@n24q02m/hull 0.0.0-stage → 0.4.0-beta.10

package/build/crypto/kdf.d.ts

@@ -0,0 +1,15 @@
+export declare function deriveAesKey(sharedSecret: ArrayBuffer, passphrase: string): Promise<CryptoKey>;
+/**
+ * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
+ *
+ * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
+ * replica converges on the SAME signing key without a shared volume or
+ * external secret store. Domain-separated per server via the HKDF info label.
+ *
+ * HKDF-SHA256 with IKM = secret, empty salt, info =
+ * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
+ * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
+ * crypto-vectors fixture).
+ */
+export declare function deriveJwtSigningSeed(secret: string, serverName: string): Buffer;
+//# sourceMappingURL=kdf.d.ts.map

package/build/crypto/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAOA,wBAAsB,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWpG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/E"}

package/build/crypto/kdf.js

@@ -0,0 +1,26 @@
+import { hkdfSync } from 'node:crypto';
+const encoder = new TextEncoder();
+const INFO = encoder.encode('mcp-relay');
+const JWT_SIGNING_INFO_PREFIX = 'mcp-jwt-signing-key-v1:';
+export async function deriveAesKey(sharedSecret, passphrase) {
+    const salt = encoder.encode(passphrase);
+    const keyMaterial = await crypto.subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt, info: INFO }, keyMaterial, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+}
+/**
+ * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
+ *
+ * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
+ * replica converges on the SAME signing key without a shared volume or
+ * external secret store. Domain-separated per server via the HKDF info label.
+ *
+ * HKDF-SHA256 with IKM = secret, empty salt, info =
+ * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
+ * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
+ * crypto-vectors fixture).
+ */
+export function deriveJwtSigningSeed(secret, serverName) {
+    const info = encoder.encode(`${JWT_SIGNING_INFO_PREFIX}${serverName}`);
+    return Buffer.from(hkdfSync('sha256', Buffer.from(secret, 'utf-8'), Buffer.alloc(0), info, 32));
+}
+//# sourceMappingURL=kdf.js.map

package/build/crypto/kdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACxC,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAEzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAyB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,UAAkB;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,uBAAuB,GAAG,UAAU,EAAE,CAAC,CAAA;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;AACjG,CAAC"}

package/build/index.d.ts

@@ -0,0 +1,19 @@
+export { authorizationServerMetadata, type CapabilityInfo, type ConfigField, type CredentialsCallback, createDelegatedOAuthApp, createLocalOAuthApp, type DelegatedOAuthAppOptions, type DelegatedOAuthAppResult, type FlowType, type LocalOAuthAppOptions, type LocalOAuthAppResult, type NextStep, type OAuthTokens, protectedResourceMetadata, type RelayConfigSchema, type RenderOptions, renderCredentialForm, type StepCallback, type SubjectContext, type TokenCallback, type UpstreamOAuthConfig } from './auth/index.js';
+export { type BuildCliOptions, buildCli, type CliHandler, type ServeFn } from './cli/build-cli.js';
+export * from './crypto/index.js';
+export { JWTIssuer } from './oauth/jwt-issuer.js';
+export { verifyPKCE } from './oauth/pkce.js';
+export { InMemoryAuthCache, type IOAuthSessionCache, OAuthProvider, type OAuthProviderOptions, type PreAuthSession } from './oauth/provider.js';
+export { type IUserCredentialStore, SqliteUserStore } from './oauth/user-store.js';
+export { tryOpenBrowser } from './relay/browser.js';
+export { createSession, generatePassphrase, notifyComplete, pollForResponses, pollForResult, type RelaySession, sendMessage } from './relay/client.js';
+export { buildOpenRelayHandler, type ElicitationServer, type OpenRelayHandlerOptions, type OpenRelayResult, registerOpenRelayTool, type ToolRegistrar } from './relay/tool-helpers.js';
+export type * from './schema/types.js';
+export { exportConfig, importConfig, listConfigs, scheduleReloadExit } from './storage/config-file.js';
+export { deleteStoredConfig as deleteConfig, readStoredConfig as readConfig, writeStoredConfig as writeConfig } from './storage/credential-store.js';
+export { clearMode, getMode, type ServerMode, setLocalMode } from './storage/mode.js';
+export * from './storage/resolver.js';
+export { acquireSessionLock, releaseSessionLock, type SessionInfo, writeSessionLock } from './storage/session-lock.js';
+export * from './token-auth/index.js';
+export { type HttpRoute, type HttpServerHandle, type RunHttpServerOptions, runHttpServer } from './transport/local-server.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAClG,cAAc,mBAAmB,CAAA;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,KAAK,YAAY,EACjB,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAChC,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGtG,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAGlC,cAAc,uBAAuB,CAAA;AAErC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,aAAa,EACd,MAAM,6BAA6B,CAAA"}

package/build/index.js

@@ -0,0 +1,28 @@
+// Local OAuth 2.1 Authorization Server (single-user, 127.0.0.1) +
+// Delegated OAuth (upstream redirect / device code) for remote multi-user.
+export { authorizationServerMetadata, createDelegatedOAuthApp, createLocalOAuthApp, protectedResourceMetadata, renderCredentialForm } from './auth/index.js';
+// Console-script CLI builder shared by every TS MCP server (config/relay/doctor
+// built-ins + version + help; parity with core-py's build_cli).
+export { buildCli } from './cli/build-cli.js';
+export * from './crypto/index.js';
+// OAuth 2.1 multi-user infrastructure (HTTP mode)
+export { JWTIssuer } from './oauth/jwt-issuer.js';
+export { verifyPKCE } from './oauth/pkce.js';
+export { InMemoryAuthCache, OAuthProvider } from './oauth/provider.js';
+export { SqliteUserStore } from './oauth/user-store.js';
+export { tryOpenBrowser } from './relay/browser.js';
+export { createSession, generatePassphrase, notifyComplete, pollForResponses, pollForResult, sendMessage } from './relay/client.js';
+export { buildOpenRelayHandler, registerOpenRelayTool } from './relay/tool-helpers.js';
+export { exportConfig, importConfig, listConfigs, scheduleReloadExit } from './storage/config-file.js';
+// Single-user credential read/write/delete route through the unified
+// per-plugin store (with legacy config.enc read fallback).
+export { deleteStoredConfig as deleteConfig, readStoredConfig as readConfig, writeStoredConfig as writeConfig } from './storage/credential-store.js';
+export { clearMode, getMode, setLocalMode } from './storage/mode.js';
+export * from './storage/resolver.js';
+export { acquireSessionLock, releaseSessionLock, writeSessionLock } from './storage/session-lock.js';
+// HTTP token-table auth (no-auth / token / multi users.toml), the TS port of
+// core-py hull_core.auth; wired into runHttpServer via its `auth` option.
+export * from './token-auth/index.js';
+// HTTP MCP server entry point (OAuth AS + /mcp transport on 127.0.0.1)
+export { runHttpServer } from './transport/local-server.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,2EAA2E;AAC3E,OAAO,EACL,2BAA2B,EAI3B,uBAAuB,EACvB,mBAAmB,EAQnB,yBAAyB,EAGzB,oBAAoB,EAKrB,MAAM,iBAAiB,CAAA;AACxB,gFAAgF;AAChF,gEAAgE;AAChE,OAAO,EAAwB,QAAQ,EAAiC,MAAM,oBAAoB,CAAA;AAClG,cAAc,mBAAmB,CAAA;AACjC,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EACL,iBAAiB,EAEjB,aAAa,EAGd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA6B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,EAEb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,qBAAqB,EAIrB,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACtG,qEAAqE;AACrE,2DAA2D;AAC3D,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,6EAA6E;AAC7E,0EAA0E;AAC1E,cAAc,uBAAuB,CAAA;AACrC,uEAAuE;AACvE,OAAO,EAIL,aAAa,EACd,MAAM,6BAA6B,CAAA"}

package/build/lifecycle/lock.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Lock-file lifecycle helpers for HTTP server mode.
+ *
+ * After the stdio-pure + http-multi-user split, lock files are used solely
+ * by `runHttpServer` to prevent two HTTP servers binding the same port for
+ * the same `serverName`. They are no longer used to discover or steer
+ * daemon-bridge processes; per-credState TTLs and PID liveness checks have
+ * been removed along with the daemon model.
+ *
+ * On-disk format (4 lines + trailing newline, padded to 512 bytes):
+ *
+ * ```
+ * {pid}
+ * {port}
+ * {token}
+ * {spawnedAt_iso8601_utc}
+ * ```
+ *
+ * `sweepStaleLocks` removes lock files whose `spawnedAt` is older than the
+ * configured TTL. There is no daemon to terminate — the HTTP server owns
+ * its own lifecycle and exits when its parent process exits.
+ *
+ * TypeScript port of core-py's `mcp_core.lifecycle.lock`. Behaviour kept
+ * identical for cross-language parity.
+ */
+export declare const DEFAULT_LOCK_TTL_HOURS = 24;
+/** Parsed lock metadata — shared by sweep and refresh helpers. */
+export interface LockMetadata {
+    pid: number;
+    port: number;
+    token: string;
+    spawnedAt: Date;
+}
+export declare function locksDir(root?: string): string;
+/**
+ * No-arg lock-dir resolver — sweep tests `vi.spyOn(lockModule, 'lockDir')`
+ * to redirect into a temp directory without threading a `root` arg.
+ */
+export declare function lockDir(): string;
+/**
+ * Refresh `spawnedAt` of an existing lock file. Silent no-op on legacy /
+ * malformed files so callers don't need try/except.
+ *
+ * Padded to 512 bytes so on-disk size stays stable while a Windows
+ * byte-range lock is held past the metadata region (parity with core-py).
+ */
+export declare function refreshLockTimestamp(path: string): void;
+/**
+ * Remove stale lock files for `serverName`. Returns count removed.
+ *
+ * Called by `runHttpServer` at startup before writing its own lock,
+ * preventing pile-up of dozens of `<server>-<port>.lock` files when HTTP
+ * servers exit abnormally (Windows OOM, taskkill, signal).
+ *
+ * A lock is stale when:
+ *  - file is unreadable or has malformed payload (legacy / corrupt)
+ *  - `spawnedAt` is older than the TTL
+ */
+export declare function sweepStaleLocks(serverName: string, ttlHours?: number, root?: string): number;
+/**
+ * Write the 4-line lock payload (pid, port, token, ISO timestamp) padded
+ * to 512 bytes. Used by `runHttpServer` after the OS file lock is
+ * acquired.
+ *
+ * Returns the absolute path to the lock file.
+ */
+export declare function writeLockFile(serverName: string, port: number, token: string, root?: string): string;
+//# sourceMappingURL=lock.d.ts.map

package/build/lifecycle/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/lifecycle/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAcH,eAAO,MAAM,sBAAsB,KAAK,CAAA;AAExC,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,wBAAgB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;GAGG;AACH,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAeD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAoD5F;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpG"}

package/build/lifecycle/lock.js

@@ -0,0 +1,173 @@
+/**
+ * Lock-file lifecycle helpers for HTTP server mode.
+ *
+ * After the stdio-pure + http-multi-user split, lock files are used solely
+ * by `runHttpServer` to prevent two HTTP servers binding the same port for
+ * the same `serverName`. They are no longer used to discover or steer
+ * daemon-bridge processes; per-credState TTLs and PID liveness checks have
+ * been removed along with the daemon model.
+ *
+ * On-disk format (4 lines + trailing newline, padded to 512 bytes):
+ *
+ * ```
+ * {pid}
+ * {port}
+ * {token}
+ * {spawnedAt_iso8601_utc}
+ * ```
+ *
+ * `sweepStaleLocks` removes lock files whose `spawnedAt` is older than the
+ * configured TTL. There is no daemon to terminate — the HTTP server owns
+ * its own lifecycle and exits when its parent process exits.
+ *
+ * TypeScript port of core-py's `mcp_core.lifecycle.lock`. Behaviour kept
+ * identical for cross-language parity.
+ */
+import { existsSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// Self-import so `sweepStaleLocks` can resolve `lockDir` through the
+// module namespace at call time. This makes
+// `vi.spyOn(lockModule, 'lockDir').mockReturnValue(...)` actually
+// intercept the helper from inside the sweep loop — without this
+// indirection, the closure-captured local binding ignores spies and
+// test mocks become silent no-ops.
+import * as self from './lock.js';
+export const DEFAULT_LOCK_TTL_HOURS = 24;
+export function locksDir(root) {
+    return root ?? join(homedir(), '.config', 'mcp', 'locks');
+}
+/**
+ * No-arg lock-dir resolver — sweep tests `vi.spyOn(lockModule, 'lockDir')`
+ * to redirect into a temp directory without threading a `root` arg.
+ */
+export function lockDir() {
+    return locksDir();
+}
+/** Internal helper: parse the textual lock payload into `LockMetadata`. */
+function parseLockText(raw) {
+    const lines = raw.replace(/\n+$/, '').split('\n');
+    if (lines.length < 4)
+        return null;
+    const pid = Number(lines[0]);
+    const port = Number(lines[1]);
+    if (!Number.isInteger(pid) || !Number.isInteger(port))
+        return null;
+    const token = lines[2];
+    const spawnedAt = new Date(lines[3]);
+    if (Number.isNaN(spawnedAt.getTime()))
+        return null;
+    return { pid, port, token, spawnedAt };
+}
+/**
+ * Refresh `spawnedAt` of an existing lock file. Silent no-op on legacy /
+ * malformed files so callers don't need try/except.
+ *
+ * Padded to 512 bytes so on-disk size stays stable while a Windows
+ * byte-range lock is held past the metadata region (parity with core-py).
+ */
+export function refreshLockTimestamp(path) {
+    if (!existsSync(path))
+        return;
+    let raw;
+    try {
+        raw = readFileSync(path, { encoding: 'utf-8' });
+    }
+    catch {
+        return;
+    }
+    const md = parseLockText(raw);
+    if (md === null)
+        return;
+    const now = new Date().toISOString();
+    const payload = `${md.pid}\n${md.port}\n${md.token}\n${now}\n`;
+    try {
+        writeFileSync(path, payload.padEnd(512, ' '), { encoding: 'utf-8' });
+    }
+    catch {
+        // Best-effort
+    }
+}
+/**
+ * Remove stale lock files for `serverName`. Returns count removed.
+ *
+ * Called by `runHttpServer` at startup before writing its own lock,
+ * preventing pile-up of dozens of `<server>-<port>.lock` files when HTTP
+ * servers exit abnormally (Windows OOM, taskkill, signal).
+ *
+ * A lock is stale when:
+ *  - file is unreadable or has malformed payload (legacy / corrupt)
+ *  - `spawnedAt` is older than the TTL
+ */
+export function sweepStaleLocks(serverName, ttlHours, root) {
+    const dir = root !== undefined ? root : self.lockDir();
+    if (!existsSync(dir))
+        return 0;
+    let removed = 0;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    const prefix = `${serverName}-`;
+    const suffix = '.lock';
+    const now = Date.now();
+    const ttlMs = (ttlHours ?? DEFAULT_LOCK_TTL_HOURS) * 3600 * 1000;
+    for (const entry of entries) {
+        if (!entry.startsWith(prefix) || !entry.endsWith(suffix))
+            continue;
+        const full = join(dir, entry);
+        let raw;
+        try {
+            raw = readFileSync(full, { encoding: 'utf-8' });
+        }
+        catch {
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+            continue;
+        }
+        const meta = parseLockText(raw);
+        if (meta === null) {
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+            continue;
+        }
+        if (now - meta.spawnedAt.getTime() > ttlMs) {
+            try {
+                unlinkSync(full);
+                removed += 1;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    return removed;
+}
+/**
+ * Write the 4-line lock payload (pid, port, token, ISO timestamp) padded
+ * to 512 bytes. Used by `runHttpServer` after the OS file lock is
+ * acquired.
+ *
+ * Returns the absolute path to the lock file.
+ */
+export function writeLockFile(serverName, port, token, root) {
+    const dir = locksDir(root);
+    const path = join(dir, `${serverName}-${port}.lock`);
+    const payload = `${process.pid}\n${port}\n${token}\n${new Date().toISOString()}\n`;
+    writeFileSync(path, payload.padEnd(512, ' '), { encoding: 'utf-8', mode: 0o600 });
+    return path;
+}
+//# sourceMappingURL=lock.js.map

package/build/lifecycle/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/lifecycle/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,qEAAqE;AACrE,4CAA4C;AAC5C,kEAAkE;AAClE,iEAAiE;AACjE,oEAAoE;AACpE,mCAAmC;AACnC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAUxC,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,QAAQ,EAAE,CAAA;AACnB,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAM;IAC7B,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IACD,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,EAAE,KAAK,IAAI;QAAE,OAAM;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,CAAA;IAC9D,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,QAAiB,EAAE,IAAa;IAClF,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IAE9B,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAA;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAA;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,sBAAsB,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAEhE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAQ;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAY,EAAE,KAAa,EAAE,IAAa;IAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,IAAI,OAAO,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAA;IAClF,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC"}

package/build/oauth/cache.d.ts

@@ -0,0 +1,22 @@
+export interface PreAuthSession {
+    sessionId: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    /** Serialized CryptoKeyPair for later credential retrieval */
+    keyPairJwk: JsonWebKey;
+    passphrase: string;
+    expiresAt: number;
+}
+export interface IOAuthSessionCache {
+    save(session: PreAuthSession): void;
+    getAndDelete(sessionId: string): PreAuthSession | null;
+}
+export declare class InMemoryAuthCache implements IOAuthSessionCache {
+    private cache;
+    save(session: PreAuthSession): void;
+    getAndDelete(sessionId: string): PreAuthSession | null;
+}
+//# sourceMappingURL=cache.d.ts.map

package/build/oauth/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/oauth/cache.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAA;IACnC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;CACvD;AAED,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,OAAO,CAAC,KAAK,CAAoC;IAEjD,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAOlC;IAED,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMrD;CACF"}

package/build/oauth/cache.js

@@ -0,0 +1,24 @@
+export class InMemoryAuthCache {
+    constructor() {
+        this.cache = new Map();
+    }
+    save(session) {
+        this.cache.set(session.sessionId, session);
+        // Cleanup expired entries
+        const now = Math.floor(Date.now() / 1000);
+        for (const [id, sess] of this.cache) {
+            if (sess.expiresAt < now)
+                this.cache.delete(id);
+        }
+    }
+    getAndDelete(sessionId) {
+        const sess = this.cache.get(sessionId);
+        if (!sess)
+            return null;
+        this.cache.delete(sessionId);
+        if (sess.expiresAt < Math.floor(Date.now() / 1000))
+            return null;
+        return sess;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/build/oauth/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/oauth/cache.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,iBAAiB;IAA9B;QACU,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAkBnD,CAAC;IAhBC,IAAI,CAAC,OAAuB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC1C,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/build/oauth/index.d.ts

@@ -0,0 +1,6 @@
+export { InMemoryAuthCache, type IOAuthSessionCache, type PreAuthSession } from './cache.js';
+export { JWTIssuer } from './jwt-issuer.js';
+export { verifyPKCE } from './pkce.js';
+export { OAuthProvider, type OAuthProviderOptions } from './provider.js';
+export { type IUserCredentialStore, SqliteUserStore } from './user-store.js';
+//# sourceMappingURL=index.d.ts.map

package/build/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/build/oauth/index.js

@@ -0,0 +1,6 @@
+export { InMemoryAuthCache } from './cache.js';
+export { JWTIssuer } from './jwt-issuer.js';
+export { verifyPKCE } from './pkce.js';
+export { OAuthProvider } from './provider.js';
+export { SqliteUserStore } from './user-store.js';
+//# sourceMappingURL=index.js.map

package/build/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAGlB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,aAAa,EAEd,MAAM,eAAe,CAAA;AACtB,OAAO,EAA6B,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/build/oauth/jwt-issuer.d.ts

@@ -0,0 +1,87 @@
+/**
+ * JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ *
+ * Two signing modes, selected at construction:
+ *
+ * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
+ *   keys generated on first run and persisted to disk so they survive restarts
+ *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
+ *
+ * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
+ *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
+ *   container replica converges on the same key without a shared volume or
+ *   external secret store, so OAuth tokens survive container recreation
+ *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
+ *   the raw public key.
+ *
+ * The two modes are different deployments that never exchange tokens
+ * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
+ * intentional. Each process runs exactly one algorithm; the verify path uses
+ * that single alg, never a {RS256, EdDSA} union.
+ */
+import * as jose from 'jose';
+export declare class JWTIssuer {
+    private serverName;
+    private keysDir;
+    private privateKeyPath;
+    private publicKeyPath;
+    private credentialSecret;
+    alg: 'RS256' | 'EdDSA';
+    private kid;
+    private privateKey;
+    private publicKey;
+    private okpX;
+    private _initialized;
+    constructor(serverName: string, keysDir?: string, credentialSecret?: string | null);
+    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
+    init(): Promise<void>;
+    private deriveEddsaKeys;
+    private loadOrGenerateRsaKeys;
+    /**
+     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
+     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
+     * mode emits an OKP JWK.
+     */
+    getJwks(): Promise<jose.JSONWebKeySet>;
+    /** Issue a JWT access token (typ="access") signed with the active alg. */
+    issueAccessToken(sub: string, expiresInSeconds?: number): Promise<string>;
+    /**
+     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
+     *
+     * Defaults to a 1-year (31536000s) lifetime so long-running MCP clients can
+     * mint fresh access tokens without forcing the user back through the browser
+     * PKCE flow. The access token stays short-lived (1h); the refresh token is the
+     * renewal credential and is rotated on every use (the /token refresh handler
+     * issues a new refresh token each time), so the security control is rotation,
+     * not a short TTL. A short refresh TTL was the residual re-auth driver: a
+     * self-hosted server a user touches only intermittently (less than once a
+     * month) would silently expire its refresh token between sessions, forcing a
+     * fresh browser OAuth tab on the next use. With a 1-year floor, only a
+     * genuinely long idle gap re-prompts. Same key / iss / aud as access tokens;
+     * the typ claim is the only thing distinguishing them, and verifyAccessToken
+     * rejects typ="refresh" so a refresh token can never be used as an access
+     * token at the /mcp resource.
+     */
+    issueRefreshToken(sub: string, expiresInSeconds?: number): Promise<string>;
+    /**
+     * Verify a JWT access token and return its payload. Throws on failure (bad
+     * signature, wrong issuer/audience, expired) — the same jose errors existing
+     * callers already catch. The verify path uses the single active algorithm,
+     * never a union. Additionally rejects tokens whose typ claim is "refresh"
+     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
+     * be replayed as an access token. Tokens with typ="access" OR a missing typ
+     * claim are accepted (the latter keeps already-issued pre-refresh-support
+     * tokens valid).
+     */
+    verifyAccessToken(token: string): Promise<jose.JWTPayload>;
+    /**
+     * Verify a JWT refresh token and return its payload. Same key / audience /
+     * issuer checks as verifyAccessToken and throws the same jose errors on
+     * failure; uses the single active algorithm. Additionally asserts
+     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
+     * an access token can never be exchanged at the refresh grant.
+     */
+    verifyRefreshToken(token: string): Promise<jose.JWTPayload>;
+}
+//# sourceMappingURL=jwt-issuer.d.ts.map

package/build/oauth/jwt-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAU5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,gBAAgB,CAAe;IACvC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;IACtB,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,YAAY,CAAQ;IAE5B,YAAY,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB,EAAE,gBAAgB,GAAE,MAAM,GAAG,IAAW,EAOjG;IAED,qFAAqF;IAC/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAc1B;YAEa,eAAe;YAYf,qBAAqB;IA6BnC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAY3C;IAED,0EAA0E;IACpE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5E;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CASjF;IAED;;;;;;;;;OASG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAW/D;IAED;;;;;;OAMG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAWhE;CACF"}