b;
+    })
+    .finally(() => {
+      browserLaunch = undefined;
+    });
+  return browserLaunch;
+}
+
 /**
  * Get or create a browser session.
  * If sessionId is provided, reuses an existing session or creates one with that ID.
- * If not, creates a new session with a generated ID.
+ * If not, reuses (or creates) a single shared default session under a fixed ID,
+ * so repeat no-ID calls and `take_screenshot` without an ID all hit the same
+ * context instead of leaking a new Chromium context per call.
  * Throws if the session pool is at capacity (maxSessions).
  */
 export async function getOrCreateSession(sessionId?: string): Promise<{ page: Page; sessionId: string }> {
@@ -95,7 +133,23 @@ export async function getOrCreateSession(sessionId?: string): Promise<{ page: Pa
     return { page: existing.page, sessionId: id };
   }
 
-  // Check capacity before creating a new session
+  // Coalesce concurrent creations for the same id (notably the default
+  // session) onto one promise so we don't create duplicate contexts or
+  // double-count capacity.
+  const inFlight = sessionCreations.get(id);
+  if (inFlight) return inFlight;
+
+  const creation = createSession(id).finally(() => {
+    sessionCreations.delete(id);
+  });
+  sessionCreations.set(id, creation);
+  return creation;
+}
+
+async function createSession(id: string): Promise<{ page: Page; sessionId: string }> {
+  // Reserve the capacity slot BEFORE any await so concurrent creations of
+  // distinct ids can't all pass the gate and then blow past maxSessions. We
+  // insert a placeholder entry now and fill in the real handles below.
   const maxSessions = config.maxSessions ?? 10;
   if (sessions.size >= maxSessions) {
     throw new Error(
@@ -103,38 +157,37 @@ export async function getOrCreateSession(sessionId?: string): Promise<{ page: Pa
       'Close an existing session before creating a new one.'
     );
   }
+  const reserved: BrowserSession = {
+    context: undefined as unknown as BrowserContext,
+    page: undefined as unknown as Page,
+    lastAccessedAt: Date.now(),
+  };
+  sessions.set(id, reserved);
 
-  // Launch browser if not running
-  if (!browser || !browser.isConnected()) {
-    // Only disable sandbox when running as root in a container
-    const isRoot = process.getuid?.() === 0;
-    browser = await chromium.launch({
-      headless: config.headless,
-      args: isRoot ? ['--no-sandbox', '--disable-setuid-sandbox'] : [],
+  try {
+    const activeBrowser = await getBrowser();
+    const context = await activeBrowser.newContext({
+      viewport: config.viewport,
+      ...(config.userAgent ? { userAgent: config.userAgent } : {}),
     });
-  }
+    const page = await context.newPage();
 
-  // Create new session
-  const context = await browser.newContext({
-    viewport: config.viewport,
-    ...(config.userAgent ? { userAgent: config.userAgent } : {}),
-  });
-  const page = await context.newPage();
-
-  // Generate final session ID upfront to avoid race conditions
-  const finalId = id === DEFAULT_SESSION
-    ? `session_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`
-    : id;
+    reserved.context = context;
+    reserved.page = page;
+    reserved.lastAccessedAt = Date.now();
 
-  sessions.set(finalId, {
-    context,
-    page,
-    lastAccessedAt: Date.now(),
-  });
+    resetIdleTimer();
 
-  resetIdleTimer();
+    // The browser context is now resident — start billing this session (no-op
+    // unless the host injected telemetry env).
+    telemetry.sessionStarted(id);
 
-  return { page, sessionId: finalId };
+    return { page, sessionId: id };
+  } catch (err) {
+    // Release the reserved slot if context creation failed.
+    sessions.delete(id);
+    throw err;
+  }
 }
 
 /**
@@ -145,8 +198,9 @@ export async function closeSession(sessionId?: string): Promise<void> {
   const session = sessions.get(id);
   if (!session) return;
 
-  await session.context.close().catch(() => {});
+  await session.context?.close().catch(() => {});
   sessions.delete(id);
+  telemetry.sessionEnded(id, 'explicit');
 
   // If no sessions remain, close the browser
   if (sessions.size === 0) {
@@ -161,8 +215,9 @@ export async function closeBrowser(): Promise<void> {
   clearIdleTimer();
 
   for (const [id, session] of sessions) {
-    await session.context.close().catch(() => {});
+    await session.context?.close().catch(() => {});
     sessions.delete(id);
+    telemetry.sessionEnded(id, 'shutdown');
   }
 
   if (browser) {
@@ -207,11 +262,13 @@ function resetIdleTimer(): void {
   clearIdleTimer();
   idleTimer = setInterval(() => {
     const now = Date.now();
-    // Close idle sessions
+    // Close idle sessions. Skip slots still being created (no context yet).
     for (const [id, session] of sessions) {
+      if (!session.context) continue;
       if (now - session.lastAccessedAt > config.idleTimeoutMs) {
         session.context.close().catch(() => {});
         sessions.delete(id);
+        telemetry.sessionEnded(id, 'idle');
       }
     }
     // Close browser if no sessions
@@ -228,6 +285,19 @@ function clearIdleTimer(): void {
   }
 }
 
-// Clean up on process exit
-process.on('SIGTERM', () => closeBrowser());
-process.on('SIGINT', () => closeBrowser());
+// Clean up on process exit. Close the browser (which emits a session_end for
+// every still-resident session), then flush telemetry best-effort so the host
+// sees the final boundary instead of waiting out the heartbeat grace.
+async function shutdown(): Promise<void> {
+  try {
+    await closeBrowser();
+  } finally {
+    await telemetry.flushOnShutdown();
+  }
+}
+process.on('SIGTERM', () => {
+  void shutdown();
+});
+process.on('SIGINT', () => {
+  void shutdown();
+});

package/dist/emitter/site-templates/dockerfile.hbs

@@ -5,8 +5,14 @@
 FROM mcr.microsoft.com/playwright:v1.59.1-noble AS builder
 
 WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci
+COPY package.json ./
+# The generator does not emit a package-lock.json, so use `npm install` (not
+# `npm ci`, which fails without a lockfile). --ignore-scripts: a malicious
+# transitive dependency's install lifecycle hook (preinstall/install/postinstall)
+# would otherwise run as root at build time — install-time RCE in the build
+# container. The server's own compile is an explicit `npm run build` step below,
+# so it does not depend on install hooks.
+RUN npm install --ignore-scripts
 COPY tsconfig.json ./
 COPY src/ src/
 RUN npm run build
@@ -20,8 +26,11 @@ ENV PORT=3000
 ENV HEADLESS=true
 
 WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
+COPY package.json ./
+# Runtime deps only (no lockfile emitted → `npm install`); --ignore-scripts
+# blocks dependency install hooks from running as root. The Playwright browser
+# binaries ship in the base image, so no install-time download lifecycle is needed.
+RUN npm install --omit=dev --ignore-scripts
 
 COPY --from=builder /app/dist dist/
 

package/dist/emitter/site-templates/env.example.hbs

@@ -9,6 +9,14 @@ IDLE_TIMEOUT_MS={{browserConfig.idleTimeoutMs}}
 VIEWPORT_WIDTH={{browserConfig.viewport.width}}
 VIEWPORT_HEIGHT={{browserConfig.viewport.height}}
 # USER_AGENT=
+
+# Browser-session telemetry (managed hosting only — leave UNSET to self-host).
+# When the host sets these, the server reports exact browser-session lifetime
+# for metering. It NEVER phones home unless MCPMAKE_TELEMETRY_URL is set.
+# MCPMAKE_TELEMETRY_URL=
+# MCPMAKE_TELEMETRY_TOKEN=
+# MCPMAKE_SERVER_SLUG=
+# MCPMAKE_TELEMETRY_HEARTBEAT_MS=30000
 {{#if (eq transport "http")}}
 
 # Transport: "stdio" or "http"

package/dist/emitter/site-templates/server-main-http.ts.hbs

@@ -1,4 +1,5 @@
 import http from 'node:http';
+import crypto from 'node:crypto';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
@@ -14,12 +15,60 @@ function log(level: string, message: string, data?: Record<string, unknown>): vo
 const config = loadConfig();
 initBrowserManager(config.browser);
 
-const server = new McpServer({
-  name: '{{serverName}}',
-  version: '{{serverVersion}}',
-});
+/* Build a fully-registered McpServer. A single McpServer connected to multiple
+ * transports concurrently races on its internal transport reference (the API
+ * HTTP template documents the same hazard), so HTTP requests get a fresh,
+ * stateless server + transport per request instead of sharing one global
+ * instance. */
+function createMcpServer(): McpServer {
+  const server = new McpServer({
+    name: '{{serverName}}',
+    version: '{{serverVersion}}',
+  });
+  registerAllTools(server, config);
+  return server;
+}
 
-registerAllTools(server, config);
+/* Bearer authentication — mirrors the API/node server. Constant-time compare of
+ * the `Authorization: Bearer <token>` header against MCP_AUTH_TOKEN.
+ *
+ * Fail CLOSED: when MCP_AUTH_TOKEN is unset, authenticated routes are denied
+ * unless the operator opts in with MCP_ALLOW_UNAUTHENTICATED === 'true' (a
+ * local/dev escape hatch). We warn once so the open posture is loud. The token
+ * is never read from the query string — URLs leak through logs and referrers. */
+let unauthWarned = false;
+function isAuthorized(req: http.IncomingMessage): boolean {
+  const expected = process.env.MCP_AUTH_TOKEN;
+  if (!expected) {
+    if (process.env.MCP_ALLOW_UNAUTHENTICATED === 'true') {
+      if (!unauthWarned) {
+        unauthWarned = true;
+        console.error(
+          'SECURITY: MCP_AUTH_TOKEN is unset and MCP_ALLOW_UNAUTHENTICATED=true — ' +
+            'serving authenticated routes WITHOUT a bearer token. ' +
+            'Set MCP_AUTH_TOKEN before exposing this endpoint.',
+        );
+      }
+      return true;
+    }
+    if (!unauthWarned) {
+      unauthWarned = true;
+      console.error(
+        'SECURITY: MCP_AUTH_TOKEN is unset — denying all authenticated routes. ' +
+          'Set MCP_AUTH_TOKEN, or set MCP_ALLOW_UNAUTHENTICATED=true for local/dev only.',
+      );
+    }
+    return false;
+  }
+  const header = req.headers.authorization;
+  if (typeof header !== 'string' || !header.startsWith('Bearer ')) return false;
+  const presented = header.slice(7).trim();
+  if (!presented) return false;
+  const a = Buffer.from(presented);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
 
 let isReady = false;
 
@@ -43,6 +92,17 @@ if (process.env.TRANSPORT === 'http') {
     }
 
     if (url.pathname === '/mcp') {
+      // Bearer auth (in addition to the origin check below). /health and /ready
+      // above stay open for liveness/readiness probes.
+      if (!isAuthorized(req)) {
+        res.writeHead(401, {
+          'Content-Type': 'application/json',
+          'WWW-Authenticate': 'Bearer',
+        });
+        res.end(JSON.stringify({ error: 'Unauthorized: missing or invalid bearer token' }));
+        return;
+      }
+
       if (allowedOrigin) {
         // Compare host-to-host exactly (DNS-rebinding protection). A substring
         // match would let "evil-{ALLOWED_ORIGIN}.attacker.com" through.
@@ -72,8 +132,17 @@ if (process.env.TRANSPORT === 'http') {
         }
       }
 
+      // Fresh stateless server + transport per request. Both are closed when
+      // the response finishes or the connection aborts, so transports and
+      // their listeners are never leaked and concurrent requests can't
+      // misroute through a shared transport reference.
+      const reqServer = createMcpServer();
       const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-      await server.connect(transport);
+      res.on('close', () => {
+        void transport.close();
+        void reqServer.close();
+      });
+      await reqServer.connect(transport);
       await transport.handleRequest(req, res);
       return;
     }
@@ -97,6 +166,8 @@ if (process.env.TRANSPORT === 'http') {
   process.on('SIGTERM', shutdown);
   process.on('SIGINT', shutdown);
 } else {
+  // Stdio is inherently single-connection, so one long-lived server is correct.
+  const server = createMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
   isReady = true;

package/dist/emitter/site-templates/telemetry.ts.hbs

@@ -0,0 +1,117 @@
+/**
+ * Browser-session telemetry for exact metering on managed hosting.
+ *
+ * NO-OP unless MCPMAKE_TELEMETRY_URL is set — a self-hosted or local server
+ * never phones home. When the cloud injects the ingest URL + token + slug, this
+ * batches session_start / heartbeat / session_end events and POSTs them so the
+ * host can bill the REAL resident browser lifetime instead of approximating it
+ * from request latency.
+ *
+ * Strictly best-effort and isolated: every network/serialization error is
+ * swallowed. Telemetry must NEVER affect the MCP server's behavior. Dropped
+ * events can only ever UNDER-bill (the host applies a heartbeat grace + an
+ * independent proxy-activity clamp), never break a tool call.
+ *
+ * An OPEN session emits a heartbeat on every flush: an open session means a
+ * resident Chromium context, which is the billable cost — independent of how
+ * often tools are called. The host treats "last heartbeat + grace" as the close
+ * time if a session_end is ever lost (e.g. the server is killed).
+ */
+
+type TelemetryEventType = 'session_start' | 'heartbeat' | 'session_end';
+
+interface TelemetryEvent {
+  type: TelemetryEventType;
+  sessionId: string;
+  ts: number;
+  reason?: string;
+}
+
+const TELEMETRY_URL = process.env.MCPMAKE_TELEMETRY_URL;
+const TELEMETRY_TOKEN = process.env.MCPMAKE_TELEMETRY_TOKEN ?? '';
+const SERVER_SLUG = process.env.MCPMAKE_SERVER_SLUG ?? '';
+const HEARTBEAT_MS = (() => {
+  const n = parseInt(process.env.MCPMAKE_TELEMETRY_HEARTBEAT_MS ?? '30000', 10);
+  return Number.isFinite(n) && n >= 1000 ? n : 30000;
+})();
+const POST_TIMEOUT_MS = 5000;
+const MAX_BUFFER = 1000;
+
+const ENABLED = Boolean(TELEMETRY_URL) && Boolean(TELEMETRY_TOKEN) && Boolean(SERVER_SLUG);
+
+const buffer: TelemetryEvent[] = [];
+const openSessions = new Set<string>();
+let flushTimer: ReturnType<typeof setInterval> | undefined;
+
+function pushEvent(ev: TelemetryEvent): void {
+  buffer.push(ev);
+  // Bound memory if the ingest is unreachable for a long time: keep the newest.
+  if (buffer.length > MAX_BUFFER) buffer.splice(0, buffer.length - MAX_BUFFER);
+}
+
+function ensureTimer(): void {
+  if (!ENABLED || flushTimer) return;
+  flushTimer = setInterval(() => {
+    void flush();
+  }, HEARTBEAT_MS);
+  // Never keep the process alive just for telemetry.
+  flushTimer.unref?.();
+}
+
+/** Record that a browser session became resident. */
+export function sessionStarted(sessionId: string): void {
+  if (!ENABLED) return;
+  openSessions.add(sessionId);
+  pushEvent({ type: 'session_start', sessionId, ts: Date.now() });
+  ensureTimer();
+}
+
+/** Record that a browser session was torn down (idle | explicit | shutdown). */
+export function sessionEnded(sessionId: string, reason: string): void {
+  if (!ENABLED) return;
+  openSessions.delete(sessionId);
+  pushEvent({ type: 'session_end', sessionId, ts: Date.now(), reason });
+  // Flush promptly so the host can finalize this session's billing.
+  void flush();
+}
+
+async function flush(): Promise<void> {
+  if (!ENABLED) return;
+  const now = Date.now();
+  // Heartbeat every still-open session — proof the browser is still resident.
+  for (const id of openSessions) {
+    pushEvent({ type: 'heartbeat', sessionId: id, ts: now });
+  }
+  if (buffer.length === 0) return;
+  const events = buffer.splice(0, buffer.length);
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), POST_TIMEOUT_MS);
+    try {
+      await fetch(TELEMETRY_URL as string, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${TELEMETRY_TOKEN}`,
+        },
+        body: JSON.stringify({ v: 1, slug: SERVER_SLUG, events }),
+        signal: controller.signal,
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    // Swallow: telemetry is best-effort and must never affect the server.
+  }
+}
+
+/** Best-effort final flush on shutdown: end every open session and send. */
+export async function flushOnShutdown(reason = 'shutdown'): Promise<void> {
+  if (!ENABLED) return;
+  const now = Date.now();
+  for (const id of [...openSessions]) {
+    openSessions.delete(id);
+    pushEvent({ type: 'session_end', sessionId: id, ts: now, reason });
+  }
+  await flush();
+}

package/dist/emitter/site-templates/tool-handler-form.ts.hbs

@@ -45,8 +45,8 @@ export function register(server: McpServer, config: AppConfig): void {
 {{#each form.fields}}
 {{#unless (eq fieldType "hidden")}}
 {{#if (eq fieldType "checkbox")}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
-          const checked = Boolean((input as Record<string, unknown>)['{{jsString name}}']);
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
+          const checked = Boolean((input as Record<string, unknown>)['{{jsString inputKey}}']);
           const fieldSelector = await resolveSelector(page, ['{{jsString selector.primary}}'{{#each selector.fallbacks}}, '{{jsString this}}'{{/each}}]);
           if (checked) {
             await page.check(fieldSelector);
@@ -55,21 +55,23 @@ export function register(server: McpServer, config: AppConfig): void {
           }
         }
 {{else if (eq fieldType "select")}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
           const fieldSelector = await resolveSelector(page, ['{{jsString selector.primary}}'{{#each selector.fallbacks}}, '{{jsString this}}'{{/each}}]);
-          await page.selectOption(fieldSelector, String((input as Record<string, unknown>)['{{jsString name}}']));
+          // The schema enum is built from option VALUES, and selectOption
+          // matches by value, so pass the value through directly.
+          await page.selectOption(fieldSelector, String((input as Record<string, unknown>)['{{jsString inputKey}}']));
         }
 {{else if (eq fieldType "radio")}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
           const radioName = '{{jsString name}}';
-          const radioValue = String((input as Record<string, unknown>)['{{jsString name}}']).replace(/["\\[\]()]/g, '\\$&');
+          const radioValue = String((input as Record<string, unknown>)['{{jsString inputKey}}']).replace(/["\\[\]()]/g, '\\$&');
           const radioNameSel = radioName.replace(/["\\]/g, '\\$&');
           await page.check(`input[name="${radioNameSel}"][value="${radioValue}"]`);
         }
 {{else}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
           const fieldSelector = await resolveSelector(page, ['{{jsString selector.primary}}'{{#each selector.fallbacks}}, '{{jsString this}}'{{/each}}]);
-          await page.fill(fieldSelector, String((input as Record<string, unknown>)['{{jsString name}}']));
+          await page.fill(fieldSelector, String((input as Record<string, unknown>)['{{jsString inputKey}}']));
         }
 {{/if}}
 {{/unless}}

package/dist/emitter/template-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AAoBA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAU9D"}
+{"version":3,"file":"template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AA8BA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAU9D"}

package/dist/emitter/template-loader.js

@@ -13,6 +13,15 @@ Handlebars.registerHelper('capitalize', function (str) {
         return str;
     return str.charAt(0).toUpperCase() + str.slice(1);
 });
+// Emit a value as a valid JS/TS literal via JSON.stringify. Safe for embedding
+// untrusted spec-derived strings (e.g. OpenAPI security-scheme names) into
+// generated code: JSON.stringify produces a double-quoted literal with all
+// special characters escaped, so the value can never break out of the literal.
+// Registered on the shared Handlebars singleton, so worker templates (which
+// import the same instance) can use it too.
+Handlebars.registerHelper('json', function (value) {
+    return JSON.stringify(value === undefined ? null : value);
+});
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function renderTemplate(name, data) {
     if (!templateCache.has(name)) {

package/dist/emitter/template-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"template-loader.js","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAErD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;AAErE,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU,GAAW;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAS;IACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"template-loader.js","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAErD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;AAErE,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU,GAAW;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,4CAA4C;AAC5C,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,KAAc;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAS;IACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}