@opendatalabs/personal-server-ts-lite 0.0.1-canary.00328bf

package/dist/mcp-store.js

@@ -0,0 +1,208 @@
+/**
+ * IndexedDB-backed `McpConnectionStore` for Web PS Lite.
+ *
+ * Phase 1 trade-off: persists the per-connection grantee private key in
+ * PLAINTEXT in IndexedDB. The owner-derived AES-GCM wrap used for the PS Lite
+ * server identity is not yet applied to grantee keys — that's the Phase 2
+ * "encrypt grantee private keys at rest" task in
+ * `260604-PLAN-vana-mcp-personal-server.md`. The risk is bounded by:
+ *
+ *   1. The browser same-origin policy — only code running on the PS Lite tab's
+ *      origin (e.g. app-dev.vana.org) can read this store.
+ *   2. Grantee keys are scoped per-connection and revocable. A leaked key only
+ *      lets the holder read the grants that connection already approved; any
+ *      revoke removes both the grant and the connection's lookup record.
+ *   3. There are no write tools — leaked grantee keys cannot mutate user data.
+ *
+ * Persistent storage is strongly preferred over in-memory because:
+ *   - app-dev page reloads are routine in a browser app;
+ *   - Claude's MCP URL is meant to live in the Claude config across sessions;
+ *   - the alternative (re-create on every boot) would silently invalidate every
+ *     prior Claude connection on every reload, indistinguishable from a real
+ *     revoke from the user's perspective.
+ */
+import { isMcpTokenExpired, matchesMcpRefreshHash, } from "@opendatalabs/personal-server-ts-core/mcp";
+const DEFAULT_DB_NAME = "personal-server-lite";
+const DEFAULT_STORE_NAME = "mcpConnections";
+const DEFAULT_AUTHORIZATION_STORE_NAME = "mcpOAuthAuthorizations";
+const TOKEN_HASH_INDEX = "tokenHash";
+const AUTHORIZATION_CODE_HASH_INDEX = "authorizationCodeHash";
+const DB_VERSION = 2;
+const CONNECTION_INDEXES = [
+    { name: TOKEN_HASH_INDEX, keyPath: "tokenHash", unique: true },
+];
+const AUTHORIZATION_INDEXES = [
+    {
+        name: AUTHORIZATION_CODE_HASH_INDEX,
+        keyPath: "authorizationCodeHash",
+        unique: true,
+    },
+];
+const DEFAULT_CONNECTION_OPTIONS = {
+    dbName: DEFAULT_DB_NAME,
+    storeName: DEFAULT_STORE_NAME,
+};
+const DEFAULT_AUTHORIZATION_OPTIONS = {
+    dbName: DEFAULT_DB_NAME,
+    storeName: DEFAULT_AUTHORIZATION_STORE_NAME,
+};
+function ensureObjectStore(db, transaction, opts, indexes) {
+    const store = db.objectStoreNames.contains(opts.storeName)
+        ? transaction?.objectStore(opts.storeName)
+        : db.createObjectStore(opts.storeName, { keyPath: "id" });
+    if (!store)
+        return;
+    for (const index of indexes) {
+        if (!store.indexNames.contains(index.name)) {
+            store.createIndex(index.name, index.keyPath, { unique: index.unique });
+        }
+    }
+}
+function openDb(opts, indexes) {
+    if (typeof indexedDB === "undefined") {
+        throw new Error("IndexedDB is not available in this runtime");
+    }
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(opts.dbName, DB_VERSION);
+        request.onupgradeneeded = () => {
+            const db = request.result;
+            ensureObjectStore(db, request.transaction, opts, indexes);
+            ensureObjectStore(db, request.transaction, DEFAULT_CONNECTION_OPTIONS, CONNECTION_INDEXES);
+            ensureObjectStore(db, request.transaction, DEFAULT_AUTHORIZATION_OPTIONS, AUTHORIZATION_INDEXES);
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+function runTx(opts, mode, indexes, fn) {
+    return openDb(opts, indexes).then((db) => new Promise((resolve, reject) => {
+        const transaction = db.transaction(opts.storeName, mode);
+        const store = transaction.objectStore(opts.storeName);
+        const request = fn(store);
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+        transaction.oncomplete = () => db.close();
+        transaction.onerror = () => {
+            db.close();
+            reject(transaction.error);
+        };
+    }));
+}
+function runIndexQuery(opts, indexName, indexes, fn) {
+    return openDb(opts, indexes).then((db) => new Promise((resolve, reject) => {
+        const transaction = db.transaction(opts.storeName, "readonly");
+        const store = transaction.objectStore(opts.storeName);
+        const request = fn(store.index(indexName));
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+        transaction.oncomplete = () => db.close();
+        transaction.onerror = () => {
+            db.close();
+            reject(transaction.error);
+        };
+    }));
+}
+function mutateConnectionRecord(opts, id, update) {
+    return openDb(opts, CONNECTION_INDEXES).then((db) => new Promise((resolve, reject) => {
+        const transaction = db.transaction(opts.storeName, "readwrite");
+        const store = transaction.objectStore(opts.storeName);
+        const request = store.get(id);
+        let result = null;
+        request.onsuccess = () => {
+            if (!request.result)
+                return;
+            result = update(structuredClone(request.result));
+            store.put(result);
+        };
+        request.onerror = () => reject(request.error);
+        transaction.oncomplete = () => {
+            db.close();
+            resolve(result ? structuredClone(result) : null);
+        };
+        transaction.onerror = () => {
+            db.close();
+            reject(transaction.error);
+        };
+    }));
+}
+export function createIndexedDbMcpConnectionStore(options = {}) {
+    const resolved = {
+        dbName: options.dbName ?? DEFAULT_DB_NAME,
+        storeName: options.storeName ?? DEFAULT_STORE_NAME,
+    };
+    return {
+        async create(record) {
+            const existing = await runTx(resolved, "readonly", CONNECTION_INDEXES, (store) => store.get(record.id));
+            if (existing) {
+                throw new Error(`mcp connection ${record.id} already exists`);
+            }
+            await runTx(resolved, "readwrite", CONNECTION_INDEXES, (store) => store.put({ ...record }));
+        },
+        async list() {
+            const all = await runTx(resolved, "readonly", CONNECTION_INDEXES, (store) => store.getAll());
+            return all.map((r) => ({ ...r }));
+        },
+        async getById(id) {
+            const record = await runTx(resolved, "readonly", CONNECTION_INDEXES, (store) => store.get(id));
+            return record ? { ...record } : null;
+        },
+        async getByTokenHash(tokenHash) {
+            const record = await runIndexQuery(resolved, TOKEN_HASH_INDEX, CONNECTION_INDEXES, (index) => index.get(tokenHash));
+            if (!record)
+                return null;
+            if (record.status !== "approved")
+                return null;
+            if (isMcpTokenExpired(record))
+                return null;
+            return { ...record };
+        },
+        async getByRefreshTokenHash(refreshTokenHash) {
+            // No IndexedDB index: a presented token may match either the current or
+            // the rotated-out hash, and the store holds a handful of connections.
+            const all = await runTx(resolved, "readonly", CONNECTION_INDEXES, (store) => store.getAll());
+            const record = all.find((candidate) => matchesMcpRefreshHash(candidate, refreshTokenHash));
+            return record ? { ...record } : null;
+        },
+        mutate(id, update) {
+            return mutateConnectionRecord(resolved, id, update);
+        },
+        async update(id, patch) {
+            return mutateConnectionRecord(resolved, id, (existing) => ({ ...existing, ...patch }));
+        },
+    };
+}
+export function createIndexedDbMcpOAuthAuthorizationStore(options = {}) {
+    const resolved = {
+        dbName: options.dbName ?? DEFAULT_DB_NAME,
+        storeName: options.storeName ?? DEFAULT_AUTHORIZATION_STORE_NAME,
+    };
+    return {
+        async create(record) {
+            const existing = await runTx(resolved, "readonly", AUTHORIZATION_INDEXES, (store) => store.get(record.id));
+            if (existing) {
+                throw new Error(`mcp oauth authorization ${record.id} already exists`);
+            }
+            await runTx(resolved, "readwrite", AUTHORIZATION_INDEXES, (store) => store.put({ ...record }));
+        },
+        async getById(id) {
+            const record = await runTx(resolved, "readonly", AUTHORIZATION_INDEXES, (store) => store.get(id));
+            return record ? { ...record } : null;
+        },
+        async getByCodeHash(authorizationCodeHash) {
+            const record = await runIndexQuery(resolved, AUTHORIZATION_CODE_HASH_INDEX, AUTHORIZATION_INDEXES, (index) => index.get(authorizationCodeHash));
+            return record ? { ...record } : null;
+        },
+        async update(id, patch) {
+            const existing = await runTx(resolved, "readonly", AUTHORIZATION_INDEXES, (store) => store.get(id));
+            if (!existing)
+                return null;
+            const updated = { ...existing, ...patch };
+            await runTx(resolved, "readwrite", AUTHORIZATION_INDEXES, (store) => store.put(updated));
+            return { ...updated };
+        },
+        async delete(id) {
+            await runTx(resolved, "readwrite", AUTHORIZATION_INDEXES, (store) => store.delete(id));
+        },
+    };
+}
+//# sourceMappingURL=mcp-store.js.map

package/dist/mcp-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-store.js","sourceRoot":"","sources":["../src/mcp-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAKtB,MAAM,2CAA2C,CAAC;AAEnD,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AAClE,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AAC9D,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,MAAM,kBAAkB,GAAG;IACzB,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;CACtD,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,uBAAuB;QAChC,MAAM,EAAE,IAAI;KACb;CACO,CAAC;AAiBX,MAAM,0BAA0B,GAAoB;IAClD,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,kBAAkB;CAC9B,CAAC;AAEF,MAAM,6BAA6B,GAAoB;IACrD,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,gCAAgC;CAC5C,CAAC;AAEF,SAAS,iBAAiB,CACxB,EAAe,EACf,WAA8C,EAC9C,IAAqB,EACrB,OAAsE;IAEtE,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QACxD,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,IAAqB,EACrB,OAAsE;IAEtE,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;YAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1D,iBAAiB,CACf,EAAE,EACF,OAAO,CAAC,WAAW,EACnB,0BAA0B,EAC1B,kBAAkB,CACnB,CAAC;YACF,iBAAiB,CACf,EAAE,EACF,OAAO,CAAC,WAAW,EACnB,6BAA6B,EAC7B,qBAAqB,CACtB,CAAC;QACJ,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CACZ,IAAqB,EACrB,IAAwB,EACxB,OAAsE,EACtE,EAA4C;IAE5C,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAC/B,CAAC,EAAE,EAAE,EAAE,CACL,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,WAAW,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC1C,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE;YACzB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAqB,EACrB,SAAiB,EACjB,OAAsE,EACtE,EAAsC;IAEtC,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAC/B,CAAC,EAAE,EAAE,EAAE,CACL,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,WAAW,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC1C,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE;YACzB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,EAAU,EACV,MAA4D;IAE5D,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAC1C,CAAC,EAAE,EAAE,EAAE,CACL,IAAI,OAAO,CAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAE3B,CAAC;QACF,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO;YAC5B,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,WAAW,CAAC,UAAU,GAAG,GAAG,EAAE;YAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE;YACzB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,UAA8C,EAAE;IAEhD,MAAM,QAAQ,GAAoB;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;KACnD,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAChC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,KAAK,CACT,QAAQ,EACR,WAAW,EACX,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CACpC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAC1B,CAAC;YACF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CACzB,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,SAAS;YAC5B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAChC,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC9C,IAAI,iBAAiB,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,gBAAgB;YAC1C,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAC1B,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACpC,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CACnD,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,EAAE,EAAE,MAAM;YACf,OAAO,sBAAsB,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,OAAO,sBAAsB,CAC3B,QAAQ,EACR,EAAE,EACF,CAAC,QAAQ,EAAuB,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAC/D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,UAAsD,EAAE;IAExD,MAAM,QAAQ,GAAoB;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gCAAgC;KACjE,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAChC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CACT,QAAQ,EACR,WAAW,EACX,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CACpC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CACzB,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,qBAAqB;YACvC,MAAM,MAAM,GAAG,MAAM,aAAa,CAGhC,QAAQ,EACR,6BAA6B,EAC7B,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAC5C,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,OAAO,GAAgC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;YACvE,MAAM,KAAK,CACT,QAAQ,EACR,WAAW,EACX,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAC9B,CAAC;YACF,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,KAAK,CACT,QAAQ,EACR,WAAW,EACX,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/owner-binding.d.ts

@@ -0,0 +1,7 @@
+import { type Address } from "viem";
+export interface PsLiteOwnerBindingInput {
+    ownerAddress?: Address;
+    ownerSignature: `0x${string}`;
+}
+export declare function resolvePsLiteOwner(input: PsLiteOwnerBindingInput): Promise<Address>;
+//# sourceMappingURL=owner-binding.d.ts.map

package/dist/owner-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-binding.d.ts","sourceRoot":"","sources":["../src/owner-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqC,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAEvE,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;CAC/B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAclB"}

package/dist/owner-binding.js

@@ -0,0 +1,18 @@
+import { recoverServerOwner } from "@opendatalabs/vana-sdk/browser";
+import { buildPersonalServerLiteOwnerBindingMessage } from "@opendatalabs/vana-sdk/protocol/personal-server-lite-owner-binding";
+import { getAddress, recoverMessageAddress } from "viem";
+export async function resolvePsLiteOwner(input) {
+    if (!input.ownerAddress) {
+        return recoverServerOwner(input.ownerSignature);
+    }
+    const expected = getAddress(input.ownerAddress);
+    const recovered = await recoverMessageAddress({
+        message: buildPersonalServerLiteOwnerBindingMessage(expected),
+        signature: input.ownerSignature,
+    });
+    if (recovered.toLowerCase() !== expected.toLowerCase()) {
+        throw new Error("PS Lite owner signature does not match ownerAddress");
+    }
+    return expected;
+}
+//# sourceMappingURL=owner-binding.js.map

package/dist/owner-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-binding.js","sourceRoot":"","sources":["../src/owner-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,0CAA0C,EAAE,MAAM,oEAAoE,CAAC;AAChI,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAgB,MAAM,MAAM,CAAC;AAOvE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;QAC5C,OAAO,EAAE,0CAA0C,CAAC,QAAQ,CAAC;QAC7D,SAAS,EAAE,KAAK,CAAC,cAAc;KAChC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/persistence.d.ts

@@ -0,0 +1,69 @@
+import type { DataStoragePort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
+import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { McpConnectionStore, McpOAuthAuthorizationStore } from "@opendatalabs/personal-server-ts-core/mcp";
+import type { PsLiteRuntimeOptions, PsLiteTokenStore } from "./runtime.js";
+import { type PsLiteStateStore } from "./state.js";
+import type { PsLiteRelayTlsIdentityStore } from "./relay-tls.js";
+/**
+ * The complete set of PS Lite persistence ports, named as one composition
+ * contract for a host (Mobile) that backs them all with a single durable store.
+ *
+ * This is a struct of the EXISTING narrow contracts — it deliberately does not
+ * collapse them into one catch-all domain API. A host may implement each port
+ * over one SQLite database, but PS Lite keeps addressing them by their narrow
+ * responsibilities (data storage, key/value state, tokens, access logs, MCP
+ * connection/authorization records, relay TLS identity).
+ *
+ * `relayTlsIdentity` is consumed by the relay TLS factory
+ * (`createRustlsPsLiteRelayTlsFactory`), not the HTTP runtime. The start
+ * factory forwards it to the relay automatically. A supplied bundle is all or
+ * nothing: hosts must not accidentally combine native and browser persistence.
+ */
+export interface PsLitePersistenceBundle {
+    /** Data envelopes + index metadata. */
+    storage: DataStoragePort;
+    /** Key/value runtime state: config, encrypted server identity, relay, cursor. */
+    state: PsLiteStateStore;
+    /** Session/device access tokens. */
+    tokens: PsLiteTokenStore;
+    /** Access-log read + write. */
+    accessLog: AccessLogReader & AccessLogWriter;
+    /** Per-connection MCP records (grantee key, token hash, grants). */
+    mcpConnections: McpConnectionStore;
+    /** In-flight MCP OAuth authorization records. */
+    mcpOAuthAuthorizations: McpOAuthAuthorizationStore;
+    /** Issued relay TLS identity cache. Consumed by the relay TLS factory. */
+    relayTlsIdentity: PsLiteRelayTlsIdentityStore;
+}
+/**
+ * The subset of {@link PsLiteRuntimeOptions} that a persistence bundle supplies.
+ * Everything a caller still owns (auth, identity, gateway, signer, config
+ * values, sync manager) stays out of the bundle.
+ */
+export type PsLitePersistenceRuntimeOptions = Pick<PsLiteRuntimeOptions, "storage" | "tokenStore" | "accessLogReader" | "accessLogWriter" | "saveConfig" | "mcpConnectionStore" | "mcpOAuthAuthorizationStore"> & Required<Pick<PsLiteRuntimeOptions, "config">>;
+/**
+ * Map a {@link PsLitePersistenceBundle} onto the runtime option subset it backs,
+ * so a host can construct PS Lite with no direct browser storage dependency:
+ *
+ * ```ts
+ * const runtime = createPsLiteRuntime({
+ *   ...(await psLitePersistenceRuntimeOptions(bundle, configDefaults)),
+ *   auth,
+ *   identity,
+ *   serverOwner,
+ *   active: true,
+ * });
+ * ```
+ *
+ * `saveConfig` is derived from the injected state store via the existing
+ * `savePsLiteConfig` contract, so config writes land in the host's store.
+ */
+export declare function psLitePersistenceRuntimeOptions(bundle: PsLitePersistenceBundle, configDefaults?: Partial<ServerConfig>): Promise<PsLitePersistenceRuntimeOptions>;
+/**
+ * Defends the all-or-nothing bundle contract at the JavaScript boundary, where
+ * TypeScript's required properties are not enforced.
+ */
+export declare function assertCompletePsLitePersistenceBundle(bundle: PsLitePersistenceBundle | null | undefined): void;
+//# sourceMappingURL=persistence.d.ts.map

package/dist/persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,OAAO,EAAE,eAAe,CAAC;IACzB,iFAAiF;IACjF,KAAK,EAAE,gBAAgB,CAAC;IACxB,oCAAoC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,+BAA+B;IAC/B,SAAS,EAAE,eAAe,GAAG,eAAe,CAAC;IAC7C,oEAAoE;IACpE,cAAc,EAAE,kBAAkB,CAAC;IACnC,iDAAiD;IACjD,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,0EAA0E;IAC1E,gBAAgB,EAAE,2BAA2B,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,oBAAoB,EAClB,SAAS,GACT,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,YAAY,GACZ,oBAAoB,GACpB,4BAA4B,CAC/B,GACC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,uBAAuB,EAC/B,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CAgB1C;AAED;;;GAGG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,GACjD,IAAI,CAmBN"}

package/dist/persistence.js

@@ -0,0 +1,58 @@
+import { loadOrCreatePsLiteConfig, savePsLiteConfig, } from "./state.js";
+/**
+ * Map a {@link PsLitePersistenceBundle} onto the runtime option subset it backs,
+ * so a host can construct PS Lite with no direct browser storage dependency:
+ *
+ * ```ts
+ * const runtime = createPsLiteRuntime({
+ *   ...(await psLitePersistenceRuntimeOptions(bundle, configDefaults)),
+ *   auth,
+ *   identity,
+ *   serverOwner,
+ *   active: true,
+ * });
+ * ```
+ *
+ * `saveConfig` is derived from the injected state store via the existing
+ * `savePsLiteConfig` contract, so config writes land in the host's store.
+ */
+export async function psLitePersistenceRuntimeOptions(bundle, configDefaults) {
+    assertCompletePsLitePersistenceBundle(bundle);
+    const config = await loadOrCreatePsLiteConfig(bundle.state, configDefaults);
+    return {
+        storage: bundle.storage,
+        config,
+        tokenStore: bundle.tokens,
+        accessLogReader: bundle.accessLog,
+        accessLogWriter: bundle.accessLog,
+        saveConfig: async (nextConfig) => {
+            const saved = await savePsLiteConfig(bundle.state, nextConfig);
+            Object.assign(config, saved);
+        },
+        mcpConnectionStore: bundle.mcpConnections,
+        mcpOAuthAuthorizationStore: bundle.mcpOAuthAuthorizations,
+    };
+}
+/**
+ * Defends the all-or-nothing bundle contract at the JavaScript boundary, where
+ * TypeScript's required properties are not enforced.
+ */
+export function assertCompletePsLitePersistenceBundle(bundle) {
+    if (!bundle || typeof bundle !== "object") {
+        throw new Error("PS Lite persistence bundle must be a complete object");
+    }
+    const required = [
+        "storage",
+        "state",
+        "tokens",
+        "accessLog",
+        "mcpConnections",
+        "mcpOAuthAuthorizations",
+        "relayTlsIdentity",
+    ];
+    const missing = required.filter((key) => bundle[key] == null);
+    if (missing.length > 0) {
+        throw new Error(`PS Lite persistence bundle must be complete; missing ${missing.join(", ")}`);
+    }
+}
+//# sourceMappingURL=persistence.js.map

package/dist/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AASA,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAoDpB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAA+B,EAC/B,cAAsC;IAEtC,qCAAqC,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5E,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,UAAU,EAAE,KAAK,EAAE,UAAmB,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,kBAAkB,EAAE,MAAM,CAAC,cAAc;QACzC,0BAA0B,EAAE,MAAM,CAAC,sBAAsB;KAC1D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAAkD;IAElD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAsC;QAClD,SAAS;QACT,OAAO;QACP,QAAQ;QACR,WAAW;QACX,gBAAgB;QAChB,wBAAwB;QACxB,kBAAkB;KACnB,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/relay-tls.d.ts

@@ -0,0 +1,61 @@
+import type { PsLiteRelayTlsFactory } from "./relay.js";
+/**
+ * Persistence port for the relay's issued TLS identity. PS Lite runtime code
+ * resolves the cached cert through this injected store instead of reaching for
+ * `globalThis.localStorage` directly, so a non-browser host (Mobile) can back
+ * it with app-private storage. Browser callers get the localStorage-backed
+ * default via {@link createLocalStoragePsLiteRelayTlsIdentityStore}.
+ */
+export interface PsLiteRelayTlsIdentityStore {
+    read(hostname: string): Promise<PsLiteRelayTlsIdentity | null> | PsLiteRelayTlsIdentity | null;
+    write(identity: PsLiteRelayTlsIdentity): Promise<void> | void;
+}
+export interface RustlsPsLiteRelayTlsOptions {
+    controlUrl: string;
+    publicSuffix?: string;
+    certIssuerUrl?: string;
+    /**
+     * Injected persistence for the issued relay TLS identity. Omit to fall back
+     * to {@link storage} (or, if that is also omitted, the browser localStorage
+     * default). Non-browser hosts pass their own store to keep runtime code free
+     * of hidden `globalThis` access.
+     */
+    identityStore?: PsLiteRelayTlsIdentityStore;
+    /**
+     * @deprecated Prefer {@link identityStore}. A raw `Storage` is wrapped by
+     * {@link createLocalStoragePsLiteRelayTlsIdentityStore}. Retained so existing
+     * browser callers keep their exact localStorage behavior.
+     */
+    storage?: Storage;
+    logger?: (line: string) => void;
+    /**
+     * Max time to wait on the relay's certificate endpoint before treating this
+     * attempt as failed and serving the self-signed fallback. A hung issuer
+     * (observed live, BUI-666: the endpoint accepts the POST and never responds)
+     * would otherwise leave the identity promise pending forever — and every
+     * incoming TLS handshake awaits that promise, so the public endpoint serves
+     * zero bytes while the control session looks healthy.
+     *
+     * Default 60s. This preserves the old per-session ACME margin and is still
+     * bounded for a truly wedged relay endpoint.
+     */
+    issueCertTimeoutMs?: number;
+}
+export interface PsLiteRelayTlsIdentity {
+    certPem: string;
+    keyPem: string;
+    hostname: string;
+    source: "acme" | "self-signed" | "cached-acme";
+    trusted: boolean;
+}
+export declare function createRustlsPsLiteRelayTlsFactory(options: RustlsPsLiteRelayTlsOptions): PsLiteRelayTlsFactory;
+export declare function psLiteRelayPublicHost(sessionId: string, publicSuffix?: string): string;
+export declare function psLiteRelayPublicUrl(sessionId: string, publicSuffix?: string): string;
+/**
+ * Browser default relay TLS identity store: persists the issued cert in
+ * `localStorage`, matching PS Lite's pre-injection behavior byte for byte. This
+ * is the one place the relay TLS path is allowed to touch a browser global; the
+ * resolution logic above goes through the injected {@link PsLiteRelayTlsIdentityStore}.
+ */
+export declare function createLocalStoragePsLiteRelayTlsIdentityStore(storage?: Storage): PsLiteRelayTlsIdentityStore;
+//# sourceMappingURL=relay-tls.d.ts.map

package/dist/relay-tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-tls.d.ts","sourceRoot":"","sources":["../src/relay-tls.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EAKtB,MAAM,YAAY,CAAC;AAMpB;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CACF,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAC1E,KAAK,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CA4EvB;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER;AA2PD;;;;;GAKG;AACH,wBAAgB,6CAA6C,CAC3D,OAAO,GAAE,OAAiC,GACzC,2BAA2B,CAa7B"}