@n8r/surface 0.1.0-experimental.2 → 0.1.0-experimental.5

package/plugins/n8r-surface/skills/research/references/first-use-overview.md

@@ -0,0 +1,101 @@
+# A useful first security overview
+
+For broad initial source research, help the reader understand the application
+before explaining the saved format. Preserve a narrow question when one is given.
+This is a bounded first pass, not an exhaustive audit or vulnerability verdict.
+
+## Research and record
+
+- Explain what the application does in one plain sentence. Put this in the focus
+  component's standard `description`; name that component as the presentation
+  focus using the [optional node hints](cyclonedx.md#overview-presentation-hints).
+- Group major internal functions and external integrations only where evidence
+  establishes their placement relative to the application. A browser is not the
+  backend; a supported database option is not an installed store. Preserve shared
+  identities and paths across groups. Leave unresolved placement unclassified.
+- Record a few consequential observations as `finding` journal entries with
+  `status: done`, evidence references, and a `reason` explaining why each matters.
+  Keep the finding and its limitation together. A source-backed execution path is
+  an investigation lead, not a demonstrated vulnerability or runtime guarantee.
+  Do not promote an unsupported inference just to fill the opening.
+- Make coverage legible across **identity**, **authorization**, **data handling**,
+  **storage**, **secrets**, **exposure** and **observability**. Use named `coverage`
+  and `gap` strings, such as “Identity: supported sign-in options inspected” or
+  “Observability: runtime trace coverage not researched.” These labels describe
+  inspected work, not control effectiveness. Mark unresearched areas explicitly;
+  do not expand a first pass into seven exhaustive investigations.
+- For integrations within scope, research supported options separately from
+  intended selections, safe configuration evidence and dated runtime observations.
+  “Identity provider unknown” alone does not describe supported authentication.
+  If support was not researched, say so and identify the next useful source read.
+- Keep model-request control points distinct from actual tool execution. Preserve
+  browser-originated traffic, backend extensions and scheduled execution contexts
+  when evidenced; explain their consequences without presuming every app has them.
+
+The generated brief uses descriptions, groups, findings, coverage/gaps and open
+next steps. The generated HTML puts a connected overview before full relationships,
+source evidence and investigation history. Do not hand-edit these views instead of
+recording the relevant evidence in the BOM.
+
+## Scope once, exceptions where needed
+
+State common source/deployment limits in `scope`. Keep per-relationship conditions,
+conflicts, bypasses, selection evidence and observations intact. Use `note` for
+what is distinctive about a path instead of repeating generic deployment caveats.
+The concise brief links to full relationship details; brevity must not erase a
+consequential exception from its associated finding.
+
+## Invite the next decision
+
+Match the next step to the established investigation context:
+
+- **Source checkout only:** recommend one concrete source-level trace, naming the
+  entry point, authorization boundary and question it can answer. Keep deployment
+  settings unverified. Research can continue without a daemon, deployed instance
+  or chosen provider. Ask about intended setup only if the user wants planning.
+- **Intended setup:** record choices as dated user-basis evidence, then explain
+  what configuration evidence would establish them later.
+- **Identified deployment:** inspect only the permitted target and relevant safe
+  fields. Keep configuration and dated runtime observations separate.
+- **Context unclear:** continue useful source research; before requesting runtime
+  access, establish whether the user wants source analysis, planning or inspection
+  of an existing deployment. A checked-out Compose file identifies a declaration,
+  not a running target. An available Docker daemon is not a target identity.
+
+## Keep the successor current and the brief short
+
+Before each save, reconcile the current scope, findings, coverage, gaps and actions:
+
+1. Record new evidence with its date and applicability. Preserve old observations
+   and accepted decisions in the journal and predecessor; do not rewrite their text.
+2. Mark obsolete entries `superseded` and link a replacement with `supersedes`.
+   Mark completed actions `done`; mark out-of-scope work `deferred` with a reason.
+   For example, reachable runtime evidence supersedes an unavailable-daemon blocker
+   and completes the retry action; it does not establish a deployment's presence.
+3. Replace obsolete current scope/gap strings in the successor. Preserve their
+   historical content in dated journal entries/evidence. Do not append contradictory
+   current statements and leave the reader to determine which applies.
+4. Keep one recommended action `active`, with a clear result and access requirement.
+   Other genuinely useful choices can remain open or deferred in the journal.
+5. Read the generated brief as a newcomer. Aim for roughly 400–700 words: a short
+   current scope, major areas, a few current implications, concise coverage/gaps
+   and one next action. Consolidate overlapping findings using supersession while
+   preserving each consequential exception and its evidence. A word target never
+   justifies dropping a limitation or inventing a summary.
+
+The renderer shows at most twelve nodes, five current findings (most recently
+recorded, not severity-ranked), seven coverage items, seven gaps and one action
+(active first, otherwise recorded order). It explicitly links additional items to
+full HTML detail. Complete finding text, reasons and evidence stay together;
+long individual entries are not silently truncated. Prioritise and consolidate
+research content before saving; list limits alone do not guarantee a short brief.
+The journal and full map retain the complete record, including superseded entries.
+This skill does not configure or deploy the system.
+
+End the chat with a short statement of what the research clarified, links to the
+brief and map (journal/detail links can follow), and the next useful question.
+Keep format mechanics underneath. Explain the architecture/research BOM's bounded
+machine-readable value when relevant: it is not a comprehensive dependency SBOM;
+standard dependencies cover only the selected dependency subset. Other consumers
+may ignore the profile's paths and evidence. Conventional SBOM linkage is future
+work, not a claim made by this increment.

package/plugins/n8r-surface/skills/research/references/instance-first.md

@@ -0,0 +1,125 @@
+# Investigate an identified running composition
+
+Use this path when the user starts with an instance, service URL or deployed
+composition, or continues source research with permitted instance evidence.
+A source checkout can describe one component without describing the whole system.
+Keep source-only work on its existing path when no instance investigation is asked
+for. This guide adds no access adapter, credential store or runtime dependency.
+
+For a newcomer or an inaccessible source, use [first-use access](first-use-access.md)
+to help establish one useful source at a time. A short reported system description
+is enough to begin; a complete access setup is not an entry requirement.
+
+## Use the host harness
+
+Codex/ChatGPT supplies the tools and access; the skill supplies the investigation
+method. Discover the relevant tools actually available in this session. Prefer a
+scoped connector or documented read API, then permitted browser or shell access.
+Do not assume a tool name, a terminal, SSH, a local clone or a connected account.
+A URL identifies a source; a successful scoped read establishes access.
+
+Start with the supplied target and question. State the selected environment and
+read-only coverage, carrying forward existing authorization. Ask only for missing
+information needed to identify the target or permitted access. Do not make users
+choose evidence categories or reproduce information an available source supplies.
+
+| Source | Useful host operation | Identity and limit to retain |
+| --- | --- | --- |
+| Remote repository | Read selected files at a pinned revision through the available connector/API. | Repository, revision, file and inspected ranges; returned text may not be original file bytes. |
+| Local checkout | Read relevant files and working-copy identity. | Commit plus differences and hashes of inspected bytes; not deployed build identity. |
+| Document or URL | Read the selected page/section using its available connector or browser. | Document revision/product version, capture time and section; newer docs may not apply to the target. |
+| Instance configuration | Read safe fields from the selected instance/admin view. | Target identity, setting scope and time; stored settings may not be loaded. |
+| Runtime metadata | Filter to the target and project allowlisted fields before output. | Instance/container/process identity, image/build identity, state and capture time. |
+| Existing observations | Read a permitted redacted event/trace or supplied observation. | Request correlation, participating identities, effective setup and coverage; missing events do not prove absence. |
+
+If a source is unavailable, retain the partial graph and identify the consequence:
+for example, storage is configured but current use is unverified. A permission
+refusal is not a prompt to bypass that route. Ask for an authorized source or
+human-supplied redacted evidence when needed. Do not sign in for the user, extract
+sessions, install tools or start services to fill the gap. Follow the discovery
+guide's [live inspection rules](discovery-map.md#inspect-live-connections-with-the-human).
+
+## Follow the composition
+
+Begin with the selected instance's identity and entry point, then follow evidence
+of relevant connections. An endpoint binding can lead to a separate gateway,
+inference provider, identity service, storage or telemetry destination. Determine
+its role before deciding which source file, document or live view to read next.
+Do not replace a custom endpoint with a familiar vendor because its protocol is
+compatible. Do not add roadmap components or enumerate unrelated host resources.
+
+Use repositories and operational documents to explain those discovered components.
+An old deployment recipe is a navigation clue until current evidence supports it.
+Match product documentation to the installed version; mismatches remain visible.
+Record supported alternatives separately from the selected instance paths.
+
+For each consequential claim, keep the evidence level precise:
+
+- Source describes support or a code path; it does not establish selection.
+- A safe binding establishes configured selection, with its setting scope.
+- Process/container state establishes presence at a time, not connection use.
+- A response establishes reachability for that operation and vantage point.
+- A correlated request/trace can establish the exercised portion of a path,
+  within its identity, time and coverage limits.
+
+A mounted file hash identifies inspected bytes, not necessarily the bytes loaded
+by a running process. A model name in configuration is not catalog availability
+or inference. A health response does not exercise storage, authentication or
+model requests. Similarly named fields in public config and process environment
+may have different meanings: inspect their version-specific implementation before
+calling them equivalent or conflicting. Keep separate login, application actor,
+provider credential and upstream identity boundaries when evidence supports them.
+
+Read-only means the operation's behavior, not its HTTP verb. A diagnostic GET
+may start a worker, refresh credentials or run a connection test. Use known passive
+operations or existing evidence; leave uncertain operations uncalled. Research
+does not send prompts or invoke tools to make an edge observable. Those are
+separately authorized testing tasks.
+
+## Retain evidence and continue
+
+Keep the journal current while working when saving is authorized. State what was
+read, what it established and the next useful question; the user can redirect or
+stop at a useful partial result. Save through the existing [Surface helper](cyclonedx.md).
+No special whole-Surface observed state is needed: use per-relationship evidence
+and dated observations, with unknown composition and explicit coverage/gaps.
+
+Keep source identity distinct from captured evidence identity. If a connector
+returns rendered or normalized text, hash a retained safe projection only as that
+projection, not as the original remote file. Never fabricate unavailable hashes,
+versions or observation times. Preserve actual source capture times separately
+from the time the BOM was saved. Do not add transport newlines before hashing
+source bytes. See [evidence identity](cyclonedx.md#evidence-identity-and-readback).
+
+On revisit, read the supplied predecessor, re-establish permitted access and
+compare equivalent observations for the same target. Explain each material result
+in ordinary language:
+
+- **Target change:** comparable evidence establishes a changed setting/build or
+  relationship. Say which prior conclusions or tests may need revisiting.
+- **Newly learned fact:** previously unread evidence adds detail; discovery time
+  alone does not establish when the target changed.
+- **Unchanged checked fact:** the same scoped fact was checked again, at a new
+  time; do not generalize to unchecked parts of the system.
+- **Lost coverage:** access or evidence is missing now; retain prior dated facts
+  without presenting them as freshly verified or treating the component as removed.
+- **Conflict:** evidence disagrees or identities are inconsistent; preserve both
+  and name the evidence needed to resolve it. A mutable image tag is not a digest.
+
+These are explanations, not new schema enums. Retain stable component identities,
+previous bytes, decisions and observations. Update current scope/gaps and next
+steps; keep old findings in history. A telemetry setting first read today may
+predate the baseline, and a file timestamp alone does not prove historical use.
+
+When consolidating earlier findings into a current journal summary, carry the
+original evidence IDs for every retained configuration/source claim. A new
+runtime-state check supports only its inspected facts; it cannot substitute for
+those sources. Open the summary's evidence links during readback and check each
+claim, even when the underlying graph still has correct provenance. Correct an
+incomplete saved summary in a successor, preserving the earlier revision.
+
+Finish with the useful composition, consequential uncertainties and one practical
+next investigation with its access requirement. Independently read back the saved
+BOM and generated brief/map/journal. Check that the key claims remain distinguishable
+without this chat and that referenced retained evidence is locatable. State any
+host persistence or navigation limitation rather than claiming a missing save.

package/plugins/n8r-surface/skills/research/references/working-notes.md

@@ -7,7 +7,12 @@ retain the same evidence and limitations. Do not impose a large empty template.
 
 ## Where notes live
 
-Use a user-selected destination first. When an applicable vault convention places
+Use a user-selected destination first. For work explicitly scoped to a recognized
+Surface workspace, keep new notes under `research/<source-slug>/` within that
+workspace, creating directories only on an authorized save. Do not redirect that
+work to a global vault or the default below. When continuing a supplied note,
+retain its folder unless the user asks to move it. Workspace setup itself creates
+no notes or content directories. When an applicable vault convention places
 Surface descriptions under `surfaces/<source-slug>/`, propose a numbered file
 such as `surface-draft-001.md` there. A save offer does not create directories or
 files; wait for acceptance. Without that convention, use the default below for

package/plugins/n8r-surface/skills/research/references/workspace.md

@@ -0,0 +1,89 @@
+# Workspace operations
+
+Use this mode for setup, repeated setup, readiness and fresh-chat recognition.
+A workspace is a user-owned folder, independent of a vault, source checkout,
+Lab or app project. The only initial file is `.n8r/workspace.json`.
+
+If the user means starting research in a web Project rather than creating a local
+folder, use [first-use access](first-use-access.md) and begin from supplied sources.
+If explicit local setup is requested but the host cannot access a persistent local
+filesystem or supported Node runtime, report that operation blocked. Keep useful
+source research available; do not ask for a laptop path the host cannot access.
+
+## Run the shared helper
+
+Requires a local persistent filesystem and Node.js 22, 24 or 26 on macOS/Linux.
+Use the helper **from this installed skill**, resolving its absolute path relative
+to this reference, not from a developer checkout. Invoke it through `node`:
+
+```sh
+node /installed/skill/scripts/workspace.mjs inspect /selected/workspace
+node /installed/skill/scripts/workspace.mjs setup /selected/workspace --purpose 'Investigate LibreChat'
+```
+
+The paths above are placeholders. Quote actual paths and supplied text safely;
+never interpolate untrusted metadata into shell code. `inspect` only reads.
+`setup` requires the user's explicit setup request. Supply `--name` only if the
+user supplied a display name; otherwise the folder name is used. Supply a brief
+nonsecret `--purpose` from the stated intent when available; it is optional.
+Do not put credentials, private bindings or absolute source paths in metadata.
+No naming/schema questionnaire is needed. Ask for a destination only when the
+user's selected/current folder cannot be established.
+
+If Node, the helper, local access or persistent storage is unavailable, explain
+that blocker and the concrete prerequisite. Do not install a runtime, recreate
+the helper's filesystem logic by hand, or claim a download is a local workspace.
+A host without shell/local persistence cannot perform this workspace operation.
+The standalone research CLI and Labs do not yet expose this capability.
+
+## Interpret the result
+
+The helper prints one JSON object with `status`, `message`, absolute `directory`
+when available, and `record` for a supported workspace. Exit 0 means created or
+recognized; exit 3 means missing, empty or awaiting a destination choice; exit 2
+means invalid input, malformed/unsupported metadata, conflict or I/O failure.
+These are helper results, not permission to expand the task.
+
+- `created`: report the actual location and a useful next research action. The
+  helper has read back the complete record. No research has started.
+- `recognized`: reuse the saved ID, name and optional purpose without rewriting
+  or asking again. Report readiness for research, not proof of prior research or
+  a configured target. For a readiness question, offer a next action based on
+  saved purpose or relevant existing notes without starting it. Read notes only
+  as needed; do not infer findings from metadata or generic filenames.
+- `missing` / `empty`: inspection found no workspace. Explain this; recognition
+  alone does not authorize creation. An explicit setup request can call `setup`.
+- `needs-choice`: explain that files already exist and ask “Initialize here, or
+  use another folder?” Make no writes before the choice. Only an explicit
+  initialize-here choice permits `setup PATH --adopt` (with supplied name/purpose).
+  If another folder is chosen, run normal setup there without `--adopt`.
+- `malformed` / `unsupported` / `conflict`: explain the helper's specific reason
+  and offer another destination or separately requested repair assessment. Make
+  no changes; no automatic migration, downgrade, replacement or cleanup.
+- `invalid-input` / `io-error`: report the specific limitation; do not claim
+  success. An interrupted operation may leave metadata staging files. Inspect
+  read-only if needed; repair is separate and never implied by a retry.
+
+For recognized/created results, identify the saved format and stable ID without
+requiring the user to understand their encoding. Keep the interaction short.
+Filesystem creation does not attach the folder to an app project. Say attachment
+is separate; only claim it if a supported host action actually occurred. Setup
+does not require attachment, Git, credentials, global settings or a vault.
+Do not create README, AGENTS.md, `.gitkeep`, models or content directories during
+setup. Research remains a separate requested action.
+
+## Shared metadata meaning
+
+`n8r.workspace/1` is independent of plugin and AI Surface Model versions. The
+helper validates a JSON object with that exact `format`, generated UUID v4 `id`,
+nonempty text `name`, and optional text `purpose`. Unknown fields are preserved
+and confer no capabilities. The ID survives setup repetition, rename, move and
+fresh sessions. Invalid JSON/required fields are malformed; a different format
+token is unsupported. Recognition is always read-only, never repair.
+
+The bundled `scripts/workspace.mjs` exports `validateWorkspace`,
+`inspectWorkspace` and `setupWorkspace` for future consumers. It owns the
+filesystem decisions; do not fork them into host-specific implementations.
+It publishes complete metadata without overwriting a target. Interrupted staging
+is never accepted as a valid record. Concurrent writers, adversarial filesystem
+mutation, migration and power-loss durability are not supported guarantees.

package/plugins/n8r-surface/skills/research/scripts/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,273 @@
+Bundled third-party code and schemas
+
+CycloneDX 1.7 schemas: OWASP Foundation / CycloneDX contributors, Apache-2.0.
+Source commit 4b3f59453366e27c8073fd24e98bf21ef8892c8e. See bundled LICENSE for Apache-2.0 terms.
+
+ajv 8.20.0 (MIT)
+The MIT License (MIT)
+
+Copyright (c) 2015-2021 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+
+ajv-formats 3.0.1 (MIT)
+MIT License
+
+Copyright (c) 2020 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+ajv-formats-draft2019 1.6.1 (MIT)
+MIT License
+
+Copyright (c) 2020 Carlo Q
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+extend 3.0.2 (MIT)
+The MIT License (MIT)
+
+Copyright (c) 2014 Stefan Thomas
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+
+fast-deep-equal 3.1.3 (MIT)
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+fast-uri 3.1.9 (BSD-3-Clause)
+Copyright (c) 2011-2021, Gary Court until https://github.com/garycourt/uri-js/commit/a1acf730b4bba3f1097c9f52e7d9d3aba8cdcaae
+Copyright (c) 2021-present The Fastify team <https://github.com/fastify/fastify#team>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * The names of any contributors may not be used to endorse or promote
+      products derived from this software without specific prior written
+      permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+                                  *   *   *
+
+The complete list of contributors can be found at:
+- https://github.com/garycourt/uri-js/graphs/contributors
+
+json-schema-traverse 1.0.0 (MIT)
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+nearley 2.20.1 (MIT)
+The MIT License (MIT)
+
+Copyright (c) 2014, 2015, 2016, 2017, 2018, 2019 Kartik Chandra, Tim Radvan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+schemes 1.4.0 (MIT)
+
+(The MIT License)
+
+Copyright (c) 2015 Peter Müller <munter@fumle.dk>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+smtp-address-parser 1.1.1 (MIT)
+MIT License
+
+Copyright (c) 2021 Gene Hightower
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+uri-js 4.4.1 (BSD-2-Clause)
+Copyright 2011 Gary Court. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1.	Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2.	Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY GARY COURT "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GARY COURT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those of the authors and should not be interpreted as representing official policies, either expressed or implied, of Gary Court.
+
+
+yaml 2.9.1 (ISC)
+Copyright Eemeli Aro <eemeli@gmail.com>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.