@oharness/engine 0.1.0

package/dist/mcp/oauth.js

@@ -0,0 +1,302 @@
+import { refreshCredential, startLoopbackFlow } from "../auth/oauth.js";
+import { parseJson } from "../util/json.js";
+/**
+ * OAuth for remote MCP servers.
+ *
+ * The point of doing this rather than shipping a list of pre-registered
+ * integrations is dynamic client registration. With it, "which servers are
+ * supported" stops being a list somebody maintains: the server says where its
+ * authorization lives, we register against it on the spot, and any server that
+ * follows the spec works without anybody adding a row anywhere.
+ *
+ * The chain, all of it discovery, none of it configured:
+ *
+ *   401 + WWW-Authenticate   the server says it wants a token, and where to
+ *                            ask about it (RFC 9728)
+ *   protected-resource       -> which authorization server, and for what
+ *                            resource identifier
+ *   authorization-server     -> authorize / token / register endpoints
+ *                            (RFC 8414, or OpenID discovery)
+ *   register                 -> a client id, issued to us, now (RFC 7591)
+ *   authorize + PKCE         -> the loopback flow the providers already use
+ *
+ * Every step has a fallback, because plenty of deployed servers implement only
+ * part of this. A server with no metadata at all is assumed to be its own
+ * authorization server at the conventional endpoints, which is what the first
+ * generation of MCP servers did and what several still do.
+ */
+const CLIENT_NAME = "OHarness";
+/** Where a server's credential lives in the shared store. */
+export function mcpAuthKey(serverUrl) {
+    return `mcp:${canonicalResource(serverUrl)}`;
+}
+/**
+ * Everything needed to start a login, worked out from the server's URL and
+ * whatever it said in its 401.
+ */
+export async function discoverMcpAuth(serverUrl, challenge) {
+    const resource = canonicalResource(serverUrl);
+    const prm = await firstJson(protectedResourceUrls(serverUrl, challenge));
+    // No protected-resource document is not an error: it means the server is
+    // older than that part of the spec, and is very likely its own issuer.
+    const issuer = prm?.authorization_servers?.[0] ?? new URL(serverUrl).origin;
+    const metadata = await firstJson(metadataUrls(issuer));
+    const scopes = prm?.scopes_supported ?? metadata?.scopes_supported;
+    return {
+        authorizeUrl: metadata?.authorization_endpoint ?? join(issuer, "authorize"),
+        tokenUrl: metadata?.token_endpoint ?? join(issuer, "token"),
+        // Guessed only when there is no metadata at all. A document that exists
+        // and omits `registration_endpoint` is saying it does not register clients
+        // dynamically, and probing anyway turns a clear "you need a client id"
+        // into a 404 from somewhere the user has no reason to look.
+        ...(metadata?.registration_endpoint
+            ? { registrationUrl: metadata.registration_endpoint }
+            : metadata
+                ? {}
+                : { registrationUrl: join(issuer, "register") }),
+        resource: prm?.resource ?? resource,
+        ...(scopes?.length ? { scope: scopes.join(" ") } : {}),
+    };
+}
+/**
+ * The `resource_metadata` URL a 401 pointed at, if it pointed at one.
+ *
+ * Exported because it is the one piece of the challenge worth reading, and a
+ * caller that has the header should not have to re-derive the parse.
+ */
+export function resourceMetadataUrl(challenge) {
+    if (!challenge)
+        return undefined;
+    const match = /resource_metadata\s*=\s*"([^"]+)"/i.exec(challenge);
+    return match?.[1];
+}
+/**
+ * Where to look for the protected-resource document.
+ *
+ * The path-suffixed form comes first: one host can serve several MCP servers
+ * on different paths, and the bare form would collapse them into one answer.
+ */
+function protectedResourceUrls(serverUrl, challenge) {
+    const advertised = resourceMetadataUrl(challenge);
+    if (advertised)
+        return [advertised];
+    return wellKnown(serverUrl, "oauth-protected-resource");
+}
+function metadataUrls(issuer) {
+    return [
+        ...wellKnown(issuer, "oauth-authorization-server"),
+        ...wellKnown(issuer, "openid-configuration"),
+        // OpenID's own convention appends rather than inserts, and issuers with a
+        // path component often only answer here.
+        join(issuer, ".well-known/openid-configuration"),
+    ];
+}
+/** Both spellings of a well-known URL: path inserted, and bare. */
+function wellKnown(base, suffix) {
+    const url = new URL(base);
+    const path = url.pathname.replace(/^\/|\/$/g, "");
+    const bare = `${url.origin}/.well-known/${suffix}`;
+    return path ? [`${bare}/${path}`, bare] : [bare];
+}
+function join(base, path) {
+    return `${base.replace(/\/$/, "")}/${path}`;
+}
+/**
+ * The resource identifier for a server URL.
+ *
+ * Query and fragment come off and the trailing slash goes, because this value
+ * has to match what the authorization server computes for the same server, and
+ * a token bound to a nearly-right audience is rejected in a way that is very
+ * hard to read.
+ */
+export function canonicalResource(serverUrl) {
+    const url = new URL(serverUrl);
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/$/, "");
+}
+async function firstJson(urls) {
+    for (const url of urls) {
+        try {
+            const response = await fetch(url, {
+                headers: { accept: "application/json" },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok)
+                continue;
+            const parsed = parseJson(await response.text());
+            if (parsed.ok)
+                return parsed.value;
+        }
+        catch {
+            // A candidate that does not resolve is the normal case — the whole
+            // point of trying several is that most of them will not be there.
+        }
+    }
+    return undefined;
+}
+export async function registerMcpClient(registrationUrl, redirectUri, scope) {
+    const response = await fetch(registrationUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({
+            client_name: CLIENT_NAME,
+            redirect_uris: [redirectUri],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            // A public client on a loopback redirect: there is nowhere on a user's
+            // machine to keep a client secret that the user cannot read anyway.
+            token_endpoint_auth_method: "none",
+            ...(scope ? { scope } : {}),
+        }),
+        signal: AbortSignal.timeout(30_000),
+    });
+    const text = await response.text();
+    const parsed = parseJson(text);
+    if (!response.ok || !parsed.ok || !parsed.value.client_id) {
+        const detail = parsed.ok ? (parsed.value.error ?? text) : text;
+        throw new Error(`dynamic client registration failed (${response.status}): ${String(detail).slice(0, 200)}`);
+    }
+    return {
+        clientId: parsed.value.client_id,
+        ...(parsed.value.client_secret ? { clientSecret: parsed.value.client_secret } : {}),
+    };
+}
+/**
+ * Begin a login. The returned `callback()` resolves when the browser comes
+ * back, and the credential is stored before it does.
+ */
+export async function beginMcpLogin(opts) {
+    const key = mcpAuthKey(opts.serverUrl);
+    const discovered = await discoverMcpAuth(opts.serverUrl, opts.challenge);
+    // A client id already issued to this server is reused rather than
+    // re-registered: registrations are not free, some servers rate-limit them,
+    // and re-authorizing should not mint a new identity every time.
+    const previous = await opts.store.get(key);
+    const remembered = previous?.type === "oauth" ? previous.metadata : undefined;
+    let client = opts.clientId
+        ? { clientId: opts.clientId, ...(opts.clientSecret ? { clientSecret: opts.clientSecret } : {}) }
+        : remembered?.["clientId"]
+            ? {
+                clientId: remembered["clientId"],
+                ...(remembered["clientSecret"] ? { clientSecret: remembered["clientSecret"] } : {}),
+            }
+            : undefined;
+    const result = await startLoopbackFlow({
+        authorizeUrl: discovered.authorizeUrl,
+        tokenUrl: discovered.tokenUrl,
+        clientId: client?.clientId ?? "",
+        ...(client?.clientSecret ? { clientSecret: client.clientSecret } : {}),
+        ...(discovered.scope ? { scope: discovered.scope } : {}),
+        // RFC 8707. Sent in both requests: the authorization server uses it to
+        // pick an audience, and the token endpoint uses it to bind one.
+        extraParams: { resource: discovered.resource },
+        tokenParams: { resource: discovered.resource },
+        async prepare(redirectUri) {
+            if (!client) {
+                if (!discovered.registrationUrl) {
+                    throw new Error("this server does not offer dynamic client registration — " +
+                        "register a client with it and pass the client id");
+                }
+                client = await registerMcpClient(discovered.registrationUrl, redirectUri, discovered.scope);
+            }
+            return {
+                clientId: client.clientId,
+                ...(client.clientSecret ? { clientSecret: client.clientSecret } : {}),
+            };
+        },
+    });
+    if (result.method !== "auto")
+        throw new Error("expected a loopback flow");
+    const finish = result.callback;
+    return {
+        ...result,
+        method: "auto",
+        async callback() {
+            const outcome = await finish();
+            if (outcome.type !== "success" || !("access" in outcome))
+                return outcome;
+            // What is stored is not just the tokens: without the endpoints and the
+            // client id beside them, a refresh an hour from now would have to redo
+            // the whole discovery chain to find out where to send it.
+            const credential = {
+                type: "oauth",
+                access: outcome.access,
+                refresh: outcome.refresh,
+                expires: outcome.expires,
+                baseUrl: canonicalResource(opts.serverUrl),
+                metadata: {
+                    tokenUrl: discovered.tokenUrl,
+                    resource: discovered.resource,
+                    clientId: client.clientId,
+                    ...(client.clientSecret ? { clientSecret: client.clientSecret } : {}),
+                    ...(discovered.scope ? { scope: discovered.scope } : {}),
+                },
+            };
+            await opts.store.set(key, credential);
+            return outcome;
+        },
+    };
+}
+/** Forget a server's credential; the next connection will ask again. */
+export async function forgetMcpAuth(serverUrl, store) {
+    return store.remove(mcpAuthKey(serverUrl));
+}
+// ---------------------------------------------------------------------------
+// Per-request headers
+// ---------------------------------------------------------------------------
+/** In-flight refreshes, so several tool calls at once share one. */
+const refreshing = new Map();
+/**
+ * The Authorization header for a server, or nothing if it has no credential.
+ *
+ * Resolved per request rather than snapshotted at connect: an access token
+ * outlives a long session by about an hour, and a header captured when the
+ * transport was built is a session that dies quietly in the middle.
+ */
+export async function mcpAuthHeaders(serverUrl, store) {
+    const key = mcpAuthKey(serverUrl);
+    const credential = await store.get(key);
+    if (!credential || credential.type !== "oauth")
+        return {};
+    const fresh = (await ensureFresh(key, credential, store)) ?? credential;
+    return { authorization: `Bearer ${fresh.access}` };
+}
+async function ensureFresh(key, credential, store) {
+    // A minute of margin: a token that expires while the request is in flight
+    // fails the same way as one that expired an hour ago.
+    const stale = credential.expires > 0 && Date.now() > credential.expires - 60_000;
+    if (!stale || !credential.refresh)
+        return credential;
+    const existing = refreshing.get(key);
+    if (existing)
+        return existing;
+    const metadata = credential.metadata ?? {};
+    const tokenUrl = metadata["tokenUrl"];
+    const clientId = metadata["clientId"];
+    if (!tokenUrl || !clientId)
+        return credential;
+    const attempt = refreshCredential(credential, {
+        tokenUrl,
+        clientId,
+        ...(metadata["clientSecret"] ? { clientSecret: metadata["clientSecret"] } : {}),
+        ...(metadata["scope"] ? { scope: metadata["scope"] } : {}),
+        ...(metadata["resource"] ? { tokenParams: { resource: metadata["resource"] } } : {}),
+    })
+        .then(async (refreshed) => {
+        if (!refreshed)
+            return undefined;
+        // The metadata is not in the token response; carry it forward or the
+        // next refresh has nowhere to go.
+        const merged = { ...refreshed, metadata };
+        await store.set(key, merged);
+        return merged;
+    })
+        // A failed refresh is not fatal here. The stale token goes out, the server
+        // answers 401, and that path already knows how to ask for a new login.
+        .catch(() => undefined)
+        .finally(() => refreshing.delete(key));
+    refreshing.set(key, attempt);
+    return attempt;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/mcp/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,OAAO,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/C,CAAC;AA6BD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,SAAkB;IAElB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAoB,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5F,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAiB,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,GAAG,EAAE,gBAAgB,IAAI,QAAQ,EAAE,gBAAgB,CAAC;IACnE,OAAO;QACL,YAAY,EAAE,QAAQ,EAAE,sBAAsB,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAC3E,QAAQ,EAAE,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3D,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,4DAA4D;QAC5D,GAAG,CAAC,QAAQ,EAAE,qBAAqB;YACjC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,qBAAqB,EAAE;YACrD,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpD,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ;QACnC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA6B;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAAiB,EAAE,SAAkB;IAClE,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,UAAU;QAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,EAAE,4BAA4B,CAAC;QAClD,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC;QAC5C,0EAA0E;QAC1E,yCAAyC;QACzC,IAAI,CAAC,MAAM,EAAE,kCAAkC,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,gBAAgB,MAAM,EAAE,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,IAAc;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,SAAS;YAC3B,MAAM,MAAM,GAAG,SAAS,CAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,kEAAkE;QACpE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,eAAuB,EACvB,WAAmB,EACnB,KAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,WAAW;YACxB,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,uEAAuE;YACvE,oEAAoE;YACpE,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAiE,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QAChC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAqB;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEzE,kEAAkE;IAClE,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,MAAM,GAAiC,IAAI,CAAC,QAAQ;QACtD,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChG,CAAC,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC;YACxB,CAAC,CAAC;gBACE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;gBAChC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF;YACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE;QAChC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,uEAAuE;QACvE,gEAAgE;QAChE,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC9C,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC9C,KAAK,CAAC,OAAO,CAAC,WAAW;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CACb,2DAA2D;wBACzD,kDAAkD,CACrD,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,MAAM,iBAAiB,CAC9B,UAAU,CAAC,eAAe,EAC1B,WAAW,EACX,UAAU,CAAC,KAAK,CACjB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAE/B,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,MAAM;QACd,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAEzE,uEAAuE;YACvE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,UAAU,GAAoB;gBAClC,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC1C,QAAQ,EAAE;oBACR,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,MAAO,CAAC,QAAQ;oBAC1B,GAAG,CAAC,MAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAgB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,KAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAE1D,MAAM,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;IACxE,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,UAA2B,EAC3B,KAAgB;IAEhB,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC;IACjF,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAErD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IAE9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE;QAC5C,QAAQ;QACR,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;SACC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACxB,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,MAAM,GAAoB,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;QACF,2EAA2E;QAC3E,uEAAuE;SACtE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtB,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/mcp/protocol.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Minimal Model Context Protocol types and JSON-RPC framing.
+ *
+ * Implemented directly rather than via an SDK so the harness has no runtime
+ * dependency for MCP and we control reconnect/timeout behaviour.
+ */
+export declare const MCP_PROTOCOL_VERSION = "2025-06-18";
+export interface JsonRpcRequest {
+    jsonrpc: "2.0";
+    id: number | string;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcNotification {
+    jsonrpc: "2.0";
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcResponse {
+    jsonrpc: "2.0";
+    id: number | string;
+    result?: unknown;
+    error?: JsonRpcError;
+}
+export interface JsonRpcError {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+export type JsonRpcMessage = JsonRpcRequest | JsonRpcNotification | JsonRpcResponse;
+export declare function isResponse(msg: JsonRpcMessage): msg is JsonRpcResponse;
+export declare function isRequest(msg: JsonRpcMessage): msg is JsonRpcRequest;
+export interface McpServerInfo {
+    name: string;
+    version: string;
+}
+export interface McpCapabilities {
+    tools?: {
+        listChanged?: boolean;
+    };
+    resources?: {
+        subscribe?: boolean;
+        listChanged?: boolean;
+    };
+    prompts?: {
+        listChanged?: boolean;
+    };
+    logging?: Record<string, unknown>;
+}
+export interface McpInitializeResult {
+    protocolVersion: string;
+    capabilities: McpCapabilities;
+    serverInfo: McpServerInfo;
+    instructions?: string;
+}
+export interface McpToolDefinition {
+    name: string;
+    title?: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+        openWorldHint?: boolean;
+    };
+}
+export type McpContent = {
+    type: "text";
+    text: string;
+} | {
+    type: "image";
+    data: string;
+    mimeType: string;
+} | {
+    type: "audio";
+    data: string;
+    mimeType: string;
+} | {
+    type: "resource";
+    resource: {
+        uri: string;
+        text?: string;
+        blob?: string;
+        mimeType?: string;
+    };
+} | {
+    type: "resource_link";
+    uri: string;
+    name?: string;
+    description?: string;
+};
+export interface McpToolCallResult {
+    content: McpContent[];
+    isError?: boolean;
+    structuredContent?: unknown;
+}
+export interface McpResource {
+    uri: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+}
+export interface McpResourceContents {
+    contents: Array<{
+        uri: string;
+        mimeType?: string;
+        text?: string;
+        blob?: string;
+    }>;
+}
+/** What `prompts/get` returns: a rendered template as chat messages. */
+export interface McpPromptResult {
+    description?: string;
+    messages?: Array<{
+        role?: string;
+        content?: unknown;
+    }>;
+}
+export interface McpPrompt {
+    name: string;
+    title?: string;
+    description?: string;
+    arguments?: Array<{
+        name: string;
+        description?: string;
+        required?: boolean;
+    }>;
+}

package/dist/mcp/protocol.js

@@ -0,0 +1,14 @@
+/**
+ * Minimal Model Context Protocol types and JSON-RPC framing.
+ *
+ * Implemented directly rather than via an SDK so the harness has no runtime
+ * dependency for MCP and we control reconnect/timeout behaviour.
+ */
+export const MCP_PROTOCOL_VERSION = "2025-06-18";
+export function isResponse(msg) {
+    return "id" in msg && !("method" in msg);
+}
+export function isRequest(msg) {
+    return "id" in msg && "method" in msg;
+}
+//# sourceMappingURL=protocol.js.map

package/dist/mcp/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AA8BjD,MAAM,UAAU,UAAU,CAAC,GAAmB;IAC5C,OAAO,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,OAAO,IAAI,IAAI,GAAG,IAAI,QAAQ,IAAI,GAAG,CAAC;AACxC,CAAC"}

package/dist/mcp/registry.d.ts

@@ -0,0 +1,52 @@
+import type { McpServerConfig } from "./client.ts";
+/**
+ * The connectors on offer, as data.
+ *
+ * A first connector should not require knowing a package name, so a short list
+ * of the ones published by the MCP project itself ships with the harness. It
+ * layers exactly like the model catalog: the bundled file, then the user's own,
+ * so adding a connector to the menu never means editing code.
+ *
+ * What this is not: an installer. Nothing is downloaded here — an entry is a
+ * command line and a description, and starting it is the same `addMcpServer`
+ * path a hand-written config takes.
+ */
+export interface ConnectorEntry {
+    id: string;
+    label: string;
+    description?: string;
+    /** Who publishes the server, shown so an entry is attributable. */
+    publisher?: string;
+    docsUrl?: string;
+    /** The vendor's site, from which the menu resolves an icon. */
+    siteUrl?: string;
+    /** Still carrying its placeholders; resolve with `connectorConfig`. */
+    config: McpServerConfig;
+}
+/** Where a user's own connector list lives; layered over the bundled one. */
+export declare function userRegistryPath(): string;
+/**
+ * Every connector on offer, bundled first and the user's own over the top.
+ *
+ * A registry that fails to parse is skipped rather than thrown: the menu it
+ * feeds is an offer, and a broken file in one of two places should not take
+ * the composer down with it.
+ */
+export declare function officialConnectors(): Promise<ConnectorEntry[]>;
+/**
+ * One entry's configuration, with its *location* placeholders filled in.
+ *
+ * `${project}` and `${home}` are resolved here because a connector that works
+ * on files has to be told which files, and the answer is a path the registry
+ * cannot know when it is written.
+ *
+ * `${env:NAME}` is deliberately **left alone**. What comes back from here is
+ * what gets written to the user's config file, and a resolved secret in that
+ * file is a secret on disk in plain text. Those are expanded at connect time
+ * instead — see `expandSecrets` — so the file keeps the reference and only the
+ * running process ever sees the value.
+ */
+export declare function connectorConfig(entry: ConnectorEntry, where: {
+    project: string;
+    home: string;
+}): McpServerConfig;

package/dist/mcp/registry.js

@@ -0,0 +1,100 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { userPath } from "../paths.js";
+import { parseJson } from "../util/json.js";
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+/** Where a user's own connector list lives; layered over the bundled one. */
+export function userRegistryPath() {
+    return process.env["OHARNESS_CONNECTORS"] ?? userPath("connectors.json");
+}
+/**
+ * Every connector on offer, bundled first and the user's own over the top.
+ *
+ * A registry that fails to parse is skipped rather than thrown: the menu it
+ * feeds is an offer, and a broken file in one of two places should not take
+ * the composer down with it.
+ */
+export async function officialConnectors() {
+    const byId = new Map();
+    for (const source of [path.join(HERE, "registry.json"), userRegistryPath()]) {
+        for (const entry of await readRegistry(source))
+            byId.set(entry.id, entry);
+    }
+    return [...byId.values()];
+}
+/**
+ * One entry's configuration, with its *location* placeholders filled in.
+ *
+ * `${project}` and `${home}` are resolved here because a connector that works
+ * on files has to be told which files, and the answer is a path the registry
+ * cannot know when it is written.
+ *
+ * `${env:NAME}` is deliberately **left alone**. What comes back from here is
+ * what gets written to the user's config file, and a resolved secret in that
+ * file is a secret on disk in plain text. Those are expanded at connect time
+ * instead — see `expandSecrets` — so the file keeps the reference and only the
+ * running process ever sees the value.
+ */
+export function connectorConfig(entry, where) {
+    const fill = (value) => value.replace(/\$\{(project|home)\}/g, (_, name) => name === "project" ? where.project : where.home);
+    const fillAll = (values) => Object.fromEntries(Object.entries(values).map(([key, value]) => [key, fill(value)]));
+    if (entry.config.type === "http") {
+        return {
+            ...entry.config,
+            url: fill(entry.config.url),
+            // Headers were being passed through unfilled, which made a placeholder
+            // in one silently reach the server as literal text.
+            ...(entry.config.headers ? { headers: fillAll(entry.config.headers) } : {}),
+        };
+    }
+    return {
+        ...entry.config,
+        command: fill(entry.config.command),
+        ...(entry.config.args ? { args: entry.config.args.map(fill) } : {}),
+        ...(entry.config.cwd ? { cwd: fill(entry.config.cwd) } : {}),
+        ...(entry.config.env ? { env: fillAll(entry.config.env) } : {}),
+    };
+}
+async function readRegistry(file) {
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const parsed = parseJson(raw);
+    if (!parsed.ok)
+        return [];
+    const connectors = parsed.value.connectors;
+    if (!connectors || typeof connectors !== "object")
+        return [];
+    const out = [];
+    for (const [id, value] of Object.entries(connectors)) {
+        const entry = value;
+        // An entry with no runnable configuration is a typo, and offering it would
+        // put a row in the menu that can only ever fail.
+        if (!entry || typeof entry !== "object" || !isRunnable(entry.config))
+            continue;
+        out.push({
+            id,
+            label: typeof entry.label === "string" ? entry.label : id,
+            ...(typeof entry.description === "string" ? { description: entry.description } : {}),
+            ...(typeof entry.publisher === "string" ? { publisher: entry.publisher } : {}),
+            ...(typeof entry.docsUrl === "string" ? { docsUrl: entry.docsUrl } : {}),
+            ...(typeof entry.siteUrl === "string" ? { siteUrl: entry.siteUrl } : {}),
+            config: entry.config,
+        });
+    }
+    return out;
+}
+function isRunnable(config) {
+    if (!config || typeof config !== "object")
+        return false;
+    const candidate = config;
+    if (candidate.type === "stdio")
+        return typeof candidate.command === "string";
+    return candidate.type === "http" && typeof candidate.url === "string";
+}
+//# sourceMappingURL=registry.js.map

package/dist/mcp/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/mcp/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AA6B5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,MAAM,YAAY,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,KAAwC;IAExC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CACrC,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CACzD,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAChD,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,MAA8B,EAA0B,EAAE,CACzE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvF,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO;YACL,GAAG,KAAK,CAAC,MAAM;YACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3B,uEAAuE;YACvE,oDAAoD;YACpD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,KAAK,CAAC,MAAM;QACf,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAA2C,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;IAC3C,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAE7D,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/E,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACzD,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,SAAS,GAAG,MAA8D,CAAC;IACjF,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC;AACxE,CAAC"}