@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/mcp/connection-api.js

@@ -0,0 +1,506 @@
+/**
+ * Owner-only MCP connection management. Implements the four endpoints listed
+ * in §2 of 260604-PLAN-vana-mcp-personal-server.md:
+ *
+ *   POST   /v1/mcp/connections
+ *   GET    /v1/mcp/connections
+ *   POST   /v1/mcp/connections/:id/approve
+ *   DELETE /v1/mcp/connections/:id
+ *
+ * These endpoints DO NOT read user data. They only manage connection records
+ * — create the per-connection grantee/token, store grant ids after the user
+ * approves them, and mark connections revoked.
+ */
+import { generateMcpGrantee } from "./grantee.js";
+import { createGrantContract } from "../contracts/index.js";
+import { appUrlFromOAuthRedirectUri, ensureMcpGranteeRegistered, McpGranteeRegistrationError, } from "./builder-registration.js";
+import { MCP_SCOPE_ACCESS_REQUEST_LIMIT } from "./types.js";
+import { isMcpRefreshExpired, MCP_TOKEN_TTL_MS, mcpRefreshExpiry, mcpTokenExpiry, } from "./token-expiry.js";
+const TOKEN_BYTES = 32;
+const OAUTH_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
+/** Store patch that drops every refresh token a connection still answers to. */
+const CLEARED_REFRESH_FAMILY = {
+    refreshTokenHash: undefined,
+    previousRefreshTokenHash: undefined,
+    refreshExpiresAt: undefined,
+};
+function nowIso(now) {
+    return (now ? now() : new Date()).toISOString();
+}
+function nowMs(now) {
+    return (now ? now() : new Date()).getTime();
+}
+function randomBytes(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+}
+function bytesToHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function bytesToBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    // `btoa` exists in modern browsers AND Node ≥18 (the engines version that
+    // PS Lite and personal-server-ts already target).
+    const base64 = btoa(binary);
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function hashConnectionToken(token) {
+    const data = new TextEncoder().encode(token);
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+    return bytesToHex(new Uint8Array(digest));
+}
+function randomId() {
+    return (globalThis.crypto?.randomUUID?.() ?? `mcp-${bytesToHex(randomBytes(8))}`);
+}
+function randomToken() {
+    return bytesToBase64Url(randomBytes(TOKEN_BYTES));
+}
+export async function createMcpConnection(input, options) {
+    const grantee = generateMcpGrantee();
+    const token = randomToken();
+    const tokenHash = await hashConnectionToken(token);
+    const id = randomId();
+    const createdAt = nowIso(options.now);
+    const record = {
+        id,
+        displayName: input.displayName?.trim() || "Claude",
+        granteeAddress: grantee.key.address,
+        granteePublicKey: grantee.key.publicKey,
+        encryptedGranteePrivateKey: grantee.key.encryptedPrivateKey,
+        tokenHash,
+        tokenExpiresAt: mcpTokenExpiry(nowMs(options.now)),
+        status: "pending",
+        grants: [],
+        createdAt,
+    };
+    await options.store.create(record);
+    return {
+        connectionId: id,
+        granteeAddress: grantee.key.address,
+        connectionToken: token,
+        mcpUrl: buildMcpUrl(options.publicOrigin, token),
+        createdAt,
+    };
+}
+export function buildMcpUrl(publicOrigin, token) {
+    const base = publicOrigin.endsWith("/")
+        ? publicOrigin.slice(0, -1)
+        : publicOrigin;
+    return `${base}/mcp/${encodeURIComponent(token)}`;
+}
+export function buildStableMcpUrl(publicOrigin) {
+    const base = publicOrigin.endsWith("/")
+        ? publicOrigin.slice(0, -1)
+        : publicOrigin;
+    return `${base}/mcp`;
+}
+export function buildMcpProtectedResourceMetadataUrl(publicOrigin) {
+    const base = publicOrigin.endsWith("/")
+        ? publicOrigin.slice(0, -1)
+        : publicOrigin;
+    return `${base}/.well-known/oauth-protected-resource/mcp`;
+}
+export class McpConnectionNotFoundError extends Error {
+    connectionId;
+    constructor(connectionId) {
+        super(`mcp connection ${connectionId} not found`);
+        this.connectionId = connectionId;
+    }
+}
+export class McpConnectionStateError extends Error {
+    connectionId;
+    state;
+    expected;
+    constructor(connectionId, state, expected) {
+        super(`mcp connection ${connectionId} is ${state}; expected ${expected}`);
+        this.connectionId = connectionId;
+        this.state = state;
+        this.expected = expected;
+    }
+}
+export async function approveMcpConnection(input, options) {
+    if (!input.grants.length) {
+        throw new Error("approveMcpConnection requires at least one grant; the consent flow must mint grants first");
+    }
+    const approvedAt = nowIso(options.now);
+    const updated = await options.store.mutate(input.connectionId, (existing) => {
+        if (existing.status === "revoked") {
+            throw new McpConnectionStateError(input.connectionId, existing.status, "pending or approved");
+        }
+        const pendingRequest = existing.scopeAccessRequest;
+        const remainingRequestScopes = pendingRequest?.scopes.filter((scope) => !input.grants.some((grant) => grantCoversScope(grant, scope)));
+        return {
+            ...existing,
+            status: "approved",
+            grants: input.grants,
+            approvedAt,
+            scopeAccessRequest: pendingRequest &&
+                remainingRequestScopes &&
+                remainingRequestScopes.length > 0
+                ? { ...pendingRequest, scopes: remainingRequestScopes }
+                : undefined,
+        };
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    return updated;
+}
+function grantCoversScope(grant, scope) {
+    return grant.scopes.some((granted) => granted === "*" ||
+        granted === scope ||
+        (granted.endsWith(".*") && scope.startsWith(granted.slice(0, -1))));
+}
+export async function requestMcpScopeAccess(input, options) {
+    const requestedAt = nowIso(options.now);
+    const inputScopes = Array.from(new Set(input.scopes.map((scope) => scope.trim()).filter(Boolean))).sort();
+    const updated = await options.store.mutate(input.connectionId, (existing) => {
+        if (existing.status !== "approved") {
+            throw new McpConnectionStateError(input.connectionId, existing.status, "approved");
+        }
+        const scopes = Array.from(new Set([...(existing.scopeAccessRequest?.scopes ?? []), ...inputScopes]
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0 &&
+            !existing.grants.some((grant) => grantCoversScope(grant, scope))))).sort();
+        if (scopes.length === 0)
+            return existing;
+        if (scopes.length > MCP_SCOPE_ACCESS_REQUEST_LIMIT)
+            return existing;
+        const reason = input.reason?.trim() || existing.scopeAccessRequest?.reason;
+        const request = {
+            scopes,
+            ...(reason ? { reason } : {}),
+            requestedAt,
+        };
+        return { ...existing, scopeAccessRequest: request };
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    const missingInputScopes = inputScopes.filter((scope) => !updated.grants.some((grant) => grantCoversScope(grant, scope)));
+    return {
+        connection: updated,
+        requestRecorded: missingInputScopes.length > 0 &&
+            missingInputScopes.every((scope) => updated.scopeAccessRequest?.scopes.includes(scope)),
+    };
+}
+export async function revokeMcpConnection(connectionId, options) {
+    const existing = await options.store.getById(connectionId);
+    if (!existing)
+        throw new McpConnectionNotFoundError(connectionId);
+    if (existing.status === "revoked")
+        return existing;
+    const revokedAt = nowIso(options.now);
+    // The refresh token outlives the access token by weeks, so a revoke that
+    // left it in place would hand the holder a fresh bearer minutes later.
+    const updated = await options.store.update(connectionId, {
+        status: "revoked",
+        revokedAt,
+        ...CLEARED_REFRESH_FAMILY,
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(connectionId);
+    return updated;
+}
+export function toMcpConnectionView(record) {
+    return {
+        id: record.id,
+        displayName: record.displayName,
+        granteeAddress: record.granteeAddress,
+        status: record.status,
+        grants: record.grants,
+        scopeAccessRequest: record.scopeAccessRequest,
+        createdAt: record.createdAt,
+        approvedAt: record.approvedAt,
+        revokedAt: record.revokedAt,
+        lastUsedAt: record.lastUsedAt,
+    };
+}
+export async function listMcpConnectionViews(store) {
+    const records = await store.list();
+    return records.map(toMcpConnectionView);
+}
+export class McpOAuthAuthorizationError extends Error {
+    code;
+    status;
+    body;
+    constructor(code, message, status = 400, body) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.body = body;
+        this.name = "McpOAuthAuthorizationError";
+    }
+}
+export async function createMcpOAuthAuthorization(input, options) {
+    if (!input.clientId.trim()) {
+        throw new McpOAuthAuthorizationError("invalid_client", "client_id is required");
+    }
+    if (!input.redirectUri.trim()) {
+        throw new McpOAuthAuthorizationError("invalid_request", "redirect_uri is required");
+    }
+    if (!input.codeChallenge.trim()) {
+        throw new McpOAuthAuthorizationError("invalid_request", "code_challenge is required");
+    }
+    if (input.codeChallengeMethod !== "S256") {
+        throw new McpOAuthAuthorizationError("invalid_request", "Only S256 PKCE is supported");
+    }
+    const now = options.now ? options.now() : new Date();
+    const expiresAt = new Date(now.getTime() + OAUTH_AUTHORIZATION_TTL_MS).toISOString();
+    const created = await createMcpConnection({ displayName: "Claude" }, {
+        store: options.connectionStore,
+        publicOrigin: options.publicOrigin,
+        now: () => now,
+    });
+    const authorizationId = randomId();
+    const record = {
+        id: authorizationId,
+        clientId: input.clientId,
+        redirectUri: input.redirectUri,
+        codeChallenge: input.codeChallenge,
+        codeChallengeMethod: "S256",
+        ...(input.scope ? { scope: input.scope } : {}),
+        ...(input.state ? { state: input.state } : {}),
+        connectionId: created.connectionId,
+        granteeAddress: created.granteeAddress,
+        status: "pending",
+        createdAt: now.toISOString(),
+        expiresAt,
+    };
+    await options.authorizationStore.create(record);
+    return {
+        authorizationId,
+        connectionId: created.connectionId,
+        granteeAddress: created.granteeAddress,
+        expiresAt,
+    };
+}
+export function toMcpOAuthAuthorizationView(record) {
+    return {
+        id: record.id,
+        clientId: record.clientId,
+        redirectUri: record.redirectUri,
+        ...(record.scope ? { scope: record.scope } : {}),
+        ...(record.state ? { state: record.state } : {}),
+        connectionId: record.connectionId,
+        granteeAddress: record.granteeAddress,
+        status: record.status,
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+    };
+}
+export async function approveMcpOAuthAuthorization(input, options) {
+    const record = await options.authorizationStore.getById(input.authorizationId);
+    if (!record) {
+        throw new McpOAuthAuthorizationError("not_found", `mcp oauth authorization ${input.authorizationId} not found`);
+    }
+    if (record.status !== "pending") {
+        throw new McpOAuthAuthorizationError("invalid_state", `mcp oauth authorization ${input.authorizationId} is ${record.status}; expected pending`);
+    }
+    if (Date.parse(record.expiresAt) <= (options.now?.() ?? new Date()).getTime()) {
+        await options.authorizationStore.update(record.id, { status: "expired" });
+        throw new McpOAuthAuthorizationError("expired", "MCP OAuth authorization expired before approval");
+    }
+    if (input.grants.length === 0) {
+        throw new McpOAuthAuthorizationError("grants_required", "Approve requires at least one grant");
+    }
+    await approveMcpConnection({ connectionId: record.connectionId, grants: input.grants }, { store: options.connectionStore, now: options.now });
+    const authorizationCode = randomToken();
+    const authorizationCodeHash = await hashMcpOAuthAuthorizationCode(authorizationCode);
+    const approvedAt = (options.now ? options.now() : new Date()).toISOString();
+    await options.authorizationStore.update(record.id, {
+        status: "approved",
+        approvedAt,
+        authorizationCodeHash,
+    });
+    const redirectTo = new URL(record.redirectUri);
+    redirectTo.searchParams.set("code", authorizationCode);
+    if (record.state) {
+        redirectTo.searchParams.set("state", record.state);
+    }
+    return { redirectTo: redirectTo.toString(), authorizationCode };
+}
+export async function approveMcpOAuthAuthorizationWithScopes(input, options) {
+    const record = await options.authorizationStore.getById(input.authorizationId);
+    if (!record) {
+        throw new McpOAuthAuthorizationError("not_found", `mcp oauth authorization ${input.authorizationId} not found`, 404);
+    }
+    if (!Array.isArray(input.scopes) || input.scopes.length === 0) {
+        throw new McpOAuthAuthorizationError("scopes_required", "Approve requires at least one scope");
+    }
+    const connection = await options.connectionStore.getById(record.connectionId);
+    if (!connection) {
+        throw new McpOAuthAuthorizationError("connection_not_found", `mcp connection ${record.connectionId} not found`, 404);
+    }
+    try {
+        await ensureMcpGranteeRegistered({
+            connection,
+            gateway: options.gateway,
+            gatewayConfig: options.gatewayConfig,
+            gatewayUrl: options.gatewayUrl,
+            appUrl: appUrlFromOAuthRedirectUri(record.redirectUri, record.clientId),
+            fetch: options.fetch,
+        });
+    }
+    catch (err) {
+        if (err instanceof McpGranteeRegistrationError) {
+            throw new McpOAuthAuthorizationError(err.code, err.message, err.status ?? 502, err.body);
+        }
+        throw err;
+    }
+    const grantResult = await createGrantContract({
+        gateway: options.gateway,
+        serverOwner: options.serverOwner,
+        serverSigner: options.serverSigner,
+        body: {
+            granteeAddress: connection.granteeAddress,
+            scopes: input.scopes,
+            ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+            ...(input.nonce !== undefined ? { nonce: input.nonce } : {}),
+        },
+    });
+    if (!grantResult.ok) {
+        throw new McpOAuthAuthorizationError("grant_creation_failed", extractGrantErrorMessage(grantResult.body), grantResult.status, grantResult.body);
+    }
+    const grantId = grantResult.body.grantId;
+    if (!grantId) {
+        throw new McpOAuthAuthorizationError("grant_creation_failed", "Personal Server did not return a grant id.", 500, grantResult.body);
+    }
+    return approveMcpOAuthAuthorization({
+        authorizationId: input.authorizationId,
+        grants: [{ grantId, scopes: input.scopes }],
+    }, options);
+}
+export async function redeemMcpOAuthAuthorizationCode(input, options) {
+    const codeHash = await hashMcpOAuthAuthorizationCode(input.authorizationCode);
+    const record = await options.authorizationStore.getByCodeHash(codeHash);
+    if (!record) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "Unknown MCP authorization code");
+    }
+    if (record.status !== "approved") {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP authorization code has already been used or is not approved");
+    }
+    if (record.clientId !== input.clientId) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "client_id does not match authorization request");
+    }
+    if (record.redirectUri !== input.redirectUri) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "redirect_uri does not match authorization request");
+    }
+    if (Date.parse(record.expiresAt) <= (options.now?.() ?? new Date()).getTime()) {
+        await options.authorizationStore.update(record.id, { status: "expired" });
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP authorization code expired");
+    }
+    if (!(await verifyPkceS256({
+        codeVerifier: input.codeVerifier,
+        expectedChallenge: record.codeChallenge,
+    }))) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "PKCE verification failed");
+    }
+    const issued = await issueMcpTokenPair({
+        connectionId: record.connectionId,
+        clientId: record.clientId,
+        issuedAtMs: nowMs(options.now),
+    }, options.connectionStore);
+    if (!issued) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP connection for authorization no longer exists");
+    }
+    await options.authorizationStore.update(record.id, {
+        status: "redeemed",
+        redeemedAt: (options.now ? options.now() : new Date()).toISOString(),
+    });
+    return {
+        ...issued,
+        ...(record.scope ? { scope: record.scope } : {}),
+    };
+}
+/**
+ * RFC 6749 §6 refresh grant with RFC 9700 §4.14.2 rotation: every exchange
+ * mints a new pair and retires the presented refresh token, so the MCP client
+ * renews silently instead of re-consenting once an hour.
+ */
+export async function refreshMcpOAuthToken(input, options) {
+    const presentedHash = await hashMcpRefreshToken(input.refreshToken);
+    const connection = await options.connectionStore.getByRefreshTokenHash(presentedHash);
+    if (!connection) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "Unknown MCP refresh token");
+    }
+    // Reuse detection. A rotated-out token still matching means two holders have
+    // the family — the legitimate client and a thief — and we cannot tell which
+    // one is calling, so the whole family dies. The access token keeps its own
+    // expiry: cutting it short would only punish the client that behaved.
+    if (connection.refreshTokenHash !== presentedHash) {
+        await options.connectionStore.update(connection.id, CLEARED_REFRESH_FAMILY);
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP refresh token was already rotated; the refresh family is revoked");
+    }
+    if (connection.status !== "approved") {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP connection is not approved");
+    }
+    if (connection.clientId !== input.clientId) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "client_id does not match the issued refresh token");
+    }
+    if (isMcpRefreshExpired(connection, nowMs(options.now))) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP refresh token expired");
+    }
+    const issued = await issueMcpTokenPair({
+        connectionId: connection.id,
+        clientId: input.clientId,
+        issuedAtMs: nowMs(options.now),
+        retiredRefreshHash: presentedHash,
+    }, options.connectionStore);
+    if (!issued) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP connection no longer exists");
+    }
+    return issued;
+}
+/**
+ * Mint one access/refresh pair. The rotation is a single store `update`, so a
+ * concurrent refresh either sees the old pair or the new one — never a
+ * connection with the old refresh already dead and no new one issued.
+ */
+async function issueMcpTokenPair(input, store) {
+    const accessToken = randomToken();
+    const refreshToken = randomToken();
+    const updated = await store.update(input.connectionId, {
+        clientId: input.clientId,
+        tokenHash: await hashConnectionToken(accessToken),
+        tokenExpiresAt: mcpTokenExpiry(input.issuedAtMs),
+        refreshTokenHash: await hashMcpRefreshToken(refreshToken),
+        previousRefreshTokenHash: input.retiredRefreshHash,
+        refreshExpiresAt: mcpRefreshExpiry(input.issuedAtMs),
+    });
+    if (!updated)
+        return null;
+    return {
+        accessToken,
+        refreshToken,
+        expiresIn: Math.floor(MCP_TOKEN_TTL_MS / 1000),
+    };
+}
+/** Domain-separated so a refresh token can never resolve as a bearer. */
+async function hashMcpRefreshToken(token) {
+    return hashConnectionToken(`mcp-oauth-refresh:${token}`);
+}
+async function hashMcpOAuthAuthorizationCode(code) {
+    return hashConnectionToken(`mcp-oauth-code:${code}`);
+}
+async function verifyPkceS256(input) {
+    const data = new TextEncoder().encode(input.codeVerifier);
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+    return bytesToBase64Url(new Uint8Array(digest)) === input.expectedChallenge;
+}
+function extractGrantErrorMessage(body) {
+    if (body && typeof body === "object") {
+        const record = body;
+        if (typeof record.message === "string")
+            return record.message;
+        const nested = record.error;
+        if (nested && typeof nested === "object") {
+            const message = nested.message;
+            if (typeof message === "string")
+                return message;
+        }
+    }
+    return "Could not create MCP grant";
+}
+//# sourceMappingURL=connection-api.js.map

package/dist/mcp/connection-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-api.js","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAM5D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AASnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,gFAAgF;AAChF,MAAM,sBAAsB,GAAG;IAC7B,gBAAgB,EAAE,SAAS;IAC3B,wBAAwB,EAAE,SAAS;IACnC,gBAAgB,EAAE,SAAS;CACnB,CAAC;AAEX,SAAS,MAAM,CAAC,GAAgB;IAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,KAAK,CAAC,GAAgB;IAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,CACL,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACpD,CAAC;AA2BD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B,EAC/B,OAAmC;IAEnC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAwB;QAClC,EAAE;QACF,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ;QAClD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QACnC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QACvC,0BAA0B,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC3D,SAAS;QACT,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE;QACV,SAAS;KACV,CAAC;IAEF,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QACnC,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,YAAY,CAAC;IACjB,OAAO,GAAG,IAAI,QAAQ,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,YAAY,CAAC;IACjB,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,YAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,YAAY,CAAC;IACjB,OAAO,GAAG,IAAI,2CAA2C,CAAC;AAC5D,CAAC;AAYD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAChC;IAAnB,YAAmB,YAAoB;QACrC,KAAK,CAAC,kBAAkB,YAAY,YAAY,CAAC,CAAC;QADjC,iBAAY,GAAZ,YAAY,CAAQ;IAEvC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEvC;IACA;IACA;IAHT,YACS,YAAoB,EACpB,KAAa,EACb,QAAgB;QAEvB,KAAK,CAAC,kBAAkB,YAAY,OAAO,KAAK,cAAc,QAAQ,EAAE,CAAC,CAAC;QAJnE,iBAAY,GAAZ,YAAY,CAAQ;QACpB,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;IAGzB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC,EAChC,OAAoC;IAEpC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,MAAM,EACf,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QACnD,MAAM,sBAAsB,GAAG,cAAc,EAAE,MAAM,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CACzE,CAAC;QACF,OAAO;YACL,GAAG,QAAQ;YACX,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;YACV,kBAAkB,EAChB,cAAc;gBACd,sBAAsB;gBACtB,sBAAsB,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,sBAAsB,EAAE;gBACvD,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,KAAa;IAChE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CACtB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,KAAK;QACjB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAkE,EAClE,OAAwD;IAKxD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CACnE,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,MAAM,EACf,UAAU,CACX,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CACnE,CACJ,CACF,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,GAAG,8BAA8B;YAAE,OAAO,QAAQ,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAC3E,MAAM,OAAO,GAA0B;YACrC,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,WAAW;SACZ,CAAC;QACF,OAAO,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAC3E,CAAC;IACF,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,eAAe,EACb,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC7B,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACjC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CACnD;KACJ,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,YAAoB,EACpB,OAAmC;IAEnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;QACvD,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAmBD,MAAM,UAAU,mBAAmB,CACjC,MAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC1C,CAAC;AAyBD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAE1C;IAEA;IACA;IAJT,YACS,IAAY,EACnB,OAAe,EACR,SAAS,GAAG,EACZ,IAAc;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QALR,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAM;QACZ,SAAI,GAAJ,IAAI,CAAU;QAGrB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAuC,EACvC,OAA2C;IAE3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,0BAA0B,CAClC,gBAAgB,EAChB,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,GAAG,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAC3C,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,EAAE,WAAW,EAAE,QAAQ,EAAE,EACzB;QACE,KAAK,EAAE,OAAO,CAAC,eAAe;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;KACf,CACF,CAAC;IACF,MAAM,eAAe,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,MAAM,GAAgC;QAC1C,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,mBAAmB,EAAE,MAAM;QAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS;KACV,CAAC;IACF,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEhD,OAAO;QACL,eAAe;QACf,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS;KACV,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,2BAA2B,CACzC,MAAmC;IAEnC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAyBD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwC,EACxC,OAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,WAAW,EACX,2BAA2B,KAAK,CAAC,eAAe,YAAY,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,2BAA2B,KAAK,CAAC,eAAe,OAAO,MAAM,CAAC,MAAM,oBAAoB,CACzF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EACzE,CAAC;QACD,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,0BAA0B,CAClC,SAAS,EACT,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,CACxB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAC3D,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrD,CAAC;IAEF,MAAM,iBAAiB,GAAG,WAAW,EAAE,CAAC;IACxC,MAAM,qBAAqB,GACzB,MAAM,6BAA6B,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,EAAE,UAAU;QAClB,UAAU;QACV,qBAAqB;KACtB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,iBAAiB,EAAE,CAAC;AAClE,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA8C,EAC9C,OAAkD;IAElD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,WAAW,EACX,2BAA2B,KAAK,CAAC,eAAe,YAAY,EAC5D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,kBAAkB,MAAM,CAAC,YAAY,YAAY,EACjD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,0BAA0B,CAAC;YAC/B,UAAU;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;YACvE,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAC/C,MAAM,IAAI,0BAA0B,CAClC,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,MAAM,IAAI,GAAG,EACjB,GAAG,CAAC,IAAI,CACT,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,IAAI,EAAE;YACJ,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D;KACF,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAClC,uBAAuB,EACvB,wBAAwB,CAAC,WAAW,CAAC,IAAI,CAAC,EAC1C,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAI,WAAW,CAAC,IAA6B,CAAC,OAAO,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0BAA0B,CAClC,uBAAuB,EACvB,4CAA4C,EAC5C,GAAG,EACH,WAAW,CAAC,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,4BAA4B,CACjC;QACE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAC5C,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AA0BD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA2C,EAC3C,OAA+C;IAE/C,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EACzE,CAAC;QACD,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,MAAM,cAAc,CAAC;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;KACxC,CAAC,CAAC,EACH,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC;QACE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;KAC/B,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC,EAChC,OAAoC;IAEpC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,UAAU,GACd,MAAM,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,UAAU,CAAC,gBAAgB,KAAK,aAAa,EAAE,CAAC;QAClD,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC5E,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC;QACE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,kBAAkB,EAAE,aAAa;KAClC,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAA6B,EAC7B,KAAyB;IAEzB,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,mBAAmB,CAAC,WAAW,CAAC;QACjD,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;QAChD,gBAAgB,EAAE,MAAM,mBAAmB,CAAC,YAAY,CAAC;QACzD,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,mBAAmB,CAAC,KAAa;IAC9C,OAAO,mBAAmB,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,IAAY;IACvD,OAAO,mBAAmB,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAG7B;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,gBAAgB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,iBAAiB,CAAC;AAC9E,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAa;IAC7C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,OAAO,GAAI,MAAkC,CAAC,OAAO,CAAC;YAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,4BAA4B,CAAC;AACtC,CAAC"}

package/dist/mcp/grantee.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Per-connection MCP grantee key generation + Web3Signed request signing.
+ *
+ * Each MCP connection gets a fresh secp256k1 keypair. The PS route uses this
+ * keypair to sign every read it performs on behalf of the connection so:
+ *
+ *  1. The data read flows through `authorizeBuilderRead` exactly like any
+ *     external builder request.
+ *  2. The access log records the per-connection grantee address, not the
+ *     owner.
+ *  3. Disconnecting one MCP client cannot affect another or the owner.
+ *
+ * This module does NOT do encryption-at-rest. The caller chooses the storage
+ * representation (`McpEncryptedPrivateKey`) — for Node the `plaintext` variant
+ * is fine (same trust boundary as the on-disk server key); for Web PS Lite the
+ * caller should wrap with the owner-derived master key.
+ */
+import type { ServerAccount } from "../keys/server-account.js";
+import type { McpEncryptedPrivateKey } from "./types.js";
+export interface McpGranteeKey {
+    address: `0x${string}`;
+    publicKey: `0x${string}`;
+    encryptedPrivateKey: McpEncryptedPrivateKey;
+}
+export interface GeneratedMcpGrantee {
+    key: McpGranteeKey;
+    account: ServerAccount;
+}
+/**
+ * Generate a new MCP grantee keypair and return both the persisted
+ * (plaintext-wrapped) form and a ready-to-sign `ServerAccount`.
+ */
+export declare function generateMcpGrantee(): GeneratedMcpGrantee;
+/**
+ * Reconstruct a `ServerAccount` from a persisted MCP grantee record.
+ * Only `plaintext` is supported here; Web PS Lite must decrypt to plaintext
+ * before calling.
+ */
+export declare function loadMcpGranteeAccount(key: McpGranteeKey): ServerAccount;
+/**
+ * Build a Web3Signed Authorization header that authenticates the bearer as the
+ * MCP connection's grantee for a given grant id and request URL.
+ */
+export declare function signMcpGranteeRequest(params: {
+    account: ServerAccount;
+    aud: string;
+    method: string;
+    uri: string;
+    grantId: string;
+    body?: Uint8Array;
+}): Promise<string>;
+//# sourceMappingURL=grantee.d.ts.map

package/dist/mcp/grantee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantee.d.ts","sourceRoot":"","sources":["../../src/mcp/grantee.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,sBAAsB,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,mBAAmB,CA8BxD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0BvE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,aAAa,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB"}