@mcsherrylabs/evolver-mcp 0.11.0 → 0.13.0

package/dist/attachments.js

@@ -0,0 +1,458 @@
+// File-backed SDK attachment envelopes only. No cipher/nonce/header encoder or HTTP here.
+// Public registry SDK0.22 owns every header, offset and cryptographic transform below.
+import { createHash } from "node:crypto";
+import { ATTACHMENT_HEADER_BYTES, SEG_BYTES, ctSize, parseAttachmentHeader, planAttachmentRange, encryptStream, decryptStream } from "@mcsherrylabs/evolver-client";
+import { parseAccess, OPEN_NOTE, RESTRICTED_NOTE } from "./content.js";
+import { byteInterval } from "./content-ranges.js";
+import { FileAccessError, fileName } from "./files.js";
+import { validScope } from "./group-key-provider.js";
+import { ok, partial, misconfigured } from "./result.js";
+export const ATTACHMENT_PLAINTEXT_CONFIRMATION = "write plaintext file in the authorized file root";
+export const PUBLISHED_ATTACHMENT_SDK = Object.freeze({
+    ATTACHMENT_HEADER_BYTES, SEG_BYTES, ctSize, parseAttachmentHeader, planAttachmentRange, encryptStream, decryptStream,
+});
+class AttachmentError extends Error {
+    code;
+    constructor(code) {
+        super(`attachment: ${code}`);
+        this.code = code;
+    }
+}
+function refuse(code) { throw new AttachmentError(code); }
+const nat = (n) => typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+const contentKey = (key) => {
+    if (typeof key !== "string" || !/^[0-9a-f]{64}$/.test(key))
+        return refuse("invalid_request");
+    return key;
+};
+const disabled = () => misconfigured("attachment encryption unavailable", "requires an explicitly authorized EVOLVER_FILE_ROOT and independent group-crypto provider in this MCP process; configure both host capabilities and reload. Public SDK0.22 is installed; no fallback codec or live mutation.");
+function authorized(deps, scope) {
+    if (!validScope(scope) || !deps.groupCrypto.provider.scopes.includes(scope))
+        refuse("scope_denied");
+}
+function plaintextAllowed(deps, confirmation) {
+    if (!deps.groupCrypto.provider.allowPlaintext || confirmation !== ATTACHMENT_PLAINTEXT_CONFIRMATION)
+        refuse("plaintext_denied");
+}
+function failure(e, uploading = false, uploadStarted = false) {
+    const cleanup = e instanceof FileAccessError && e.cleanupWarning ? "; staging_cleanup_failed; protected staging may remain" : "";
+    if (e instanceof FileAccessError && e.code === "commit_unconfirmed")
+        return partial("attachment", "output_commit_unconfirmed; a plaintext target may have become visible or remain present; removal was attempted if authorization failed after linking. Inspect the authorized file root; do not automatically retry." + cleanup);
+    if (e instanceof FileAccessError && e.code === "publication_unknown")
+        return partial("attachment", "output_publication_unknown; target may exist or have been visible; NOT a no-write refusal. Inspect the authorized file root; do not retry or automatically delete the final target." + cleanup);
+    const aftermath = uploading ? (uploadStarted ? "ciphertext storage may have completed; not retried or republished open" : "upload was not started; not retried or republished open") : "no completed plaintext output returned; not retried";
+    if (e instanceof AttachmentError)
+        return partial("attachment", `${e.code}; ${aftermath}`);
+    if (e instanceof FileAccessError)
+        return partial("attachment", `file_${e.code}; ${aftermath}${cleanup}`);
+    if (e instanceof Error && e.name === "AbortError")
+        return partial("attachment", `cancelled; ${aftermath}`);
+    const status = e instanceof Error ? /^(?:postContentStream|getContentStream(?: [0-9a-f]{1,12})?): HTTP ([1-5][0-9]{2})\b/.exec(e.message)?.[1] : undefined;
+    if (status)
+        return partial("attachment", `content_http_${status}; ${aftermath}`);
+    return partial("attachment", `transport_or_key_failure; ${aftermath}`);
+}
+/** Manual signal chaining keeps the Node20 surface small. The key callback spans every read,
+ * transform, write and commit; no deferred stream outlives a wiped temporary key copy. */
+async function leased(deps, scope, handle, caller, job) {
+    if (typeof handle !== "string")
+        return refuse("key_unavailable");
+    let leaseSignal, entered = false;
+    try {
+        return await deps.groupCrypto.handles.withLease(scope, handle, async (key, lease) => {
+            entered = true;
+            leaseSignal = lease.signal;
+            const controller = new AbortController();
+            const forward = () => controller.abort();
+            const sources = caller ? [caller, lease.signal] : [lease.signal];
+            for (const source of sources)
+                source.addEventListener("abort", forward, { once: true });
+            if (sources.some(s => s.aborted))
+                controller.abort();
+            try {
+                return await deps.files.transfer(files => job(key, lease, files), controller.signal);
+            }
+            finally {
+                for (const source of sources)
+                    source.removeEventListener("abort", forward);
+            }
+        });
+    }
+    catch (e) {
+        if (e instanceof FileAccessError && (e.code === "commit_unconfirmed" || e.code === "publication_unknown" || e.cleanupWarning))
+            throw e;
+        if (!entered)
+            refuse("key_unavailable");
+        if (leaseSignal?.aborted)
+            refuse("lease_invalid");
+        throw e;
+    }
+}
+/** Exact streamed bytes and incremental hash, never a proportional buffer. Retains underlying
+ * transport failure separately because the shared file writer deliberately scrubs stream errors. */
+function measured(source, size, signal, problem, readFailure) {
+    const reader = source.getReader(), hash = createHash("sha256");
+    let count = 0, complete = false, digest = "", released = false;
+    const onAbort = () => { void reader.cancel().catch(() => undefined); };
+    const release = () => { if (!released) {
+        signal.removeEventListener("abort", onAbort);
+        reader.releaseLock();
+        released = true;
+    } };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted)
+        onAbort();
+    const stream = new ReadableStream({
+        async pull(ctrl) {
+            try {
+                if (signal.aborted)
+                    throw new FileAccessError("cancelled");
+                const { done, value } = await reader.read();
+                if (signal.aborted)
+                    throw new FileAccessError("cancelled");
+                if (done) {
+                    if (count !== size)
+                        refuse("incomplete_transfer");
+                    complete = true;
+                    digest = hash.digest("hex");
+                    release();
+                    ctrl.close();
+                    return;
+                }
+                if (!(value instanceof Uint8Array) || value.length > size - count)
+                    refuse("incomplete_transfer");
+                count += value.length;
+                hash.update(value);
+                ctrl.enqueue(value);
+            }
+            catch (e) {
+                if (!signal.aborted)
+                    problem.error ??= e instanceof AttachmentError ? e : new AttachmentError(readFailure);
+                await reader.cancel().catch(() => undefined);
+                release();
+                ctrl.error(e);
+            }
+        },
+        async cancel() { await reader.cancel().catch(() => undefined); release(); },
+    }, { highWaterMark: 0 });
+    return { stream, metadata() { if (!complete)
+            return refuse("incomplete_transfer"); return { size: count, sha256: digest }; } };
+}
+/** Observe SDK failures without reflecting its exception text. Pipe cancellation propagates to
+ * the actual client stream. Only the shared file writer ever publishes a final basename. */
+function authenticated(source, signal, problem) {
+    const reader = source.getReader();
+    let released = false;
+    const release = () => { if (!released) {
+        reader.releaseLock();
+        released = true;
+    } };
+    return new ReadableStream({
+        async pull(ctrl) {
+            try {
+                if (signal.aborted)
+                    throw new FileAccessError("cancelled");
+                const { done, value } = await reader.read();
+                if (done) {
+                    release();
+                    ctrl.close();
+                }
+                else
+                    ctrl.enqueue(value);
+            }
+            catch (e) {
+                if (!signal.aborted)
+                    problem.error ??= new AttachmentError("authentication_or_incomplete");
+                await reader.cancel().catch(() => undefined);
+                release();
+                ctrl.error(e);
+            }
+        },
+        async cancel() { await reader.cancel().catch(() => undefined); release(); },
+    }, { highWaterMark: 0 });
+}
+/** Read only the small SDK-authoritative prefix, keeping at most the current source chunk. */
+async function prefixOf(source, size) {
+    const reader = source.getReader(), prefix = new Uint8Array(size);
+    let used = 0, remainder;
+    try {
+        while (used < size) {
+            const next = await reader.read();
+            if (next.done)
+                refuse("invalid_envelope");
+            const n = Math.min(next.value.length, size - used);
+            prefix.set(next.value.subarray(0, n), used);
+            used += n;
+            if (n < next.value.length)
+                remainder = next.value.subarray(n);
+        }
+    }
+    catch (e) {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+        throw e;
+    }
+    let first = true, released = false;
+    const release = () => { if (!released) {
+        reader.releaseLock();
+        released = true;
+    } };
+    const stream = new ReadableStream({
+        async pull(ctrl) {
+            try {
+                if (first) {
+                    first = false;
+                    ctrl.enqueue(prefix);
+                    return;
+                }
+                if (remainder) {
+                    ctrl.enqueue(remainder);
+                    remainder = undefined;
+                    return;
+                }
+                const next = await reader.read();
+                if (next.done) {
+                    release();
+                    ctrl.close();
+                }
+                else
+                    ctrl.enqueue(next.value);
+            }
+            catch (e) {
+                await reader.cancel().catch(() => undefined);
+                release();
+                ctrl.error(e);
+            }
+        },
+        async cancel() { await reader.cancel().catch(() => undefined); release(); },
+    }, { highWaterMark: 0 });
+    return { prefix, stream };
+}
+function prepend(prefix, source) {
+    return source.pipeThrough(new TransformStream({
+        start(ctrl) { ctrl.enqueue(prefix); },
+        transform(chunk, ctrl) { ctrl.enqueue(chunk); },
+    }));
+}
+function trimmed(source, offset, length, decryptedBytes) {
+    let seen = 0, kept = 0;
+    return source.pipeThrough(new TransformStream({
+        transform(bytes, ctrl) {
+            if (bytes.length > decryptedBytes - seen)
+                refuse("incomplete_transfer");
+            const from = Math.max(0, offset - seen), to = Math.min(bytes.length, offset + length - seen);
+            if (to > from) {
+                ctrl.enqueue(bytes.subarray(from, to));
+                kept += to - from;
+            }
+            seen += bytes.length;
+            // Do NOT stop/cancel after requested bytes: authenticate/drain ALL covering segments.
+        },
+        flush() { if (seen !== decryptedBytes || kept !== length)
+            refuse("incomplete_transfer"); },
+    }));
+}
+export async function encryptUploadAttachment(deps, req, signal) {
+    const access = parseAccess(req.access, req.authorizedPrincipals);
+    if ("kind" in access)
+        return access;
+    if (!deps)
+        return disabled();
+    let held;
+    let uploadStarted = false;
+    const problem = {};
+    try {
+        authorized(deps, req.scope);
+        const scope = req.scope, file = fileName(req.file);
+        if (!Array.isArray(req.recipients) || req.recipients.length < 1 || req.recipients.length > 64)
+            refuse("invalid_request");
+        // GroupCrypto.wrap is the sole validator/resolver of registered, host-approved recipients.
+        const created = await deps.groupCrypto.create(scope);
+        if (created.kind !== "ok")
+            refuse("key_unavailable");
+        held = created.value;
+        const wrappedKeys = [];
+        for (const recipient of req.recipients) {
+            const wrapped = await deps.groupCrypto.wrap(scope, held.handle, recipient);
+            if (wrapped.kind !== "ok")
+                refuse("key_unavailable");
+            wrappedKeys.push(wrapped.value);
+        }
+        return await leased(deps, scope, held.handle, signal, async (key, lease, files) => files.withInput(file, async (input) => {
+            const size = deps.sdk.ctSize(input.size);
+            if (!nat(size) || size > files.maxBytes)
+                throw new FileAccessError("too_large");
+            lease.check();
+            const cipher = measured(input.stream.pipeThrough(deps.sdk.encryptStream(key).transform, { signal: files.signal }), size, files.signal, problem, "incomplete_transfer");
+            try {
+                uploadStarted = true;
+                const stored = await deps.client.postContentStream(cipher.stream, { size, signal: files.signal,
+                    ...(access.mode === "restricted" ? { authorizedPrincipals: access.principals } : {}) });
+                const ciphertext = cipher.metadata(), plaintext = input.metadata();
+                if (stored.size !== size)
+                    refuse("incomplete_transfer");
+                const storedKey = contentKey(stored.key);
+                lease.check();
+                return ok({ ...held, key: storedKey, file, format: "sdk-attachment-v2", plaintextBytes: plaintext.size,
+                    plaintextSha256: plaintext.sha256, plaintextHashScope: "full-plaintext", ciphertextBytes: size,
+                    ciphertextSha256: ciphertext.sha256, ciphertextHashScope: "full-ciphertext", wrappedKeys,
+                    access: access.mode, ...(access.mode === "restricted" ? { authorizedPrincipals: access.principals } : {}),
+                    note: (access.mode === "restricted" ? RESTRICTED_NOTE : OPEN_NOTE) + " Encryption is independent of serving ACLs/availability; wrapped metadata is not publisher or membership proof." });
+            }
+            finally {
+                await cipher.stream.cancel().catch(() => undefined);
+            }
+        }));
+    }
+    catch (e) {
+        if (held) {
+            try {
+                deps.groupCrypto.handles.dispose(held.scope, held.handle);
+            }
+            catch { /* expired/disposed already */ }
+        }
+        return failure(e instanceof FileAccessError && (e.code === "commit_unconfirmed" || e.code === "publication_unknown" || e.cleanupWarning) ? e : problem.error ?? e, true, uploadStarted);
+    }
+}
+export async function decryptAttachmentFile(deps, req, signal) {
+    if (!deps)
+        return disabled();
+    const problem = {};
+    try {
+        authorized(deps, req.scope);
+        plaintextAllowed(deps, req.confirmation);
+        const key = contentKey(req.key), file = fileName(req.file);
+        return await leased(deps, req.scope, req.handle, signal, async (held, lease, files) => {
+            const got = await deps.client.getContentStream(key, { signal: files.signal });
+            if (got === null)
+                return ok(null);
+            if (got.status !== 200 || got.range !== null || !nat(got.size)) {
+                await got.stream.cancel().catch(() => undefined);
+                refuse("incomplete_transfer");
+            }
+            if (got.size > files.maxBytes) {
+                await got.stream.cancel().catch(() => undefined);
+                throw new FileAccessError("too_large");
+            }
+            const cipher = measured(got.stream, got.size, files.signal, problem, "transport_failure");
+            let joined;
+            try {
+                const head = await prefixOf(cipher.stream, deps.sdk.ATTACHMENT_HEADER_BYTES);
+                joined = head.stream;
+                try {
+                    deps.sdk.parseAttachmentHeader(head.prefix);
+                }
+                catch {
+                    refuse("invalid_envelope");
+                }
+                lease.check();
+                const verified = authenticated(joined.pipeThrough(deps.sdk.decryptStream(held), { signal: files.signal }), files.signal, problem);
+                const saved = await files.writeNew(file, verified, undefined, { check: () => lease.check(), commit: () => lease.commit() });
+                const ciphertext = cipher.metadata();
+                return ok({ ...saved, key, scope: req.scope, format: "sdk-attachment-v2", integrity: "full-envelope",
+                    hashScope: "full-plaintext", ciphertextBytes: ciphertext.size, ciphertextSha256: ciphertext.sha256,
+                    ciphertextHashScope: "full-ciphertext", note: "Authenticated envelope finality, not publisher identity, chain membership, availability or serving ACLs." });
+            }
+            finally {
+                await joined?.cancel().catch(() => undefined);
+                await cipher.stream.cancel().catch(() => undefined);
+            }
+        });
+    }
+    catch (e) {
+        return failure(e instanceof FileAccessError && (e.code === "commit_unconfirmed" || e.code === "publication_unknown" || e.cleanupWarning) ? e : problem.error ?? e);
+    }
+}
+async function requireRange(got, requested, total) {
+    const r = got.range;
+    if (got.status !== 206 || !r || !nat(r.totalSize) || r.totalSize < 1 || (total !== undefined && r.totalSize !== total) ||
+        r.from !== requested.from || r.toInclusive !== requested.toInclusive || r.toInclusive >= r.totalSize ||
+        !nat(got.size) || got.size !== requested.toInclusive - requested.from + 1) {
+        await got.stream.cancel().catch(() => undefined);
+        refuse("range_metadata_invalid");
+    }
+    return r.totalSize;
+}
+export async function decryptAttachmentRangeFile(deps, req, signal) {
+    if (!deps)
+        return disabled();
+    const problem = {};
+    try {
+        authorized(deps, req.scope);
+        plaintextAllowed(deps, req.confirmation);
+        const key = contentKey(req.key), file = fileName(req.file);
+        const requested = byteInterval(req.from, req.toInclusive, deps.files.maxBytes);
+        if ("kind" in requested)
+            return requested;
+        return await leased(deps, req.scope, req.handle, signal, async (held, lease, files) => {
+            const headerRange = { from: 0, toInclusive: deps.sdk.ATTACHMENT_HEADER_BYTES - 1 };
+            const head = await deps.client.getContentStream(key, { range: headerRange, signal: files.signal });
+            if (head === null)
+                return ok(null);
+            const total = await requireRange(head, headerRange);
+            if (total > files.maxBytes) {
+                await head.stream.cancel().catch(() => undefined);
+                throw new FileAccessError("too_large");
+            }
+            const header = new Uint8Array(deps.sdk.ATTACHMENT_HEADER_BYTES);
+            const headerInput = measured(head.stream, header.length, files.signal, problem, "transport_failure");
+            const reader = headerInput.stream.getReader();
+            let used = 0;
+            try {
+                for (;;) {
+                    const next = await reader.read();
+                    if (next.done)
+                        break;
+                    header.set(next.value, used);
+                    used += next.value.length;
+                }
+            }
+            finally {
+                await reader.cancel().catch(() => undefined);
+                reader.releaseLock();
+            }
+            try {
+                deps.sdk.parseAttachmentHeader(header);
+            }
+            catch {
+                refuse("invalid_envelope");
+            }
+            let plan;
+            try {
+                plan = deps.sdk.planAttachmentRange(header, total, requested);
+            }
+            catch {
+                return refuse("invalid_range_or_layout");
+            }
+            lease.check();
+            const selected = await deps.client.getContentStream(key, { range: plan.ciphertextRange, signal: files.signal });
+            // Missing between the two reads is not an empty range or a partial success.
+            if (selected === null)
+                return partial("attachment", "content_missing_during_range; no completed plaintext output returned");
+            await requireRange(selected, plan.ciphertextRange, total);
+            const cipher = measured(selected.stream, selected.size, files.signal, problem, "transport_failure");
+            let verified;
+            try {
+                verified = authenticated(prepend(header, cipher.stream).pipeThrough(deps.sdk.decryptStream(held, { rangeMode: plan.rangeMode }), { signal: files.signal }), files.signal, problem);
+                const output = trimmed(verified, plan.trim.offset, plan.trim.length, plan.decryptedBytes);
+                const saved = await files.writeNew(file, output, plan.trim.length, lease);
+                cipher.metadata();
+                return ok({ file: saved.file, size: saved.size, sha256: saved.sha256,
+                    ...(saved.cleanupWarning ? { cleanupWarning: saved.cleanupWarning } : {}), key, scope: req.scope,
+                    format: "sdk-attachment-v2", hashScope: "selected-plaintext-range", integrity: "selected-segments",
+                    complete: false, rangeComplete: true, fileComplete: true, requested, ciphertextRange: plan.ciphertextRange,
+                    ciphertextBytesDeclared: total, plaintextBytesInferred: plan.plaintextBytesInferred,
+                    firstSegIndex: plan.firstSegIndex, lastSegIndex: plan.lastSegIndex,
+                    note: "Selected segments authenticated only, EVEN for an all-selected range. Declared layout/inferred size is untrusted; no whole-file finality/hash, publisher identity, membership or availability proof." });
+            }
+            finally {
+                await verified?.cancel().catch(() => undefined);
+                await cipher.stream.cancel().catch(() => undefined);
+            }
+        });
+    }
+    catch (e) {
+        return failure(e instanceof FileAccessError && (e.code === "commit_unconfirmed" || e.code === "publication_unknown" || e.cleanupWarning) ? e : problem.error ?? e);
+    }
+}
+//# sourceMappingURL=attachments.js.map

package/dist/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,mBAAmB,EAC7F,aAAa,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAIvD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,kDAAkD,CAAC;AAOpG,MAAM,CAAC,MAAM,wBAAwB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC7E,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa;CACrH,CAAC,CAAC;AAWH,MAAM,eAAgB,SAAQ,KAAK;IAAwB;IAArB,YAAqB,IAAa;QAAI,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAA9C,SAAI,GAAJ,IAAI,CAAS;IAAkC,CAAC;CAAE;AAC7G,SAAS,MAAM,CAAC,IAAa,IAAW,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1E,MAAM,GAAG,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpG,MAAM,UAAU,GAAG,CAAC,GAAY,EAAU,EAAE;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,mCAAmC,EACtE,8NAA8N,CAAC,CAAC;AAClO,SAAS,UAAU,CAAC,IAAoB,EAAE,KAAc;IACtD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AACtG,CAAC;AACD,SAAS,gBAAgB,CAAC,IAAoB,EAAE,YAAqB;IACnE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,IAAI,YAAY,KAAK,iCAAiC;QAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAClI,CAAC;AACD,SAAS,OAAO,CAAC,CAAU,EAAE,SAAS,GAAG,KAAK,EAAE,aAAa,GAAG,KAAK;IACnE,MAAM,OAAO,GAAG,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE,CAAC;IACjI,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QACjE,OAAO,OAAO,CAAC,YAAY,EAAE,qNAAqN,GAAG,OAAO,CAAC,CAAC;IAChQ,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAClE,OAAO,OAAO,CAAC,YAAY,EAAE,qLAAqL,GAAG,OAAO,CAAC,CAAC;IAChO,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC7O,IAAI,CAAC,YAAY,eAAe;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,YAAY,eAAe;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,KAAK,SAAS,GAAG,OAAO,EAAE,CAAC,CAAC;IACzG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,cAAc,SAAS,EAAE,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,qFAAqF,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3J,IAAI,MAAM;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,gBAAgB,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC,YAAY,EAAE,6BAA6B,SAAS,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;0FAC0F;AAC1F,KAAK,UAAU,MAAM,CAAI,IAAoB,EAAE,KAAa,EAAE,MAAe,EAAE,MAA+B,EAC5G,GAA8E;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACjE,IAAI,WAAoC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC1D,IAAI,CAAC;QAAC,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxF,OAAO,GAAG,IAAI,CAAC;YAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACrD,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;oBACrF,CAAC;gBAAC,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,cAAc,CAAC;YAAE,MAAM,CAAC,CAAC;QACvI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,WAAW,EAAE,OAAO;YAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;oGACoG;AACpG,SAAS,QAAQ,CAAC,MAAkC,EAAE,IAAY,EAAE,MAAmB,EACrF,OAAoC,EAAE,WAAoB;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,KAAK,GAAG,CAAC,EAAE,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAClI,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC5C,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC3D,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,KAAK,KAAK,IAAI;wBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;oBAClD,QAAQ,GAAG,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO;gBAChF,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,KAAK;oBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACjG,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,KAAK,KAAK,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC3G,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KAC5E,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjI,CAAC;AACD;4FAC4F;AAC5F,SAAS,aAAa,CAAC,MAAkC,EAAE,MAAmB,EAAE,OAAoC;IAClH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI,EAAE,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;;oBAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,KAAK,KAAK,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;gBAC3F,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KAC5E,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AACD,8FAA8F;AAC9F,KAAK,UAAU,QAAQ,CAAC,MAAkC,EAAE,IAAY;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,IAAI,GAAG,CAAC,EAAE,SAAiC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5F,IAAI,KAAK,GAAG,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC5C,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,CAAC;oBAAC,KAAK,GAAG,KAAK,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC3D,IAAI,SAAS,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAAC,SAAS,GAAG,SAAS,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC1E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;;oBAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACzF,CAAC;QACD,KAAK,CAAC,MAAM,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KAC5E,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AACD,SAAS,OAAO,CAAC,MAAkB,EAAE,MAAkC;IACrE,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAyB;QACpE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AACD,SAAS,OAAO,CAAC,MAAkC,EAAE,MAAc,EAAE,MAAc,EAAE,cAAsB;IACzG,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAyB;QACpE,SAAS,CAAC,KAAK,EAAE,IAAI;YACnB,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,GAAG,IAAI;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;YAC7F,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAAC,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC;YAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,sFAAsF;QACxF,CAAC;QACD,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;KAC3F,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAgC,EAAE,GAE/E,EAAE,MAAoB;IACrB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjE,IAAI,MAAM,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC7B,IAAI,IAAgC,CAAC;IACrC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzH,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,GAAG,OAAO,CAAC,KAAuB,CAAC;QACvC,MAAM,WAAW,GAAc,EAAE,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,SAA8B,CAAC,CAAC;YAChG,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACrD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACrH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,QAAQ;gBAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;YAChF,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACvK,IAAI,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;oBAC5F,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,IAAI;oBACpG,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI;oBAC9F,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,WAAW;oBACxF,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,iHAAiH,EAAE,CAAC,CAAC;YAC9L,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;QACpE,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QACzH,OAAO,OAAO,CAAC,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1L,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAgC,EAAE,GAE7E,EAAE,MAAoB;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC9B,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAC1F,IAAI,MAA8C,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBACnG,IAAI,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAAC,CAAC;gBAC1F,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClI,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC5H,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrC,OAAO,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe;oBAClG,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM;oBAClG,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,EAAE,0GAA0G,EAAE,CAAC,CAAC;YAChK,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;QACnH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;AACrL,CAAC;AAGD,KAAK,UAAU,YAAY,CAAC,GAAU,EAAE,SAAuB,EAAE,KAAc;IAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IACpB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC;QAClH,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS;QACpG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,CAAC,SAAS,CAAC;AACrB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAgC,EAAE,GAElF,EAAE,MAAoB;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,MAAM,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnG,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACpD,IAAI,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YAC1H,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACrG,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC5D,IAAI,CAAC;gBAAC,SAAS,CAAC;oBAAC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,IAAI,IAAI,CAAC,IAAI;wBAAE,MAAM;oBAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAC,CAAC;YAAC,CAAC;oBAC7H,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAC/E,IAAI,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAAC,CAAC;YACrF,IAAI,IAAyB,CAAC;YAC9B,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAAC,CAAC;YAC1H,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAChH,4EAA4E;YAC5E,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,YAAY,EAAE,sEAAsE,CAAC,CAAC;YAC5H,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACpG,IAAI,QAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACnL,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC1F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC1E,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;oBAClE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChG,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,0BAA0B,EAAE,SAAS,EAAE,mBAAmB;oBAClG,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe;oBAC1G,uBAAuB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;oBACnF,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY;oBAClE,IAAI,EAAE,sMAAsM,EAAE,CAAC,CAAC;YACpN,CAAC;oBAAS,CAAC;gBAAC,MAAM,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;AACrL,CAAC"}

package/dist/content-file-tools.d.ts

@@ -0,0 +1,3 @@
+import type { ToolSpec } from "./tools.js";
+export declare const FILE_CONTENT_TOOLS: ToolSpec[];
+//# sourceMappingURL=content-file-tools.d.ts.map

package/dist/content-file-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-file-tools.d.ts","sourceRoot":"","sources":["../src/content-file-tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAe3C,eAAO,MAAM,kBAAkB,EAAE,QAAQ,EAqDxC,CAAC"}

package/dist/content-file-tools.js

@@ -0,0 +1,67 @@
+import { Type } from "typebox";
+import { publishFile, fetchFile } from "./content-files.js";
+import { fetchRangeFile } from "./content-ranges.js";
+import { CONTENT_MAX_PRINCIPALS } from "./content.js";
+import { UNTRUSTED } from "./mcp.js";
+const FILE_POLICY = " file is one server-local basename (1-128 ASCII letters/digits/._-, starting letter/digit), " +
+    "not a client path; nested paths, traversal, symlinks, hardlinked/nonregular inputs are refused. " +
+    "Requires operator EVOLVER_FILE_ROOT (dedicated Linux0700 directory, procfs) and reload; " +
+    "client-declared MCP roots are not authorization. Default64MiB, operator bound up to1GiB, " +
+    "one transfer per session root. Hash is SHA-256 of actual transferred bytes, separate from key " +
+    "(a key can name a manifest). No binary/base64 payload is returned. Cancellation retires local " +
+    "resources; an upload may already have reached node storage. No total transfer deadline." + UNTRUSTED;
+export const FILE_CONTENT_TOOLS = [
+    {
+        name: "evolver_content_put_file", label: "Publish content from host file",
+        description: "Stream an explicitly authorized host file into the node's separate content listener. " +
+            "access MUST be open or restricted; restricted needs1-32 valid identity/group authorizedPrincipals. " +
+            "Never retries open after an ACL error. ACLs control honest peer NODES, not the trusted local " +
+            "listener, storage operator or prior recipients; not encryption. Identical-byte grants merge " +
+            "by union: a narrower re-publication cannot retract an earlier open/wider grant. Returns only " +
+            "key,file,size,sha256,complete,access and grant metadata. It signs/submits no transaction." + FILE_POLICY,
+        parameters: Type.Object({
+            file: Type.String({ description: "Approved input basename under the operator's server-local file root" }),
+            access: Type.String({ description: 'Required: "open" or "restricted"; never inferred' }),
+            authorizedPrincipals: Type.Optional(Type.Array(Type.String(), { maxItems: CONTENT_MAX_PRINCIPALS,
+                description: "Only with restricted:1-32 identity/group principal names (duplicates collapse)" })),
+        }, { additionalProperties: false }),
+        run: async (ctx, params) => publishFile(ctx.contentFiles, params, ctx.signal),
+    },
+    {
+        name: "evolver_content_get_file", label: "Download content into new host file",
+        description: "Stream a COMPLETE object by64-lowercase-hex content key into a NEW host file. " +
+            "Protected0600 staging is atomically promoted without overwriting ANY existing target only " +
+            "after exact byte-count verification and incremental hashing. Failure/cancellation cleans " +
+            "staging; no incomplete file is returned as complete. ok:null means SDK no-reachable-holder " +
+            "HTTP404, not a global absence proof; transport failure is unreachable, not null. " +
+            "Output metadata is key,file,size,sha256,complete:true. No partial/range object is accepted." + FILE_POLICY,
+        parameters: Type.Object({
+            key: Type.String({ description: "Exactly64 lowercase hex characters; immutable content identity, not assumed whole-object SHA-256" }),
+            file: Type.String({ description: "New output basename; existing files and symlinks are never overwritten" }),
+        }, { additionalProperties: false }),
+        run: async (ctx, params) => fetchFile(ctx.contentFiles, params, ctx.signal),
+    },
+    {
+        name: "evolver_content_get_range_file", label: "Download one content byte range into new file",
+        description: "Retrieve one INCLUSIVE [from,toInclusive] byte interval into a NEW host file, " +
+            "using validated SDK206 status/served offsets/total. Bounds must be non-negative safe integers, " +
+            "from <= toInclusive; requested count must fit the configured file byte cap BEFORE I/O. " +
+            "An end past EOF is clipped by the node when the start is satisfiable; requested and served " +
+            "intervals plus clipped flag are distinct. An ignored Range/full200 is refused and cancelled, " +
+            "never silently saved, retried full or labeled range success. HTTP416 returns status:" +
+            "unsatisfiable with known totalSize or null (never inferred); ok:null means no reachable holder, " +
+            "not global absence. Transport/integrity failure is not an unsatisfiable/missing interval. " +
+            "Success reports key,file,size,sha256,hashScope:served-range,complete:false(original object), " +
+            "rangeComplete:true(served interval),fileComplete:true,requested,served and clipped. The hash " +
+            "describes ONLY selected bytes, not the whole object. Atomic no-overwrite and cleanup reuse " +
+            "the full-file policy; no append/merge/resume orchestration or payload returned." + FILE_POLICY,
+        parameters: Type.Object({
+            key: Type.String({ description: "Exactly64 lowercase hex characters identifying the immutable original content" }),
+            file: Type.String({ description: "New output basename; no overwrite or append" }),
+            from: Type.Number({ description: "Inclusive first byte offset, integer0..Number.MAX_SAFE_INTEGER" }),
+            toInclusive: Type.Number({ description: "Inclusive final requested offset, safe integer >=from; requested length bounded before I/O" }),
+        }, { additionalProperties: false }),
+        run: async (ctx, params) => fetchRangeFile(ctx.contentFiles, params, ctx.signal),
+    },
+];
+//# sourceMappingURL=content-file-tools.js.map

package/dist/content-file-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-file-tools.js","sourceRoot":"","sources":["../src/content-file-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,WAAW,GACf,8FAA8F;IAC9F,kGAAkG;IAClG,0FAA0F;IAC1F,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,yFAAyF,GAAG,SAAS,CAAC;AAExG,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C;QACE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,gCAAgC;QACzE,WAAW,EAAE,uFAAuF;YAClG,qGAAqG;YACrG,+FAA+F;YAC/F,8FAA8F;YAC9F,+FAA+F;YAC/F,2FAA2F,GAAG,WAAW;QAC3G,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;YACzG,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;YACxF,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,sBAAsB;gBAC9F,WAAW,EAAE,gFAAgF,EAAE,CAAC,CAAC;SACpG,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACnC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;KAC9E;IACD;QACE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,qCAAqC;QAC9E,WAAW,EAAE,gFAAgF;YAC3F,4FAA4F;YAC5F,2FAA2F;YAC3F,6FAA6F;YAC7F,mFAAmF;YACnF,6FAA6F,GAAG,WAAW;QAC7G,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kGAAkG,EAAE,CAAC;YACrI,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wEAAwE,EAAE,CAAC;SAC7G,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACnC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;KAC5E;IACD;QACE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,+CAA+C;QAC9F,WAAW,EAAE,gFAAgF;YAC3F,iGAAiG;YACjG,yFAAyF;YACzF,6FAA6F;YAC7F,+FAA+F;YAC/F,sFAAsF;YACtF,kGAAkG;YAClG,4FAA4F;YAC5F,+FAA+F;YAC/F,+FAA+F;YAC/F,6FAA6F;YAC7F,iFAAiF,GAAG,WAAW;QACjG,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;YAClH,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;YACjF,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;YACpG,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4FAA4F,EAAE,CAAC;SACxI,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACnC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;KACjF;CACF,CAAC"}

package/dist/content-files.d.ts

@@ -0,0 +1,32 @@
+import type { NodeClient } from "@mcsherrylabs/evolver-client";
+import type { FileRoot, FileMetadata } from "./files.js";
+import type { ToolResult } from "./result.js";
+export type FileContentClient = Pick<NodeClient, "postContentStream" | "getContentStream">;
+export interface FileContentDeps {
+    readonly files: FileRoot;
+    readonly client: FileContentClient;
+    readonly contentUrl: string;
+}
+export type FilePublished = FileMetadata & {
+    key: string;
+    access: "open" | "restricted";
+    authorizedPrincipals?: string[];
+    note: string;
+};
+export type FileFetched = FileMetadata & {
+    key: string;
+};
+/** Deliberately do not echo exceptions/response text/host paths: a server can reflect content,
+ * and some TLS errors include certificate details. A completed HTTP refusal is not transport loss. */
+export declare function contentFileFailure(e: unknown, url: string, operation: "publish" | "download" | "range"): ToolResult<never>;
+export declare const contentFileDisabled: () => ToolResult<never>;
+export declare function publishFile(deps: FileContentDeps | undefined, req: {
+    file?: unknown;
+    access?: unknown;
+    authorizedPrincipals?: unknown;
+}, signal?: AbortSignal): Promise<ToolResult<FilePublished>>;
+export declare function fetchFile(deps: FileContentDeps | undefined, req: {
+    key?: unknown;
+    file?: unknown;
+}, signal?: AbortSignal): Promise<ToolResult<FileFetched | null>>;
+//# sourceMappingURL=content-files.d.ts.map

package/dist/content-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-files.d.ts","sourceRoot":"","sources":["../src/content-files.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,GAAG,kBAAkB,CAAC,CAAC;AAC3F,MAAM,WAAW,eAAe;IAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAC9H,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACzI,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;sGACsG;AACtG,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAiB1H;AACD,eAAO,MAAM,mBAAmB,QAAO,UAAU,CAAC,KAAK,CAC6F,CAAC;AAErJ,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,EAAE,GAAG,EAAE;IACxE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAClE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAiB3D;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,EAAE,GAAG,EAAE;IACtE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CAC/B,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAmBhE"}