@miragon/pulse-widget-shell 0.0.0-bootstrap.0 → 0.21.0

package/dist/composed-server.edge.test.js

@@ -0,0 +1,184 @@
+import http from "node:http";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { composeModules } from "./composition.js";
+import { createComposedServer, DEFAULT_REQUEST_TIMEOUT_MS, } from "./composed-server.js";
+import { createShellPlugin } from "./shell-catalogue.js";
+/**
+ * The HTTP edge as `createComposedServer` wires it, beyond the guard itself
+ * (`composed-server.test.ts`): the listener refuses a guarded request before
+ * reading its body, the in-flight body budget, the request timeout — and the
+ * `Host` half deferred to the CLI under `mcp-use dev`, so its tunnel works.
+ */
+const composition = composeModules({ label: "edge-test", modules: [], appEnvVars: [] });
+const running = [];
+let info;
+beforeEach(() => {
+    info = vi.spyOn(console, "info").mockImplementation(() => { });
+    vi.spyOn(console, "warn").mockImplementation(() => { });
+    vi.spyOn(console, "log").mockImplementation(() => { });
+});
+afterEach(async () => {
+    await Promise.all(running.splice(0).map((server) => server.shutdown()));
+    vi.restoreAllMocks();
+});
+const compose = (env = {}) => createComposedServer({
+    label: "edge-test",
+    info: { name: "edge-test", version: "0.0.0" },
+    composition,
+    // The bundle is read once; a missing file only warns (views render empty).
+    bundle: { jsPath: "/nonexistent/mcp-app.js" },
+    env,
+    setup: () => ({ plugins: [createShellPlugin()] }),
+});
+async function boot(env = {}, listen = {}) {
+    const composed = await compose(env);
+    const server = await composed.listen({ port: 0, host: "127.0.0.1", ...listen });
+    running.push(server);
+    return { composed, server };
+}
+/** Raw HTTP (fetch cannot set `Host`), always on a fresh connection. */
+function request(port, { method = "GET", path = "/", body }) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ host: "127.0.0.1", port, method, path, agent: false }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString("utf8") }));
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
+/**
+ * A POST that sends 10 bytes and never finishes: resolves with the answer the
+ * server gives while the upload is still open, and fails clearly (instead of
+ * hanging) when none comes.
+ */
+function openUpload(port, headers, path = "/mcp") {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ host: "127.0.0.1", port, method: "POST", path, headers, agent: false }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                clearTimeout(unanswered);
+                resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString("utf8") });
+                req.destroy();
+            });
+        });
+        const unanswered = setTimeout(() => {
+            req.destroy();
+            reject(new Error("no answer while the upload was open"));
+        }, 2000);
+        req.on("error", (error) => {
+            if (error.code !== "ECONNRESET" && error.code !== "EPIPE")
+                reject(error);
+        });
+        req.write(Buffer.alloc(10, 0x20));
+    });
+}
+const INITIALIZE = JSON.stringify({
+    jsonrpc: "2.0",
+    id: 1,
+    method: "initialize",
+    params: {
+        protocolVersion: "2025-06-18",
+        capabilities: {},
+        clientInfo: { name: "unit", version: "0" },
+    },
+});
+describe("createComposedServer — admission before the body", () => {
+    it("answers a foreign Host's POST from the guard without reading its body", async () => {
+        const { server } = await boot({ MCP_MAX_BODY_BYTES: "64" });
+        // Over the cap and never finished — the guard's 403 comes first anyway.
+        const res = await openUpload(server.port, {
+            host: "attacker.example",
+            "content-type": "application/json",
+            "content-length": "5000",
+        });
+        expect(res.status).toBe(403);
+        expect(res.body).toContain('Host \\"attacker.example\\" is not allowed');
+        const metrics = await request(server.port, { path: "/metrics" });
+        expect(metrics.body).toMatch(/^mcp_http_requests_total\{method="POST",route="\/mcp",status="403"\} 1$/m);
+    });
+    it("answers a foreign Origin's POST from the guard without reading its body", async () => {
+        const { server } = await boot({ MCP_MAX_BODY_BYTES: "64" });
+        const res = await openUpload(server.port, {
+            origin: "https://attacker.example",
+            "content-type": "application/json",
+            "content-length": "5000",
+        });
+        expect(res.status).toBe(403);
+        expect(res.body).toContain('Origin \\"https://attacker.example\\" is not allowed');
+    });
+    it("decides exemptions like the guard: a POST to an exempt path is read — and capped", async () => {
+        const { server } = await boot({ MCP_MAX_BODY_BYTES: "64" });
+        const headers = { host: "10.0.0.7:8400", "content-length": "5000" };
+        expect((await openUpload(server.port, headers, "/health/x?probe=1")).status).toBe(413);
+        // Not a prefix match on the string: `/healthz` is guarded, so refused unread.
+        expect((await openUpload(server.port, headers, "/healthz")).status).toBe(403);
+    });
+    it("answers 503 once the in-flight body budget is spent", async () => {
+        // Budget: 4 × 64 bytes — four held cap-sized bodies leave no room.
+        const { composed, server } = await boot({ MCP_MAX_BODY_BYTES: "64" });
+        let release;
+        const gate = new Promise((resolve) => (release = resolve));
+        composed.app.post("/hold", async () => {
+            await gate;
+            return new Response("held");
+        });
+        composed.app.post("/probe", () => new Response("admitted"));
+        const holders = Array.from({ length: 4 }, () => request(server.port, { method: "POST", path: "/hold", body: "x".repeat(64) }));
+        await vi.waitFor(async () => {
+            const res = await request(server.port, { method: "POST", path: "/probe", body: "y" });
+            expect(res.status).toBe(503);
+            expect(res.body).toContain("Server busy");
+        });
+        release();
+        for (const holder of holders)
+            expect((await holder).body).toBe("held");
+        // The shares are released with the responses.
+        await vi.waitFor(async () => {
+            const after = await request(server.port, { method: "POST", path: "/probe", body: "y" });
+            expect(after.body).toBe("admitted");
+        });
+    });
+    it("cuts an upload that is not finished within the request timeout", async () => {
+        const { server } = await boot({}, { requestTimeoutMs: 200 });
+        const res = await openUpload(server.port, {
+            "content-type": "application/json",
+            "content-length": "100",
+        });
+        expect(res.status).toBe(408);
+    });
+    it("defaults the request timeout far below Node's 300 s", () => {
+        expect(DEFAULT_REQUEST_TIMEOUT_MS).toBe(30_000);
+    });
+});
+describe("createComposedServer — under mcp-use dev (the CLI owns the socket)", () => {
+    const TUNNEL_HOST = "k3x9.tunnel.example";
+    /** What the dev CLI hands the entry's `fetch` for a tunneled call: the public Host, unchanged. */
+    const tunneled = (composed, origin) => composed.app.fetch(new Request(`http://${TUNNEL_HOST}/mcp`, {
+        method: "POST",
+        headers: {
+            host: TUNNEL_HOST,
+            "content-type": "application/json",
+            accept: "application/json, text/event-stream",
+            ...(origin ? { origin } : {}),
+        },
+        body: INITIALIZE,
+    }));
+    it("defers the Host check to the CLI, so its tunnel reaches the server", async () => {
+        const composed = await compose({ MCP_USE_DEV_CLI: "1" });
+        expect((await tunneled(composed)).status).toBe(200);
+        expect(info).toHaveBeenCalledWith("[edge-test] mcp-use dev: the CLI checks Host (localhost-class + its tunnel); Origin is checked here.");
+    });
+    it("keeps the Origin check, which the CLI does not do", async () => {
+        const composed = await compose({ MCP_USE_DEV_CLI: "1" });
+        expect((await tunneled(composed, "https://attacker.example")).status).toBe(403);
+    });
+    it("checks Host itself outside mcp-use dev", async () => {
+        const composed = await compose();
+        expect((await tunneled(composed)).status).toBe(403);
+        expect(info).not.toHaveBeenCalledWith(expect.stringContaining("mcp-use dev:"));
+    });
+});
+//# sourceMappingURL=composed-server.edge.test.js.map

package/dist/composed-server.edge.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composed-server.edge.test.js","sourceRoot":"","sources":["../src/composed-server.edge.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAqB,MAAM,QAAQ,CAAA;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD;;;;;GAKG;AAEH,MAAM,WAAW,GAAG,cAAc,CAAS,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;AAC/F,MAAM,OAAO,GAAoB,EAAE,CAAA;AACnC,IAAI,IAA0C,CAAA;AAE9C,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC7D,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACvD,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvE,EAAE,CAAC,eAAe,EAAE,CAAA;AACtB,CAAC,CAAC,CAAA;AAEF,MAAM,OAAO,GAAG,CAAC,MAAyB,EAAE,EAAE,EAAE,CAC9C,oBAAoB,CAAC;IACnB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE;IAC7C,WAAW;IACX,2EAA2E;IAC3E,MAAM,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC7C,GAAG;IACH,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;CAClD,CAAC,CAAA;AAEJ,KAAK,UAAU,IAAI,CAAC,MAAyB,EAAE,EAAE,SAAwB,EAAE;IACzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED,wEAAwE;AACxE,SAAS,OAAO,CACd,IAAY,EACZ,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAqD;IAEvF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACxF,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAA;QACH,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,OAA+B,EAC/B,IAAI,GAAG,MAAM;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EACxE,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,YAAY,CAAC,UAAU,CAAC,CAAA;gBACxB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACtF,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YACjC,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAA;QAC1D,CAAC,EAAE,IAAI,CAAC,CAAA;QACR,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,OAAO,EAAE,KAAK;IACd,EAAE,EAAE,CAAC;IACL,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE;QACN,eAAe,EAAE,YAAY;QAC7B,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;KAC3C;CACF,CAAC,CAAA;AAEF,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,wEAAwE;QACxE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;YACxC,IAAI,EAAE,kBAAkB;YACxB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4CAA4C,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAC1B,0EAA0E,CAC3E,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE,0BAA0B;YAClC,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sDAAsD,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAA;QACnE,MAAM,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtF,8EAA8E;QAC9E,MAAM,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,mEAAmE;QACnE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACrE,IAAI,OAAoB,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAA;QAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,IAAI,CAAA;YACV,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAC7C,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAC9E,CAAA;QACD,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACrF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;QACT,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtE,8CAA8C;QAC9C,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACvF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;YACxC,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAClF,MAAM,WAAW,GAAG,qBAAqB,CAAA;IAEzC,kGAAkG;IAClG,MAAM,QAAQ,GAAG,CACf,QAA+D,EAC/D,MAAe,EACf,EAAE,CACF,QAAQ,CAAC,GAAG,CAAC,KAAK,CAChB,IAAI,OAAO,CAAC,UAAU,WAAW,MAAM,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,IAAI,EAAE,WAAW;YACjB,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;YAC7C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;QACD,IAAI,EAAE,UAAU;KACjB,CAAC,CACH,CAAA;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAA;QACxD,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAC/B,sGAAsG,CACvG,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAA;QACxD,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAA;QAChC,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/composed-server.fonts.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=composed-server.fonts.test.d.ts.map

package/dist/composed-server.fonts.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composed-server.fonts.test.d.ts","sourceRoot":"","sources":["../src/composed-server.fonts.test.ts"],"names":[],"mappings":""}

package/dist/composed-server.fonts.test.js

@@ -0,0 +1,186 @@
+import http from "node:http";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { composeModules } from "./composition.js";
+import { createComposedServer } from "./composed-server.js";
+import { loadServedFonts } from "./font-assets.js";
+import { SERVED_FONT_FILES, SERVED_FONT_PATH } from "./served-fonts.js";
+import { createShellPlugin } from "./shell-catalogue.js";
+import { showToolBinding } from "./widget-tool-bindings.js";
+/**
+ * The font route and the font origin as `createComposedServer` wires them:
+ * Geist served behind the HTTP edge guard, and the origin the views load it
+ * from advertised on every view-bound tool — `render-view` AND a module's
+ * own `*_show_*` tool.
+ */
+const composition = composeModules({ label: "fonts-test", modules: [], appEnvVars: [] });
+const running = [];
+const SANS = `${SERVED_FONT_PATH}/${SERVED_FONT_FILES.sans}`;
+const MONO = `${SERVED_FONT_PATH}/${SERVED_FONT_FILES.mono}`;
+/** A module plugin with one view-bound show tool, registered the house way. */
+const showPlugin = {
+    definition: { name: "demo", steps: [], widgets: [] },
+    registerWidgetTools: (server) => {
+        server.tool({
+            name: "demo_show_thing",
+            description: "Shows a thing.",
+            ...showToolBinding("demo_show_thing", "Thing"),
+        }, () => ({ content: [{ type: "text", text: "ok" }], structuredContent: {} }));
+    },
+};
+beforeEach(() => {
+    vi.spyOn(console, "info").mockImplementation(() => { });
+    vi.spyOn(console, "warn").mockImplementation(() => { });
+    vi.spyOn(console, "log").mockImplementation(() => { });
+});
+afterEach(async () => {
+    await Promise.all(running.splice(0).map((server) => server.shutdown()));
+    vi.restoreAllMocks();
+    vi.unstubAllEnvs();
+});
+async function boot(env = {}) {
+    // mcp-use reads MCP_URL from process.env itself (the request-resolved origin).
+    vi.stubEnv("MCP_URL", env.MCP_URL);
+    const composed = await createComposedServer({
+        label: "fonts-test",
+        info: { name: "fonts-test", version: "0.0.0" },
+        composition,
+        bundle: { jsPath: "/nonexistent/mcp-app.js" },
+        env,
+        setup: () => ({ plugins: [createShellPlugin(), showPlugin] }),
+    });
+    const server = await composed.listen({ port: 0, host: "127.0.0.1" });
+    running.push(server);
+    return server;
+}
+/** Raw HTTP (fetch cannot set `Host`), on a fresh connection. */
+function request(port, { method = "GET", path = "/", headers = {}, body, }) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ host: "127.0.0.1", port, method, path, headers, agent: false }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => resolve({
+                status: res.statusCode ?? 0,
+                headers: res.headers,
+                body: Buffer.concat(chunks),
+            }));
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
+/** One JSON-RPC call to `/mcp` (stateless), its `result`. */
+async function rpc(port, method, params = {}) {
+    const res = await request(port, {
+        method: "POST",
+        path: "/mcp",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json, text/event-stream",
+            "mcp-protocol-version": "2025-06-18",
+        },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    });
+    const text = res.body.toString("utf8");
+    const json = text.trimStart().startsWith("{")
+        ? text
+        : text
+            .split("\n")
+            .find((line) => line.startsWith("data: "))
+            .slice("data: ".length);
+    return JSON.parse(json).result;
+}
+const viewResources = async (port) => (await rpc(port, "resources/list")).resources.filter((r) => r.uri.startsWith("ui://views/"));
+async function readCsp(port, uri) {
+    const { contents } = (await rpc(port, "resources/read", { uri }));
+    return contents[0]._meta?.ui?.csp;
+}
+describe("the font route", () => {
+    it("serves both files as woff2, cached immutable, readable from the view's sandboxed origin", async () => {
+        const server = await boot();
+        const files = new Map(loadServedFonts().map(({ file, body }) => [file, body]));
+        for (const path of [SANS, MONO]) {
+            // A font load from a sandboxed srcdoc view: CORS mode, `Origin: null`.
+            const res = await request(server.port, { path, headers: { origin: "null" } });
+            expect(res.status, path).toBe(200);
+            expect(res.headers).toMatchObject({
+                "content-type": "font/woff2",
+                "cache-control": "public, max-age=31536000, immutable",
+                "access-control-allow-origin": "*",
+                "cross-origin-resource-policy": "cross-origin",
+                "x-content-type-options": "nosniff",
+            });
+            expect(res.body.equals(Buffer.from(files.get(path.split("/").at(-1)))), path).toBe(true);
+        }
+    });
+    it("answers HEAD without a body and an unknown file with 404", async () => {
+        const server = await boot();
+        const head = await request(server.port, { method: "HEAD", path: SANS });
+        expect(head.status).toBe(200);
+        expect(head.headers["content-type"]).toBe("font/woff2");
+        expect(head.body.byteLength).toBe(0);
+        expect((await request(server.port, { path: `${SERVED_FONT_PATH}/other.woff2` })).status).toBe(404);
+    });
+    it("stays behind the Host guard (DNS rebinding) but passes any Origin on its GET", async () => {
+        const server = await boot();
+        const foreignHost = await request(server.port, {
+            path: SANS,
+            headers: { host: "attacker.example" },
+        });
+        expect(foreignHost.status).toBe(403);
+        const hostedView = await request(server.port, {
+            path: SANS,
+            headers: { origin: "https://abc123.claudemcpcontent.com" },
+        });
+        expect(hostedView.status).toBe(200);
+    });
+    it("admits MCP_URL's host — where a hosted view reaches the server", async () => {
+        const server = await boot({ MCP_URL: "https://mcp.example.test/mcp" });
+        const res = await request(server.port, { path: SANS, headers: { host: "mcp.example.test" } });
+        expect(res.status).toBe(200);
+    });
+    it("is counted in the HTTP metrics under its own route label", async () => {
+        const server = await boot();
+        await request(server.port, { path: SANS });
+        const metrics = (await request(server.port, { path: "/metrics" })).body.toString("utf8");
+        expect(metrics).toMatch(/^mcp_http_requests_total\{method="GET",route="\/fonts",status="200"\} 1$/m);
+    });
+});
+describe("the font origin on the views", () => {
+    it("advertises MCP_URL's origin in resourceDomains on every view resource, listed and read", async () => {
+        const server = await boot({ MCP_URL: "https://mcp.example.test/mcp" });
+        const resources = await viewResources(server.port);
+        expect(resources.map((r) => r.uri).sort()).toEqual([
+            "ui://views/demo_show_thing.html",
+            "ui://views/render-view.html",
+        ]);
+        for (const resource of resources) {
+            expect(resource._meta?.ui?.csp?.resourceDomains, `${resource.uri} listed`).toContain("https://mcp.example.test");
+            expect((await readCsp(server.port, resource.uri))?.resourceDomains, `${resource.uri} read`).toContain("https://mcp.example.test");
+        }
+    });
+    it("advertises it to Apps SDK hosts on every widget tool (openai/widgetCSP)", async () => {
+        const server = await boot({ MCP_URL: "https://mcp.example.test/mcp" });
+        const { tools } = (await rpc(server.port, "tools/list"));
+        const widgetTools = tools.filter((tool) => tool._meta?.["openai/outputTemplate"] !== undefined);
+        expect(widgetTools.map((tool) => tool.name).sort()).toEqual(["demo_show_thing", "render-view"]);
+        for (const tool of widgetTools) {
+            expect(tool._meta?.["openai/widgetCSP"], tool.name).toEqual({
+                resource_domains: ["https://mcp.example.test"],
+            });
+        }
+    });
+    it("without MCP_URL leaves it to the request: every view admits the origin it was read from", async () => {
+        const server = await boot();
+        const origin = `http://127.0.0.1:${server.port}`;
+        for (const resource of await viewResources(server.port)) {
+            // mcp-use appends the request-resolved origin, listed and read alike.
+            expect(resource._meta?.ui?.csp?.resourceDomains, resource.uri).toEqual([origin]);
+            expect((await readCsp(server.port, resource.uri))?.resourceDomains, resource.uri).toEqual([
+                origin,
+            ]);
+        }
+        const { tools } = (await rpc(server.port, "tools/list"));
+        expect(tools.some((tool) => tool._meta?.["openai/widgetCSP"] !== undefined)).toBe(false);
+    });
+});
+//# sourceMappingURL=composed-server.fonts.test.js.map

package/dist/composed-server.fonts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composed-server.fonts.test.js","sourceRoot":"","sources":["../src/composed-server.fonts.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAGxE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAsB,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D;;;;;GAKG;AAEH,MAAM,WAAW,GAAG,cAAc,CAAS,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;AAChG,MAAM,OAAO,GAAoB,EAAE,CAAA;AACnC,MAAM,IAAI,GAAG,GAAG,gBAAgB,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAA;AAC5D,MAAM,IAAI,GAAG,GAAG,gBAAgB,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAA;AAE5D,+EAA+E;AAC/E,MAAM,UAAU,GAAyB;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACpD,mBAAmB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC9B,MAAM,CAAC,IAAI,CACT;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,gBAAgB;YAC7B,GAAG,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC;SAC/C,EACD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CACpF,CAAA;IACH,CAAC;CACF,CAAA;AAED,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACvD,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvE,EAAE,CAAC,eAAe,EAAE,CAAA;IACpB,EAAE,CAAC,aAAa,EAAE,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,KAAK,UAAU,IAAI,CAAC,MAAyB,EAAE;IAC7C,+EAA+E;IAC/E,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;QAC1C,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;QAC9C,WAAW;QACX,MAAM,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;QAC7C,GAAG;QACH,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpB,OAAO,MAAM,CAAA;AACf,CAAC;AAQD,iEAAiE;AACjE,SAAS,OAAO,CACd,IAAY,EACZ,EACE,MAAM,GAAG,KAAK,EACd,IAAI,GAAG,GAAG,EACV,OAAO,GAAG,EAAE,EACZ,IAAI,GAML;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAChE,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC;gBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC3B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC5B,CAAC,CACH,CAAA;QACH,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,SAAkC,EAAE;IACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;YAC7C,sBAAsB,EAAE,YAAY;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI;aACD,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAE;aAC1C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC,MAAM,CAAA;AACzE,CAAC;AAMD,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAC1C,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9E,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAChC,CAAA;AAEH,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAE/D,CAAA;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAA;AACnC,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;YAC7E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;gBAChC,cAAc,EAAE,YAAY;gBAC5B,eAAe,EAAE,qCAAqC;gBACtD,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,cAAc;gBAC9C,wBAAwB,EAAE,SAAS;aACpC,CAAC,CAAA;YACF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAC3F,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAC7C,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;SACtC,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5C,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE;SAC3D,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;QAC7F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CACrB,2EAA2E,CAC5E,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;QACtE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAClD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACjD,iCAAiC;YACjC,6BAA6B;SAC9B,CAAC,CAAA;QACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC,SAAS,CAClF,0BAA0B,CAC3B,CAAA;YACD,MAAM,CACJ,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAC3D,GAAG,QAAQ,CAAC,GAAG,OAAO,CACvB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;QACzC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;QACtE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAA2B,CAAA;QAClF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,uBAAuB,CAAC,KAAK,SAAS,CAAC,CAAA;QAC/F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAA;QAC/F,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC1D,gBAAgB,EAAE,CAAC,0BAA0B,CAAC;aAC/C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,MAAM,MAAM,GAAG,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAA;QAChD,KAAK,MAAM,QAAQ,IAAI,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,sEAAsE;YACtE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAChF,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;gBACxF,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAA2B,CAAA;QAClF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}