@n24q02m/hull 0.0.0-stage → 0.4.0-beta.9

package/build/token-auth/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/token-auth/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,6EAA6E;AAC7E,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,YAAW;IAExB,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CACjC;AAED,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAqED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAiB9D;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAKrH;AA2BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtE"}

package/build/token-auth/users.js

@@ -0,0 +1,174 @@
+/**
+ * users.toml: the multi-user token table (auth mode `multi`).
+ *
+ * Same schema and validation order as core-py `hull_core.auth.users`:
+ *
+ *     [users.<uid>]
+ *     token_hash = "scrypt$..."        # mint with `hull token hash`
+ *     enabled = true
+ *     namespace = "<uid-or-shared>"    # data isolation root
+ *     allowed_roots = ["/data/alice"]  # filesystem roots tools may touch
+ *     [users.<uid>.limits]
+ *     rpm = 60                         # optional per-minute request cap
+ *
+ * Admin is host-side only: edit the file, restart the server. There is no
+ * admin API and no self-service.
+ */
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { basename, dirname, join, resolve, sep } from 'node:path';
+import { parse, TomlError } from 'smol-toml';
+import { pyRepr } from './py-compat.js';
+import { isValidTokenHash, verifyToken } from './tokens.js';
+/** Raised when users.toml is missing, malformed, or semantically invalid. */
+export class UsersError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'UsersError';
+    }
+}
+/** Raised by `ensurePathAllowed` (core-py raises `PermissionError`). */
+export class PathNotAllowedError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'EACCES';
+        this.name = 'PathNotAllowedError';
+    }
+}
+function isTable(value) {
+    // TOML tables parse to plain (null-prototype) objects; arrays and
+    // TomlDate values are excluded by their tags.
+    return Object.prototype.toString.call(value) === '[object Object]';
+}
+function readTomlText(path) {
+    let isFile = false;
+    try {
+        isFile = statSync(path).isFile();
+    }
+    catch {
+        isFile = false;
+    }
+    if (!isFile)
+        throw new UsersError(`users file not found: ${path}`);
+    const bytes = readFileSync(path);
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch (err) {
+        throw new UsersError(`users file is not valid UTF-8: ${path}`, { cause: err });
+    }
+}
+function field(entry, key, fallback) {
+    return Object.hasOwn(entry, key) ? entry[key] : fallback;
+}
+function parseUser(uid, entry) {
+    const who = `user ${pyRepr(uid)}`;
+    if (!isTable(entry))
+        throw new UsersError(`${who}: expected a table`);
+    const tokenHash = field(entry, 'token_hash', undefined);
+    if (typeof tokenHash !== 'string' || !isValidTokenHash(tokenHash)) {
+        throw new UsersError(`${who}: token_hash missing or not a scrypt encoding (mint one with \`hull token hash\`)`);
+    }
+    const namespace = field(entry, 'namespace', undefined);
+    if (typeof namespace !== 'string' || namespace.length === 0) {
+        throw new UsersError(`${who}: namespace must be a non-empty string`);
+    }
+    const enabled = field(entry, 'enabled', true);
+    if (typeof enabled !== 'boolean')
+        throw new UsersError(`${who}: enabled must be a boolean`);
+    const roots = field(entry, 'allowed_roots', []);
+    if (!Array.isArray(roots) || !roots.every((r) => typeof r === 'string')) {
+        throw new UsersError(`${who}: allowed_roots must be a list of strings`);
+    }
+    const limits = field(entry, 'limits', {});
+    if (!isTable(limits))
+        throw new UsersError(`${who}: limits must be a table`);
+    const rpmRaw = field(limits, 'rpm', undefined);
+    let rpm = null;
+    if (rpmRaw !== undefined) {
+        if (typeof rpmRaw !== 'bigint' || rpmRaw < 1n) {
+            throw new UsersError(`${who}: limits.rpm must be a positive integer`);
+        }
+        rpm = Number(rpmRaw);
+    }
+    return Object.freeze({
+        uid,
+        tokenHash,
+        enabled,
+        namespace,
+        allowedRoots: Object.freeze([...roots]),
+        limits: Object.freeze({ rpm })
+    });
+}
+/**
+ * Parse and validate users.toml into a `uid -> TokenUser` map.
+ *
+ * Synchronous on purpose: it runs once at server build time, and each
+ * `token_hash` is checked with one full scrypt derivation (like core-py
+ * `is_valid_encoding`) so an unusable row fails the boot, not a request.
+ */
+export function loadUsers(path) {
+    const text = readTomlText(path);
+    let raw;
+    try {
+        raw = parse(text, { integersAsBigInt: true });
+    }
+    catch (err) {
+        const reason = err instanceof TomlError ? err.message : String(err);
+        throw new UsersError(`users file is not valid TOML: ${path}: ${reason}`, { cause: err });
+    }
+    const table = field(raw, 'users', undefined);
+    if (!isTable(table) || Object.keys(table).length === 0) {
+        throw new UsersError('users file must contain a non-empty [users] table');
+    }
+    const users = new Map();
+    for (const [uid, entry] of Object.entries(table))
+        users.set(uid, parseUser(uid, entry));
+    return users;
+}
+/** Return the first user whose `tokenHash` verifies `token`, else `null`. */
+export async function findUserByToken(users, token) {
+    for (const user of users.values()) {
+        if (await verifyToken(token, user.tokenHash))
+            return user;
+    }
+    return null;
+}
+// Python `Path.resolve()` (non-strict): absolutize, follow symlinks as far
+// as the path exists, keep the non-existent tail lexically.
+function resolveLoose(target) {
+    const absolute = resolve(target);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch {
+        const parent = dirname(absolute);
+        if (parent === absolute)
+            return absolute;
+        return join(resolveLoose(parent), basename(absolute));
+    }
+}
+function comparable(p) {
+    return process.platform === 'win32' ? p.toLowerCase() : p;
+}
+function isWithin(resolved, root) {
+    const target = comparable(resolved);
+    const base = comparable(root);
+    if (target === base)
+        return true;
+    const prefix = base.endsWith(sep) ? base : base + sep;
+    return target.startsWith(prefix);
+}
+/**
+ * Enforce the caller's `allowedRoots`. An empty list grants nothing. Both
+ * sides are resolved first, so a symlinked escape needs its resolved target
+ * to sit under a root too. Throws `PathNotAllowedError` on denial.
+ */
+export function ensurePathAllowed(scope, path) {
+    const resolved = resolveLoose(path);
+    for (const root of scope.allowedRoots) {
+        if (isWithin(resolved, resolveLoose(root)))
+            return;
+    }
+    throw new PathNotAllowedError(`path ${resolved} is outside allowed roots for user ${pyRepr(scope.uid)}`);
+}
+//# sourceMappingURL=users.js.map

package/build/token-auth/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/token-auth/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE3D,6EAA6E;AAC7E,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;IAC1B,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QAHP,SAAI,GAAG,QAAQ,CAAA;QAItB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAyBD,SAAS,OAAO,CAAC,KAAc;IAC7B,kEAAkE;IAClE,8CAA8C;IAC9C,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,iBAAiB,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAA;IAChB,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,kCAAkC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAChF,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB,EAAE,GAAW,EAAE,QAAiB;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,KAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAA;IAErE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAA;IACvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,mFAAmF,CAAC,CAAA;IACjH,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;IACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,wCAAwC,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IAC7C,IAAI,OAAO,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,6BAA6B,CAAC,CAAA;IAE3F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,2CAA2C,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,0BAA0B,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAC9C,IAAI,GAAG,GAAkB,IAAI,CAAA;IAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,yCAAyC,CAAC,CAAA;QACvE,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG;QACH,SAAS;QACT,OAAO;QACP,SAAS;QACT,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAI,KAAkB,CAAC,CAAC;QACrD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;KAC/B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAe,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnE,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAAC,mDAAmD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IACvF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAqC,EAAE,KAAa;IACxF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;IAC3D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2EAA2E;AAC3E,4DAA4D;AAC5D,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAChC,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;QACxC,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAY;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAA;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,IAAY;IAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAAE,OAAM;IACpD,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,QAAQ,QAAQ,sCAAsC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAC1G,CAAC"}

package/build/transport/cache.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Tools-list cache with version-aware key (D10) — TS parity with core-py.
+ *
+ * Cache filename: ``<server>-<port>-<srvVersion>-<coreVersion>.tools.json``.
+ * A mismatch on either ``srvVersion`` (the upstream MCP server's version) or
+ * ``coreVersion`` (mcp-core itself) invalidates the cache, so an upgrade on
+ * either side never serves a stale tool surface.
+ *
+ * ``persistToolsCache`` writes via ``.tmp`` + ``rename`` (Windows-safe) and
+ * suppresses all filesystem errors with a debug log. This is the D10
+ * root-cause fix for ``Failed to persist capabilities cache`` hard-failures
+ * (crg #384).
+ */
+export declare function cacheDir(): string;
+export declare function cacheFilename(serverName: string, port: number, srvVersion: string, coreVersion: string): string;
+export declare function atomicWrite(path: string, content: string): void;
+export declare function persistToolsCache(serverName: string, port: number, srvVersion: string, coreVersion: string, tools: unknown[]): void;
+export declare function loadToolsCache(serverName: string, port: number, srvVersion: string, coreVersion: string): unknown[] | null;
+//# sourceMappingURL=cache.d.ts.map

package/build/transport/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/transport/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAK/G;AAOD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAgB/D;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EAAE,GACf,IAAI,CASN;AAED,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,EAAE,GAAG,IAAI,CAUlB"}

package/build/transport/cache.js

@@ -0,0 +1,76 @@
+/**
+ * Tools-list cache with version-aware key (D10) — TS parity with core-py.
+ *
+ * Cache filename: ``<server>-<port>-<srvVersion>-<coreVersion>.tools.json``.
+ * A mismatch on either ``srvVersion`` (the upstream MCP server's version) or
+ * ``coreVersion`` (mcp-core itself) invalidates the cache, so an upgrade on
+ * either side never serves a stale tool surface.
+ *
+ * ``persistToolsCache`` writes via ``.tmp`` + ``rename`` (Windows-safe) and
+ * suppresses all filesystem errors with a debug log. This is the D10
+ * root-cause fix for ``Failed to persist capabilities cache`` hard-failures
+ * (crg #384).
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+// Self-namespace import lets ``vi.spyOn(cacheModule, 'cacheDir' | 'atomicWrite')``
+// intercept internal calls (ESM bindings make plain references unmockable).
+import * as self from './cache.js';
+export function cacheDir() {
+    return join(homedir(), '.config', 'mcp', 'cache');
+}
+export function cacheFilename(serverName, port, srvVersion, coreVersion) {
+    const safeName = serverName.replace(/[^a-zA-Z0-9.-]/g, '_').replace(/\.\./g, '__');
+    const safeSrvVersion = srvVersion.replace(/[^a-zA-Z0-9.-]/g, '_').replace(/\.\./g, '__');
+    const safeCoreVersion = coreVersion.replace(/[^a-zA-Z0-9.-]/g, '_').replace(/\.\./g, '__');
+    return `${safeName}-${port}-${safeSrvVersion}-${safeCoreVersion}.tools.json`;
+}
+// Cache directories already chmod-tightened in this process. The directory is
+// still re-created if missing (OS cleanup), but chmod runs once per directory
+// so a pre-existing overly-permissive directory is tightened without paying
+// the syscall on every hot-path write (TOCTOU hardening).
+const initDirs = new Set();
+export function atomicWrite(path, content) {
+    const dir = dirname(path);
+    if (dir) {
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        if (!initDirs.has(dir)) {
+            if (process.platform !== 'win32') {
+                chmodSync(dir, 0o700);
+            }
+            initDirs.add(dir);
+        }
+    }
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, content, { encoding: 'utf-8', mode: 0o600 });
+    renameSync(tmp, path);
+}
+export function persistToolsCache(serverName, port, srvVersion, coreVersion, tools) {
+    const path = join(self.cacheDir(), cacheFilename(serverName, port, srvVersion, coreVersion));
+    const payload = JSON.stringify({ tools, srv_version: srvVersion, core_version: coreVersion });
+    try {
+        self.atomicWrite(path, payload);
+    }
+    catch (err) {
+        // Suppress per D10 — log only.
+        console.debug('Failed to persist capabilities cache for %s: %s', serverName, err);
+    }
+}
+export function loadToolsCache(serverName, port, srvVersion, coreVersion) {
+    const path = join(self.cacheDir(), cacheFilename(serverName, port, srvVersion, coreVersion));
+    if (!existsSync(path))
+        return null;
+    try {
+        const payload = JSON.parse(readFileSync(path, 'utf-8'));
+        if (payload.srv_version !== srvVersion || payload.core_version !== coreVersion)
+            return null;
+        return Array.isArray(payload.tools) ? payload.tools : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/build/transport/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/transport/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,mFAAmF;AACnF,4EAA4E;AAC5E,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAElC,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAY,EAAE,UAAkB,EAAE,WAAmB;IACrG,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAClF,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACxF,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1F,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,cAAc,IAAI,eAAe,aAAa,CAAA;AAC9E,CAAC;AACD,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;AAElC,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACvB,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAA;IACzB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAAY,EACZ,UAAkB,EAClB,WAAmB,EACnB,KAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7F,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+BAA+B;QAC/B,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,IAAY,EACZ,UAAkB,EAClB,WAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;IAC5F,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACvD,IAAI,OAAO,CAAC,WAAW,KAAK,UAAU,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/build/transport/index.d.ts

@@ -0,0 +1,5 @@
+export type { HttpAuthConfig } from '../token-auth/authenticator.js';
+export { type HttpRoute, type HttpServerHandle, type JWTClaims, type RunHttpServerOptions, runHttpServer } from './local-server.js';
+export { type AuthenticatedRequest, OAuthMiddleware, type OAuthMiddlewareOptions } from './oauth-middleware.js';
+export { StreamableHTTPServer, type StreamableHTTPServerOptions } from './streamable-http.js';
+//# sourceMappingURL=index.d.ts.map

package/build/transport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,EACL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,aAAa,EACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,KAAK,oBAAoB,EACzB,eAAe,EACf,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAA"}

package/build/transport/index.js

@@ -0,0 +1,4 @@
+export { runHttpServer } from './local-server.js';
+export { OAuthMiddleware } from './oauth-middleware.js';
+export { StreamableHTTPServer } from './streamable-http.js';
+//# sourceMappingURL=index.js.map

package/build/transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,aAAa,EACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,eAAe,EAEhB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,oBAAoB,EAErB,MAAM,sBAAsB,CAAA"}

package/build/transport/local-server.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Local MCP server entry point combining OAuth 2.1 AS + Streamable HTTP transport.
+ *
+ * Composes:
+ *  1. OAuth 2.1 AS (credential form + token exchange) -- serves /authorize,
+ *     /token, /otp, /setup-status, /.well-known/*
+ *  2. MCP Streamable HTTP transport -- serves /mcp with optional Bearer auth
+ *  3. /health endpoint -- liveness probe
+ *
+ * For servers without credential input (e.g. godot) ``relaySchema`` may be
+ * omitted: only /mcp (unauthenticated) and /health are served.
+ *
+ * This is a TypeScript port of ``core-py``'s ``local_server.py``. Route layout,
+ * Bearer enforcement, and lifecycle semantics are kept identical.
+ */
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { JWTPayload } from 'jose';
+import type { RelayConfigSchema } from '../auth/credential-form.js';
+import { type DelegatedOAuthAppOptions } from '../auth/delegated-oauth-app.js';
+import { type CredentialsCallback, type StepCallback } from '../auth/local-oauth-app.js';
+import type { JWTIssuer } from '../oauth/jwt-issuer.js';
+import { type HttpAuthConfig } from '../token-auth/authenticator.js';
+/** Decoded JWT claims returned by JWTIssuer.verifyAccessToken. */
+export type JWTClaims = JWTPayload & {
+    anonymous?: boolean;
+};
+/**
+ * A route a consumer registers on the same port ``runHttpServer`` serves.
+ *
+ * The built-in ``/mcp`` and ``/health`` routes are matched FIRST and cannot be
+ * overridden -- a consumer cannot accidentally shadow the MCP transport or the
+ * liveness probe. Everything else is tried against ``extraRoutes`` before the
+ * OAuth app, which is a catch-all for the remaining paths.
+ */
+export interface HttpRoute {
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    path: string;
+    handler: (req: IncomingMessage, res: ServerResponse) => Promise<void> | void;
+}
+export interface RunHttpServerOptions {
+    /** Identifier used for JWT iss/aud and credential storage. */
+    serverName: string;
+    /** If undefined, server has NO auth (e.g., godot). */
+    relaySchema?: RelayConfigSchema;
+    /** Optional pre-created issuer, primarily for isolated tests and custom key storage. */
+    jwtIssuer?: JWTIssuer;
+    /**
+     * Mutually exclusive with `relaySchema`. When set, the OAuth app is the
+     * delegated provider (upstream redirect or device_code) instead of the local
+     * credential form. The `serverName` and `jwtIssuer` are supplied by this
+     * function; callers provide only `flow`, `upstream`, and `onTokenReceived`.
+     */
+    delegatedOAuth?: Omit<DelegatedOAuthAppOptions, 'serverName' | 'jwtIssuer'>;
+    /** 0 = auto-find a free port. Default: 0. */
+    port?: number;
+    /** Host to bind. Default '127.0.0.1'. */
+    host?: string;
+    /** Optional callback invoked with credentials after POST /authorize. */
+    onCredentialsSaved?: CredentialsCallback;
+    /** Optional callback invoked with step data after POST /otp. */
+    onStepSubmitted?: StepCallback;
+    /**
+     * Called after server ready so callers can wire background tasks (e.g.
+     * GDrive device code poll) to the form's ``/setup-status`` endpoint.
+     *
+     * Accepts either arity for backward compatibility:
+     *  - Legacy 1-arg: ``hook(markComplete)`` -- success-only (older consumers).
+     *  - New 2-arg:    ``hook(markComplete, markFailed)`` -- surfaces upstream
+     *    errors (``invalid_grant`` / ``expired_token`` / ``access_denied``)
+     *    to the browser form so it stops polling and shows the error.
+     *
+     * Prefer the 2-arg form for new code. Arity is detected via
+     * ``Function.prototype.length``.
+     */
+    setupCompleteHook?: ((markComplete: (key?: string) => void) => void) | ((markComplete: (key?: string) => void, markFailed: (key?: string, error?: string) => void) => void);
+    /**
+     * Optional renderer used in place of the default credential form on GET
+     * /authorize. Passed through to ``createLocalOAuthApp``.
+     */
+    customCredentialFormHtml?: (schema: RelayConfigSchema, options: {
+        submitUrl: string;
+        prefill?: Record<string, string>;
+    }) => string;
+    /** Forwarded to the local OAuth app; see LocalOAuthAppOptions.stableSubEnabled. */
+    stableSubEnabled?: boolean;
+    /**
+     * Optional middleware invoked after JWT verification and before the MCP
+     * transport handles the request. Called with verified claims and a ``next``
+     * function that invokes the MCP transport. Consumers use this to wrap the
+     * request in AsyncLocalStorage (e.g., for per-user token lookup).
+     */
+    authScope?: (claims: JWTClaims, next: () => Promise<void>) => Promise<void>;
+    /**
+     * When `true`, skip Bearer token validation on the MCP endpoint and treat
+     * the caller as anonymous. Intended for deployments behind an external
+     * auth boundary (reverse proxy, API gateway like agentgateway/Zitadel) that
+     * already enforces authentication. The deployer is responsible for ensuring
+     * the network in front of this server is locked down — anyone who can
+     * reach `/mcp` directly will get tool access.
+     *
+     * Wire via env var: `authDisabled: process.env.MCP_AUTH_DISABLE === '1'`.
+     *
+     * When set, `authScope` (if provided) receives anonymous claims
+     * `{ sub: 'anonymous', anonymous: true }`.
+     */
+    authDisabled?: boolean;
+    /**
+     * Whether to auto-open the setup URL in the user's browser when the stored
+     * config is not yet complete. Default ``true`` -- first-run setup for the
+     * servers built on this function depends on it.
+     *
+     * Set ``false`` when the consumer already hands the setup URL to the user by
+     * another route (a tool-call result, a log line, its own UI). Otherwise there
+     * are two entry points into the SAME temporary server, so the user starts two
+     * consent flows: whichever finishes first resolves the flow and closes the
+     * server, and the other tab's redirect then lands on a dead port
+     * (ERR_CONNECTION_REFUSED). The user is left with one "Setup complete" page
+     * and one connection error, unable to tell which one counted.
+     */
+    openBrowser?: boolean;
+    /**
+     * Extra HTTP routes served on the same port, matched by exact pathname and
+     * method. Tried after ``/mcp`` and ``/health`` (which always win) and before
+     * the OAuth app, whose handler is a catch-all for every other path -- so a
+     * route registered here is the only way for a consumer to own an endpoint
+     * inside this process. Used by servers that need their own OAuth callback,
+     * e.g. adding a second upstream account to an already-authenticated subject.
+     */
+    extraRoutes?: HttpRoute[];
+    /**
+     * Token-table HTTP auth, the core-py `[server] auth` modes:
+     *
+     *  - `{ mode: 'no-auth' }` -- no Authorization header; every request runs as
+     *    `localAuthContext()`. Refuses (throws `ServerConfigError`) any `host`
+     *    that is not loopback.
+     *  - `{ mode: 'token', tokenHash, rpm? }` -- one shared bearer token checked
+     *    against a `scrypt$...` hash; caller `uid` is `"shared"`.
+     *  - `{ mode: 'multi', usersFile?, users? }` -- users.toml table (default
+     *    `~/.hull/users.toml`); 401 wrong token, 403 disabled user, 429 over the
+     *    user's `limits.rpm`.
+     *
+     * The guard runs before routing for every path except `/health` (so `/mcp`
+     * and `extraRoutes` both see the caller via `currentUser()`), and rejects
+     * with core-py's JSON body and `WWW-Authenticate: Bearer` on 401. The config
+     * is validated before the port is bound. Mutually exclusive with the
+     * OAuth/relay options (`relaySchema`, `delegatedOAuth`, `jwtIssuer`,
+     * `authDisabled`, `authScope`).
+     */
+    auth?: HttpAuthConfig;
+}
+export interface HttpServerHandle {
+    /** Actual TCP port bound. Non-zero even when ``options.port`` was 0. */
+    port: number;
+    /** Host bound. */
+    host: string;
+    /** Cleanly close transport + http server. */
+    close: () => Promise<void>;
+}
+/**
+ * Start an HTTP server with optional local OAuth AS + MCP Streamable HTTP transport.
+ *
+ * Behavior:
+ *  - If ``relaySchema`` is provided, serves OAuth routes (/authorize, /token,
+ *    /otp, /setup-status, /.well-known/*) AND /mcp with Bearer auth.
+ *  - If ``relaySchema`` is undefined (e.g., godot), serves ONLY /mcp without
+ *    auth (plus /health).
+ *  - Binds to ``host:port``. Port 0 auto-assigns via the OS.
+ *  - Returns a handle for lifecycle management; the server runs in the
+ *    background until ``close()`` is called.
+ */
+export declare function runHttpServer(serverFactory: () => McpServer, options: RunHttpServerOptions): Promise<HttpServerHandle>;
+//# sourceMappingURL=local-server.d.ts.map

package/build/transport/local-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.d.ts","sourceRoot":"","sources":["../../src/transport/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAgB,KAAK,eAAe,EAAe,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAKhG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAEnE,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,KAAK,mBAAmB,EAGxB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGvD,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAKnF,kEAAkE;AAClE,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAA;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC7E;AAED,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,WAAW,CAAC,CAAA;IAC3E,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gEAAgE;IAChE,eAAe,CAAC,EAAE,YAAY,CAAA;IAC9B;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EACd,CAAC,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAC,GAChD,CAAC,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAC,CAAA;IACxG;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CACzB,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC7D,MAAM,CAAA;IACX,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3E;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,SAAS,EAAE,CAAA;IACzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,EAAE,cAAc,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,6CAA6C;IAC7C,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,SAAS,EAC9B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CA0b3B"}