@ni-c/mcp-hub 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -7,6 +7,394 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.0] - 2026-09-03
+
+### Added
+
+- **The meta-tools answer in both channels.** Five of the six now declare an
+  `outputSchema` and return the same object as `structuredContent` as well as
+  the JSON text block they always returned. A client that wants to *use* the
+  answer no longer has to parse a string and hope; one that wants to read it
+  still gets the text, because the SDK does not synthesize a text block for an
+  object-shaped value and dropping it would have left older clients with
+  nothing.
+
+  `list_servers` and `list_tools` therefore answer with `{"servers": […]}` and
+  `{"tools": […]}` rather than a bare array. That is the breaking part of this
+  change, and it is not cosmetic: the 2025 wire cannot carry a non-object
+  `structuredContent`, so the SDK wraps one in `{"result": …}` — and an
+  array-rooted answer would let a client tell from the payload which protocol
+  revision it had been given. The hub's promise is that it cannot. There is a
+  test comparing both eras field for field.
+
+  `call_tool` is the one without a schema. It returns the child's own result,
+  and a schema of the hub's would only be honest if the hub wrapped somebody
+  else's payload — which would break the passthrough the era matrix pins across
+  all four client/child combinations.
+
+- **`get_tool_schema` hands on the child's `outputSchema`.** This is the gap the
+  rest of the work uncovered. `call_tool` has always returned a child's
+  `structuredContent` verbatim, but the schema to validate it against was
+  dropped on the way out of `/hub`, so an aggregate client received structured
+  data it had no way to check — while `hub-tools.md` claimed structured content
+  "passes through". Half of it did.
+
+  `list_tools` marks such a tool with `hasOutputSchema: true` rather than
+  inlining the schema, so a large server's list stays a list. Both follow the
+  rule `annotations` already followed: the child's own document, verbatim, and
+  the key absent when it declared none.
+
+- **`list_tools` and `get_tool_schema` carry a child's tool annotations
+  through.** Over `/hub` a client never sees the child's own `tools/list`, so
+  those two answers are the only place it can learn that one of two similarly
+  named tools deletes and the other does not. They came back as name plus
+  description, which left every tool looking identical at exactly the moment a
+  model decides which to call. The proxy endpoint `/<name>/mcp` was already
+  correct; there is a test for it now too, because "already correct" is a
+  property that stops being true silently.
+
+  Verbatim, not summarised into a marker of the hub's own. The specification
+  says a client "MUST consider tool annotations to be untrusted unless they come
+  from trusted servers", and the hub is in no position to vouch for a child it
+  merely forwards to — a derived `kind` would have been the hub's claim about
+  somebody else's server. A child that declared nothing arrives with no
+  `annotations` key at all; an empty object would read as all four defaults,
+  which is a claim it did not make.
+
+- **The six meta-tools annotate themselves**, which they never did. The
+  specification gives `destructiveHint` and `openWorldHint` a default of `true`,
+  so silence declared `list_servers` a destructive tool in an open world.
+  `call_tool` is the one where that really is the answer: whatever the named
+  tool does, `call_tool` does.
+
+- **The hub speaks both MCP revisions on every endpoint.** `2026-07-28` and
+  `2025-11-25`, on `/hub`, on `/<name>/mcp` and over `--stdio`; the client
+  picks during its opening exchange and cannot tell from the answers which one
+  it got. Which traffic is carried on which revision is a
+  [matrix](https://mcp-hub.ni-c.de/reference/standards#what-is-carried-per-revision)
+  now, with a test behind every row, because this project has twice announced
+  something it did not deliver.
+
+  The 2025 path is untouched: it is served by the same transport that always
+  served it, so a `GET` still opens a stream and a `DELETE` still answers 200
+  rather than the 405 the modern handler's own fallback would give. claude.ai
+  opens that stream on every reconnect.
+
+- **Change notifications travel, on both sides.** A `2026-07-28` client opens a
+  `subscriptions/listen` stream and names what it wants — tool, prompt and
+  resource list changes, or specific resource URIs — and the hub delivers.
+  Upstream it subscribes to each child the way that child understands:
+  `subscriptions/listen` to a 2026 server, `resources/subscribe` to a 2025 one.
+  So a server that has never heard of the newer mechanism still reaches a client
+  that speaks nothing else, which is the common case in practice.
+  [Details](https://mcp-hub.ni-c.de/guide/subscriptions).
+
+  This is the second thing the 2026 revision made possible for a stateless
+  gateway, and for the same reason as the first: the state is the open HTTP
+  response rather than a session table, so a client reconnecting without closing
+  anything leaves nothing behind. One handler per route now outlives the
+  request, because it owns those streams — it holds the sockets currently open
+  and no record of who opened them.
+
+  The bookkeeping is a lease per stream rather than a reference count per URI.
+  A count cannot tell "nobody wants this any more" from "the one leaving wanted
+  it too", and gets it wrong in the direction that silently stops delivering to
+  the client that stayed.
+
+  A sleeping [on-demand](https://mcp-hub.ni-c.de/guide/on-demand) server watches
+  nothing: subscribing does not wake it — the acknowledgment comes from the
+  cached capabilities — and the subscription is re-established when something
+  else does, followed by a re-read signal for everything that client was
+  watching. What changed during the nap is not reported, only that there is
+  reason to look. `subscriptions: "off"` withdraws one server's right to push.
+
+- **An end-to-end suite that runs the hub the way it ships.** Three tiers: in
+  this process, as `node dist/index.js`, and as the published image through
+  `demo/compose.yml`. It is not part of `npm test`, which stays fast and stays
+  the pull-request gate; this one runs nightly, on any pull request that touches
+  it, and as a gate on release tags. [What it is
+  for](https://github.com/ni-c/mcp-hub/blob/main/e2e/README.md).
+
+  The tiers exist because a class of question cannot be asked from inside the
+  process being tested. `src/index.ts`'s startup block — environment parsing,
+  the listener, signal handlers — is entered only when the file is the program.
+  `mcp-hub-admin` is a *separate program* sharing `/data` with a running hub,
+  and a test that called the same `AuthStore` instance proves the hub can read
+  its own memory; that mistake shipped once, as a revocation that reported
+  success and did nothing. An `uncaughtException` in-process takes the test
+  runner down rather than the hub. And uid 1000, a read-only root filesystem,
+  the healthcheck and tini cannot be wrong in a bare process at all.
+
+  The consumer is a scripted agent rather than a model. It discovers through the
+  six meta-tools and then builds its arguments *from the schema the hub
+  published*, which is the whole point: a schema damaged in transit — truncated,
+  budget-clipped, missing a property it declares required — stops working there
+  and nowhere else. A model handed a broken schema improvises around it, and
+  improvisation is not an assertion.
+
+  Alongside it: thirteen fixture servers that each misbehave in one specific way
+  no off-the-shelf server does, a four-cell client-era × child-era matrix built
+  on one catalogue registered twice so a difference can only be the hub's, raw
+  `fetch` conformance checks that assert an HTTP status and a JSON-RPC code
+  together, and a recorder for what real clients put on the wire.
+
+- **`src/timings.ts`.** The supervisor's ping interval, wake timeout, idle
+  sweep and backoff curve read the environment, the same way `mcp-limits.ts`
+  already did for the call deadline. `IDLE_TIMEOUT_MS` is the sub-minute sibling
+  of `IDLE_TIMEOUT_MINUTES`.
+
+  Defaults are unchanged, so no deployment behaves differently. What changes is
+  that the behaviour becomes observable: at the shipped numbers, watching a
+  server fall asleep costs a minute and the five-minute backoff ceiling cannot
+  be reached at all. Four minutes of a test suite spent asleep is four minutes
+  somebody eventually deletes.
+
+- **`describe_connection`, behind `MCP_DIAGNOSTICS`.** A seventh meta-tool that
+  answers the one question a client cannot answer for itself: which protocol
+  era this connection is on, whether this request carried an elicitation
+  capability, and — for a named server — whether a question from it would
+  actually reach the person at the far end.
+
+  It exists because a server falling back to its two-call token looks identical
+  to a server that simply did not ask. From inside the client both are silence,
+  and only the hub knows which one it was. The first thing it reported in
+  anger: a connector on the `2026-07-28` era that declares no `elicitation`
+  capability at all — which the era, unlike the older one, would let it do.
+
+  Off by default. Not for safety — it reports only what the caller's own request
+  already carried, and nothing about any other client — but because every tool a
+  client can see costs context in every conversation it has, and "six meta-tools
+  instead of N×tools" is the argument for the aggregate. With the switch on,
+  `/hub` and `--stdio` serve seven.
+
+- **One log line when a question is dropped.** When the hub declines to carry a
+  child's elicitation it now says so once per client, server and reason, instead
+  of leaving the only trace inside a tool result that one caller sees. The
+  decision itself moved into a single function that both the forwarding path and
+  the new tool call, so the explanation cannot drift from the behaviour.
+
+### Fixed
+
+- **The meta-tools no longer advertise an empty schema where they mean
+  "anything".** Five fields carry a document the hub does not own — a child's
+  `annotations` on `list_tools` and `get_tool_schema`, the two schemas on
+  `get_tool_schema`, and the `arguments` of `call_tool` — and zod writes that
+  as `"additionalProperties": {}`. An empty schema is legal and means exactly
+  what `true` means, but it is the spelling some MCP clients refuse or
+  mishandle, which is the worst kind of bug to own: the tool works against the
+  client you tested with and fails against the one you did not.
+
+  Only the emitted JSON Schema changes. The runtime is still as permissive as
+  it has to be, and deliberately so: those fields are validated against the zod
+  schema, a child is free to put anything in them, and the SDK turns a refused
+  answer into an error result. A test walks every schema the hub advertises and
+  fails on any node that constrains nothing, so a future zod release cannot put
+  the spelling back without saying so.
+
+- **A non-object output schema now reaches a 2025 client with its value wrapped
+  to match.** The per-server endpoint writes its own `tools/call` handler, and
+  such a handler has to run the result through the wire codec itself. It did
+  not. The schema half was already being rewritten to `{"result": …}` on the
+  way out, so a child whose `outputSchema` describes an array handed a 2025
+  client a bare array to validate against a schema saying "object" — correct
+  data that looks broken. Both halves are projected now, and a fixture with an
+  array-rooted schema pins it on every era pair.
+
+  The e2e agent, which checks that a result carries everything its schema
+  requires, was silently doing nothing on the `/hub` door for the same reason:
+  the schema it read from `get_tool_schema` was always `undefined`. It bites
+  there now, and it also asserts that the text block and `structuredContent`
+  agree.
+
+- **Three capabilities the hub announced but did not serve.** `listChanged` for
+  tools, prompts and resources is now advertised only on the revision that
+  carries it, and is true there; `resources.subscribe` likewise, having been
+  stripped outright since 0.6.3. `logging` is no longer advertised at all —
+  `logging/setLevel` never had a handler, so a client that believed it got a
+  `-32601` at call time, and on `2026-07-28` the level is per-request `_meta`
+  with no RPC left to implement.
+
+  A 2025 client is now told none of the three. That is a visible change, and the
+  honest one: it was never going to receive any of them.
+
+- **A `subscriptions/listen` POST no longer occupies an in-flight slot.** It is
+  a POST whose response stays open for the life of the subscription, so counted
+  as work in progress it held one of `MCP_MAX_CONCURRENT_REQUESTS` (default
+  four) the entire time — a handful of subscribed clients would have locked
+  every tool call on the hub out with a 429 while nothing was running. It is the
+  standing channel by another name and is charged to
+  `MCP_MAX_CONCURRENT_STREAMS`, where the 2025 era's `GET` already went.
+
+- **Elicitation travels end to end.** A child server that needs to ask the
+  person at the far end something — `smtp-mcp` before it sends, `imap-mcp`
+  before it expunges a mailbox — now reaches them through the hub instead of
+  silently falling back to a weaker check. On `2026-07-28` a question is a
+  *result*, not a push: the call ends, the person decides, the client retries
+  with the answer. Nothing is held open, so the stateless transport is what
+  makes this work rather than what prevented it.
+
+  The hub adds what follows from the question crossing a trust boundary. It is
+  attributed to the server that asked, after the text has been stripped of the
+  bidirectional and zero-width characters that could visually undo that line.
+  Embedded `sampling/createMessage` and `roots/list` requests are dropped and
+  named in the log — relaying them would spend the caller's model budget and
+  hand out its workspace layout on a child's say-so. The child's `_meta` is
+  removed. The resumption state is signed and bound to the server, the tool,
+  the OAuth client and the endpoint, so it cannot be pasted onto another call.
+
+  The capability is mirrored per request from what the client itself declared,
+  and never widened — so it is announced only for a call whose answer has
+  somewhere to go. A `2025-11-25` client over HTTP is therefore not offered it
+  at all, and the child takes its own fallback, which is the same rule this
+  project already applies to `listChanged`.
+
+  `"passthrough": "off"` on a server withdraws its right to put words in front
+  of the user without switching it off; `MCP_ELICITATION=false` is the global
+  brake. Four further `MCP_ELICITATION_*` variables bound rounds, lifetime,
+  message size and payload size. See
+  [Elicitation](https://mcp-hub.ni-c.de/guide/elicitation).
+
+- **A question from a server that had gone to sleep was lost.** The hub decided
+  whether a child could be asked by reading the protocol era off its client,
+  and an on-demand child that is asleep has none — so the first tool call after
+  an idle nap silently took the weaker path and the second one worked. The wake
+  now happens before the decision.
+
+### Changed
+
+- **On MCP SDK 2.0.** The single `@modelcontextprotocol/sdk` package has been
+  replaced by the split `@modelcontextprotocol/{core,client,server,node,express}`.
+  Behaviour is unchanged by the migration itself: no wire format, endpoint or
+  response differs, and deployments need do nothing. Speaking `2026-07-28` as
+  well is a separate change, listed under Added above — it is what the
+  migration was for.
+
+  Notably **not** installed is `@modelcontextprotocol/server-legacy`, the frozen
+  copy of v1's authorization-server helpers that npm marks deprecated on
+  install. Replacing the hand-written OAuth server with `oidc-provider` first is
+  what made that possible — this migration only had to touch the MCP wire layer.
+
+  Two things the mechanical migration would have changed quietly, and did not:
+  `tools/list` is still walked one page at a time, because v2's `listTools()`
+  aggregates the whole pagination internally and would have bypassed the tool
+  count and metadata budgets that bound what a hostile child can make the hub
+  hold in memory; and a malformed line on a child's stdio is still reported,
+  because v2's read buffer skips unparseable lines in silence.
+
+- **The authorization server is now `oidc-provider` instead of ~900 lines of
+  hand-written OAuth.** Every endpoint keeps its path, the login and consent
+  pages are the same pages, and the discovery document advertises everything it
+  advertised before — there is a test that compares it field by field against
+  the old one and fails on anything that is not a written-down decision.
+
+  **This is a clean cut, not a migration: every client re-registers and
+  authorizes once more.** Tokens issued by the previous server are refused
+  rather than honoured, because a credential nothing can revoke is worse than a
+  reconnect. Registrations, approvals and API tokens in `state.json` are
+  untouched; only the OAuth artifacts are new.
+
+  Access tokens are **opaque** rather than JWTs. That is what makes
+  `mcp-hub-admin clients revoke` take effect on the next call instead of when
+  the token expires: oidc-provider never persists a JWT, so a JWT could not be
+  withdrawn at all. Nothing that presents a token has to change.
+
+  Several things got stricter on the way. Replaying a rotated refresh token now
+  revokes the grant's access tokens as well. Client assertions may not be valid
+  for longer than five minutes. Nothing an authorization server holds is written
+  to `state.json` in a form anyone could present — the file used to keep hashes
+  of refresh tokens, and now keeps hashes of everything. A `Host` header can no
+  longer influence the URLs in the discovery document.
+
+  Visible differences, none of which change what is allowed: redirects use
+  `303` where they used `302`, `invalid_client` may be answered `401` rather
+  than `400` (RFC 6749 §5.2 allows either), a rejected redirect URI is reported
+  as `invalid_redirect_uri`, and the login page lives at `/interaction/<id>/`
+  instead of being rendered by `/authorize` directly. The discovery document
+  gained the OpenID fields oidc-provider always publishes; no ID token is ever
+  issued.
+
+- **Four more reserved server names: `jwks`, `interaction`, `session` and
+  `userinfo`.** They are paths the authorization server answers on, and a server
+  configured under one of them would shadow the login flow rather than merely be
+  unreachable. A configuration using one of these names is now refused at
+  startup with the same message as for `token` or `authorize`.
+
+- **Both images now run on Node 24 ("Krypton"), the active LTS line, instead of
+  Node 26.** Node 26 is Current until October, and a non-LTS build leaves
+  `process.release.lts` unset — which is not cosmetic, because libraries branch
+  on it. It is also what the CI matrix already tests against, so the container
+  and the test runs no longer sat on different majors.
+
+  Nothing else changes: npm is still replaced wholesale and its three vulnerable
+  vendored packages still overwritten in place, verified against the built
+  image.
+
+### Security
+
+Five findings from an internal review of the authorization surface, which is the
+half that was rewritten onto oidc-provider in this cycle and had not been looked
+at adversarially since.
+
+- **`/token` bounds the body it reads.** It is the one provider path whose
+  request stream the hub takes away from the library — `stripPhantomSecret` has
+  to read it to strip a presented secret — and it read it without a ceiling.
+  `/token` cannot ask who is calling before it reads, because the credentials
+  are in the body, so an anonymous 300 MB request took the process from 157 MB
+  resident to 1.4 GB, and the per-path budget still allows fifty of them per
+  caller per window. The ceiling is oidc-provider's own 56 KiB, so nothing a
+  legitimate client sends changes, and an oversized body now gets the same
+  answer the library would have given it.
+
+- **A public client's record no longer carries a secret.** RFC 7591 makes
+  `client_secret_basic` the default when `token_endpoint_auth_method` is
+  omitted — which is what Claude and ChatGPT both do — so the authorization
+  server minted and persisted a real secret before `clientDefaults` rewrote the
+  method to `none`. Two consequences, neither visible from outside:
+  `state.json` gained a value someone could present, which is the one thing it
+  is careful never to hold; and `stripPhantomSecret` gates on the stored client
+  having no secret, so it stopped firing for exactly the clients it exists for.
+  A connector that echoed the secret from its registration response got
+  `401 invalid_client` — the failure quirk 2 was written to prevent. The
+  response still carries a secret, because ChatGPT insists on one; only the
+  record is cleaned.
+
+- **A hundred wrong passwords no longer lock the operator out.** The global
+  failure ceiling refused every address once it was reached, so an attacker
+  could close the only administrative way in — from one host, in under a second,
+  renewable every fifteen minutes — and the operator holding the correct
+  password got `429` from an address that had never touched the form. The
+  ceiling now refuses the callers that are guessing, and refuses them on their
+  first failure rather than their tenth once the hub is under a distributed
+  attempt, so the total number of guesses still collapses. What it no longer
+  does is let them spend somebody else's budget.
+
+- **Every per-caller budget counts an IPv6 /64, not an address.** A /64 is the
+  smallest block one subscriber is handed, and a /56 or /48 is what a
+  residential line usually gets, so a limiter keyed on the full address counted
+  one host as billions of callers: twenty-five registrations from twenty-five
+  addresses in one network spent twenty-five budgets of twenty. IPv4 keeps its
+  own address, and an IPv4-mapped form is folded back onto it so the same caller
+  is not counted twice for arriving over a dual-stack listener. Log lines are
+  unchanged — fail2ban still gets the host that actually connected.
+
+- **A `TRUSTED_PROXIES` list that never matches is now said out loud.** It is
+  compared against the address the connection came from, and the easiest way to
+  get it wrong is the least visible: a proxy configured as
+  `proxy_pass http://localhost:…` on a dual-stack host arrives over `::1`,
+  which `127.0.0.1` does not cover. Every forwarded header is then ignored and
+  per-caller limiting collapses into one global counter — the exact failure the
+  startup warning covers for an *unset* list, with nothing said when the list is
+  merely wrong. The hub now says so once, when a forwarded header arrives from
+  an address it does not trust.
+
+Unchanged, and confirmed by the same review: the docker policy proxy refused
+every one of thirty-three attempts to reach the daemon past it — privileged
+containers, host mounts, `Mounts` instead of `Binds`, foreign images, prototype
+pollution in the create body, duplicate query parameters, encoded traversal in a
+container name, `exec`, `build`, `networks/create`; and the metadata-document
+fetcher refused literal private addresses, IPv4-mapped ones and public names
+that resolve inward.
+
 ## [0.10.0] - 2026-08-27
 
 ### Added

package/README.md

@@ -9,8 +9,17 @@
 [![docs](https://img.shields.io/badge/docs-mcp--hub.ni--c.de-informational)](https://mcp-hub.ni-c.de)
 [![sponsor](https://img.shields.io/badge/sponsor-ni--c-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ni-c)
 
-A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) gateway: it serves
-many stdio MCP servers from **one container**, published over HTTPS.
+A dual-era [Model Context Protocol](https://modelcontextprotocol.io) (MCP) gateway: it
+serves many stdio MCP servers from **one container**, published over HTTPS, and speaks
+**both MCP revisions on every endpoint** — `2026-07-28` and `2025-11-25`. The client
+picks, and cannot tell which one it is on from the answers. On the 2026 revision that
+includes **elicitation** — a child server's question reaches the person at the far end
+instead of dying at the gateway
+([how](https://mcp-hub.ni-c.de/guide/elicitation)) — and **subscriptions**: the hub
+serves `subscriptions/listen` to its clients and subscribes to its children on
+whichever revision _they_ speak, so a server that has never heard of it still reaches
+a client that speaks nothing else
+([how](https://mcp-hub.ni-c.de/guide/subscriptions)).
 
 Lets MCP clients that cannot spawn a local process — ChatGPT connectors, Claude on
 the Web and in Code, Mistral Le Chat, Cursor, LibreChat and any other
@@ -83,11 +92,62 @@ replaces N containers with one process:
   servers.
 - **Stateless Streamable HTTP**: no session state, so claude.ai's
   reconnect-without-DELETE behaviour cannot leak processes or memory.
+- **Dual-era**: every endpoint — `/hub`, `/<name>/mcp` and `--stdio` — answers
+  MCP `2026-07-28` and `2025-11-25` alike; the client picks and cannot tell
+  from the answers which it got. On the 2026 revision that includes
+  **elicitation**: a server asking the user something returns the question
+  rather than pushing it, so it reaches the person at the far end instead of
+  dying at the gateway. The hub attributes it to the server that asked, strips
+  what could lie about that, drops embedded sampling and roots requests, and
+  seals the resumption state against the call it belongs to. `passthrough:
+"off"` withdraws one server's right to ask;
+  [details](https://mcp-hub.ni-c.de/guide/elicitation).
+- **Change notifications, in both eras**: a client opens a
+  `subscriptions/listen` stream and hears when a child's tools, prompts or
+  resources change. The hub subscribes to each child the way that child
+  understands — `subscriptions/listen` to a 2026 server, `resources/subscribe`
+  to a 2025 one — so the era gap is the gateway's problem rather than either
+  end's. The state is the open response, not a session table, so this costs the
+  stateless design nothing. A sleeping server watches nothing and is told to
+  re-read on waking; `subscriptions: "off"` withdraws one server's right to
+  push; [details](https://mcp-hub.ni-c.de/guide/subscriptions).
 - **Lightweight by design**: one Node process, no database (state is one JSON
-  file plus a JWT key under `/data`), a handful of runtime dependencies, and
+  file plus a signing key under `/data`), six runtime dependencies, and
   multi-arch images — a stated project goal is to run comfortably on a
   single-board computer like a Raspberry Pi.
 
+## Servers to run behind it
+
+The hub is server-agnostic — it serves any stdio MCP server whose entry fits
+Claude Code's `mcpServers` format, which is most of them. These seventeen are
+built and maintained alongside it, so their documentation carries the hub entry
+you need and their tool filters line up with the hub's own `allowTools` /
+`denyTools`:
+
+| Server                                                                 | npm                               | What it reaches                                                                |
+| ---------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------ |
+| [audiobookshelf-mcp](https://audiobookshelf-mcp.ni-c.de)               | `audiobookshelf-mcp`              | Audiobookshelf — libraries, listening progress, collections and playlists      |
+| [calibreweb-mcp](https://calibreweb-mcp.ni-c.de)                       | `calibreweb-mcp`                  | Calibre-Web — read-only library access through the OPDS feed                   |
+| [freshrss-mcp](https://freshrss-mcp.ni-c.de)                           | `@ni-c/freshrss-mcp`              | FreshRSS — feeds, categories and articles as plain text, not stream ids        |
+| [google-search-console-mcp](https://google-search-console-mcp.ni-c.de) | `@ni-c/google-search-console-mcp` | Google Search Console — properties, sitemaps, search analytics, URL inspection |
+| [healthchecks-mcp](https://healthchecks-mcp.ni-c.de)                   | `healthchecks-mcp`                | Healthchecks — cron and uptime checks, and why one failed                      |
+| [hetzner-dns-mcp](https://hetzner-dns-mcp.ni-c.de)                     | `hetzner-dns-mcp`                 | Hetzner Cloud DNS — zones, record sets and BIND import/export                  |
+| [imap-mcp](https://imap-mcp.ni-c.de)                                   | `@ni-c/imap-mcp`                  | IMAP mailboxes — read, search, organise and draft mail; it cannot send         |
+| [linkwarden-mcp](https://linkwarden-mcp.ni-c.de)                       | `linkwarden-mcp`                  | Linkwarden — bookmarks, collections and the article text it preserved          |
+| [mealie-mcp](https://mealie-mcp.ni-c.de)                               | `@ni-c/mealie-mcp`                | Mealie — recipes, meal plans, shopping lists and cookbooks                     |
+| [ntfy-mcp](https://ntfy-mcp.ni-c.de)                                   | `@ni-c/ntfy-mcp`                  | ntfy — publish and update notifications, manage users and topic access         |
+| [opengist-mcp](https://opengist-mcp.ni-c.de)                           | `opengist-mcp`                    | Opengist — gists, revisions, commit history and raw files                      |
+| [osm-mcp](https://osm-mcp.ni-c.de)                                     | `osm-mcp`                         | OpenStreetMap — geocoding, routing, isochrones and POI search                  |
+| [rustpad-mcp](https://rustpad-mcp.ni-c.de)                             | `rustpad-mcp`                     | Rustpad — collaborative pads edited through real OT, not overwrites            |
+| [smtp-mcp](https://smtp-mcp.ni-c.de)                                   | `@ni-c/smtp-mcp`                  | SMTP — sends mail, behind a recipient allowlist and a human confirmation       |
+| [wg-easy-mcp](https://wg-easy-mcp.ni-c.de)                             | `wg-easy-mcp`                     | wg-easy v15+ — the full WireGuard client lifecycle                             |
+| [wikijs-mcp](https://wikijs-mcp.ni-c.de)                               | `@ni-c/wikijs-mcp`                | Wiki.js — search, read and edit pages, plus assets, users and groups           |
+| [woodpecker-ci-mcp](https://woodpecker-ci-mcp.ni-c.de)                 | `@ni-c/woodpecker-ci-mcp`         | Woodpecker CI — repositories, pipelines, logs, secrets and crons               |
+
+Each one runs perfectly well on its own over stdio. Put them behind the hub when
+you want them reachable from a client that cannot spawn a local process, or when
+you would rather register one connector than seventeen.
+
 ## Configuration
 
 `/config/mcp.json` — identical to Claude Code (`${VAR}` expands from the
@@ -366,15 +426,20 @@ immediately. Per-client recipes:
 
 ## Notes & limitations
 
-- Stateless transport: server-initiated notifications (`listChanged`,
-  subscriptions, sampling) are not delivered to clients. Tool/resource/prompt
-  request-response works fully; the hub's tool cache does follow
-  `tools/list_changed` internally.
-- Access tokens are self-contained 15-minute JWTs. Revoking a client rejects
-  its existing JWTs and removes all of its refresh tokens. Refresh tokens
-  rotate; replaying a token
-  that was already rotated away revokes its whole chain, and a refresh cannot
-  ask for more scope than the original grant.
+- Change notifications (`listChanged`, resource updates) are carried on
+  `2026-07-28` via `subscriptions/listen`, whose state is the open response
+  rather than a session table. A `2025-11-25` client is offered neither, because
+  that revision needs a channel the stateless transport does not keep — so the
+  capability is withheld instead of announced and dropped. An on-demand server
+  watches nothing while it sleeps; the subscription is re-established on the
+  next wake and the client is told to re-read.
+- Elicitation travels end to end on `2026-07-28`: it is a result rather than a
+  push. Sampling and log messages are not forwarded.
+- Access tokens are opaque and last 15 minutes. Revoking a client takes effect
+  on its next request rather than when the token expires — the token is a
+  reference to a stored record, so withdrawing it is a deletion. Refresh tokens
+  rotate; replaying one that was already rotated away is treated as a leak and
+  revokes the whole grant, access tokens included.
 - Upstream auth is fully decoupled from the hub's own OAuth: an expired
   upstream token just marks that one server `down` (503 on its path, visible
   in `/health`) — clients never see the upstream's 401.

package/dist/admin.js

@@ -4,7 +4,7 @@ import { AuthStore, clientLimitsFromEnv } from './auth/store.js';
 import { isSafeRedirectUri } from './auth/redirect-uri.js';
 import { clampDisplayName } from './auth/text.js';
 import { isClientIdMetadataUrl } from './auth/cimd.js';
-import { mintApiToken } from './auth/provider.js';
+import { mintApiToken } from './auth/api-tokens.js';
 import { loadConfig } from './config.js';
 import { authFor, requireOAuthServer, startUpstreamLogin, upstreamStatus } from './upstream/login.js';
 function usage() {

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":";AACA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtG,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CACX;QACE,QAAQ;QACR,8BAA8B;QAC9B,2EAA2E;QAC3E,yFAAyF;QACzF,kFAAkF;QAClF,2CAA2C;QAC3C,mFAAmF;QACnF,6BAA6B;QAC7B,0CAA0C;QAC1C,+BAA+B;QAC/B,0CAA0C;QAC1C,qDAAqD;QACrD,sFAAsF;QACtF,oEAAoE;QACpE,mFAAmF;QACnF,EAAE;QACF,qFAAqF;QACrF,8EAA8E;QAC9E,wDAAwD;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,OAAO,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,EAAE,AAAD,EAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;AAClD,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAErF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACpC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACrB,sBAAsB,EAAE,MAAM,CAAC,aAAa;QAC5C,oBAAoB,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE;QACvD,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC3F,CAAC,CAAC,CAAC;IACJ,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,EAAE,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACrB,sBAAsB,EAAE,EAAE;YAC1B,oBAAoB,EAAE,QAAQ,CAAC,YAAY;YAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,EAAE,CAAC;IACnC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,2EAA2E,WAAW,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;QACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,yEAAyE;IACzE,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,QAAQ;QACR,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE;QAC7D,oBAAoB,EAAE,MAAM,CAAC,aAAa;QAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;KACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,sEAAsE;IACtE,+BAA+B;IAC/B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAa,EAAE,EAAE,CACjC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG;QACb,MAAM;QACN,MAAM,EAAE;YACN,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI;YAChD,YAAY,EAAE,MAAM,CAAC,eAAe,GAAG,MAAM;SAC9C;QACD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IAC1C,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC1D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACjE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAA+B,OAAO,CAAC,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,KAAK,EAAE,CAAC;IACnB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC1H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,OAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC5D,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;QACrF,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjI,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,EAAE,CAAC;AACV,CAAC;AAED,KAAK,EAAE,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":";AACA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtG,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CACX;QACE,QAAQ;QACR,8BAA8B;QAC9B,2EAA2E;QAC3E,yFAAyF;QACzF,kFAAkF;QAClF,2CAA2C;QAC3C,mFAAmF;QACnF,6BAA6B;QAC7B,0CAA0C;QAC1C,+BAA+B;QAC/B,0CAA0C;QAC1C,qDAAqD;QACrD,sFAAsF;QACtF,oEAAoE;QACpE,mFAAmF;QACnF,EAAE;QACF,qFAAqF;QACrF,8EAA8E;QAC9E,wDAAwD;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,OAAO,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,EAAE,AAAD,EAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;AAClD,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAErF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACpC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACrB,sBAAsB,EAAE,MAAM,CAAC,aAAa;QAC5C,oBAAoB,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE;QACvD,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC3F,CAAC,CAAC,CAAC;IACJ,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,EAAE,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACrB,sBAAsB,EAAE,EAAE;YAC1B,oBAAoB,EAAE,QAAQ,CAAC,YAAY;YAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,EAAE,CAAC;IACnC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,2EAA2E,WAAW,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;QACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,yEAAyE;IACzE,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,QAAQ;QACR,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE;QAC7D,oBAAoB,EAAE,MAAM,CAAC,aAAa;QAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;KACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,sEAAsE;IACtE,+BAA+B;IAC/B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAa,EAAE,EAAE,CACjC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG;QACb,MAAM;QACN,MAAM,EAAE;YACN,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI;YAChD,YAAY,EAAE,MAAM,CAAC,eAAe,GAAG,MAAM;SAC9C;QACD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IAC1C,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC1D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACjE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAA+B,OAAO,CAAC,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,KAAK,EAAE,CAAC;IACnB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC1H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,OAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC5D,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;QACrF,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjI,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,EAAE,CAAC;AACV,CAAC;AAED,KAAK,EAAE,CAAC"}

package/dist/auth/api-tokens.js

@@ -0,0 +1,27 @@
+import crypto from 'node:crypto';
+import { SignJWT } from 'jose';
+/** Distinguishes admin-minted API tokens from interactive OAuth tokens. */
+export const API_TOKEN_SUBJECT = 'mcp-hub-token';
+/**
+ * Mint a long-lived, resource-bound API token for clients that cannot do
+ * OAuth (OpenAI Responses API, xAI API, Gemini API, plain-header clients).
+ * The JWT is returned exactly once; only its record (jti) is persisted, which
+ * is what `tokens list` shows and `tokens revoke` deletes.
+ */
+export async function mintApiToken(store, externalUrl, resource, days, label) {
+    const id = crypto.randomBytes(8).toString('base64url');
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + days * 86_400;
+    const token = await new SignJWT({})
+        .setProtectedHeader({ alg: 'EdDSA' })
+        .setIssuer(new URL(externalUrl).href)
+        .setAudience(resource.href)
+        .setSubject(API_TOKEN_SUBJECT)
+        .setIssuedAt(now)
+        .setExpirationTime(expiresAt)
+        .setJti(id)
+        .sign(store.privateKey);
+    store.saveApiToken(id, { label, resource: resource.href, createdAt: now, expiresAt });
+    return { id, token, expiresAt };
+}
+//# sourceMappingURL=api-tokens.js.map

package/dist/auth/api-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens.js","sourceRoot":"","sources":["../../src/auth/api-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAI/B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgB,EAChB,WAAmB,EACnB,QAAa,EACb,IAAY,EACZ,KAAa;IAEb,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;SAChC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;SACpC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC1B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,EAAE,CAAC;SACV,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC"}