@opendatalabs/personal-server-ts-server 1.16.0 → 1.17.0

package/dist/mcp/durable-state.js

@@ -0,0 +1,418 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { isMcpTokenExpired, matchesMcpRefreshHash, } from "@opendatalabs/personal-server-ts-core/mcp";
+import { userPsId } from "@opendatalabs/vana-sdk/protocol/identity";
+const AAD = Buffer.from("vana.mcp.tee-state.v1");
+/** Whether a missing or unreadable sealed state file is a genuine first boot
+ * (`Optional`, today's default) or a lost durable volume (`Required`, set
+ * from the signed `MCP_STATE_REQUIRED=1`). */
+export var McpStateRequirement;
+(function (McpStateRequirement) {
+    McpStateRequirement["Optional"] = "optional";
+    McpStateRequirement["Required"] = "required";
+})(McpStateRequirement || (McpStateRequirement = {}));
+/** Stable code for a required sealed MCP state file that was missing or
+ * could not be decrypted at boot. Distinguishes a lost durable volume from
+ * an ordinary first boot; callers must never fall back to fresh state. */
+export const MCP_STATE_REQUIRED_MISSING_CODE = "MCP_STATE_REQUIRED_MISSING";
+export class McpStateRequiredError extends Error {
+    constructor(cause) {
+        super("MCP durable state file is required (MCP_STATE_REQUIRED=1) but missing or unreadable", { cause });
+        this.name = "McpStateRequiredError";
+    }
+}
+/**
+ * Single-CVM, single-writer store. Only ciphertext is written to its durable
+ * volume; the caller obtains its 32-byte key from the TEE key agent. This is
+ * deliberately not a multi-process or fleet database.
+ */
+export async function openMcpDurableState(options) {
+    const requirement = options.requirement ?? McpStateRequirement.Optional;
+    if (options.key.length !== 32)
+        throw new Error("MCP state key must be 32 bytes");
+    const key = Buffer.from(options.key);
+    let state = {
+        connections: {},
+        authorizations: {},
+        owners: {},
+        identities: {},
+    };
+    try {
+        const envelope = JSON.parse(await readFile(options.path, "utf8"));
+        if (envelope.v !== 1)
+            throw new Error("Unsupported MCP state version");
+        const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"));
+        decipher.setAAD(AAD);
+        decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+            decipher.final(),
+        ]);
+        try {
+            state = JSON.parse(plaintext.toString("utf8"));
+            state.identities ??= {};
+            if (!state.connections || !state.authorizations || !state.owners) {
+                throw new Error("Invalid MCP state");
+            }
+        }
+        finally {
+            plaintext.fill(0);
+        }
+    }
+    catch (error) {
+        // A missing file is a genuine first boot only when the caller has not
+        // demanded continuity; otherwise it, and any undecryptable file, means
+        // the durable volume was lost and must never be papered over.
+        if (requirement === McpStateRequirement.Required)
+            throw new McpStateRequiredError(error);
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    let writes = Promise.resolve();
+    let operations = Promise.resolve();
+    const assertActive = () => {
+        if (state.writer?.fenced)
+            throw new Error("MCP writer fenced for migration");
+    };
+    const mutate = (change) => {
+        const result = writes.then(async () => {
+            assertActive();
+            const draft = structuredClone(state);
+            const value = change(draft);
+            await persist(options.path, key, draft);
+            state = draft;
+            return structuredClone(value);
+        });
+        writes = result.catch(() => undefined);
+        return result;
+    };
+    const read = async (select) => {
+        await writes;
+        assertActive();
+        return structuredClone(select(state));
+    };
+    return {
+        // Read-only membership reconciliation remains possible after writer fencing;
+        // it never exposes connection keys or permits an OAuth mutation.
+        approvedOwnerBindings: async () => {
+            await writes;
+            return structuredClone(rollbackOwners(state).bindings);
+        },
+        prepareRollback(migrationId, resolve) {
+            const operation = operations.then(() => {
+                const prepared = writes.then(async () => {
+                    assertActive();
+                    if (!migrationId ||
+                        state.writer?.importedId !== migrationId ||
+                        !state.writer.importedDigest)
+                        throw new Error("Rollback requires the exact imported migration");
+                    // A failed refresh must not leave an earlier receipt usable at boot.
+                    const pending = structuredClone(state);
+                    delete pending.writer.rollback;
+                    delete pending.writer.rollbackActivated;
+                    await persist(options.path, key, pending);
+                    state = pending;
+                    const required = rollbackOwners(state);
+                    const draft = structuredClone(state);
+                    const identities = {};
+                    // Resolve one owner at a time on the small source TEE, without writing
+                    // a partial cache or exposing owner bindings to the operator.
+                    for (const binding of required.bindings) {
+                        const resolved = await resolve(binding);
+                        const id = userPsId(binding.chainId, binding.owner);
+                        if (resolved.identity.userPsId !== id ||
+                            !Number.isSafeInteger(resolved.identity.epoch) ||
+                            resolved.identity.epoch < 1 ||
+                            !Number.isSafeInteger(resolved.generation) ||
+                            resolved.generation < 0)
+                            throw new Error("Rollback identity does not match its owner");
+                        draft.identities[id] = structuredClone(resolved.identity);
+                        identities[id] = {
+                            digest: rollbackDigest(resolved.identity),
+                            generation: resolved.generation,
+                        };
+                    }
+                    const receipt = {
+                        migrationId,
+                        digest: rollbackDigest({
+                            migrationId,
+                            importedDigest: state.writer.importedDigest,
+                            ownersDigest: required.digest,
+                            identities,
+                        }),
+                        owners: required.bindings.length,
+                        connections: required.connections,
+                    };
+                    draft.writer.rollback = {
+                        importedDigest: state.writer.importedDigest,
+                        ownersDigest: required.digest,
+                        identities,
+                        receipt,
+                    };
+                    await persist(options.path, key, draft);
+                    state = draft;
+                    return structuredClone(receipt);
+                });
+                writes = prepared.catch(() => undefined);
+                return prepared;
+            });
+            operations = operation.catch(() => undefined);
+            return operation;
+        },
+        getRollbackPreparation: () => read((current) => {
+            const prepared = current.writer?.rollback;
+            const required = rollbackOwners(current);
+            if (!prepared ||
+                prepared.receipt.migrationId !== current.writer?.importedId ||
+                prepared.importedDigest !== current.writer.importedDigest ||
+                prepared.ownersDigest !== required.digest ||
+                Object.keys(prepared.identities).length !== required.bindings.length)
+                throw new Error("Rollback identities are not prepared for this imported state");
+            const owners = required.bindings.map((binding) => {
+                const id = userPsId(binding.chainId, binding.owner);
+                const identity = current.identities[id];
+                if (!identity ||
+                    prepared.identities[id]?.digest !== rollbackDigest(identity))
+                    throw new Error("Rollback identity changed after preparation");
+                return {
+                    binding,
+                    identity,
+                    generation: prepared.identities[id].generation,
+                };
+            });
+            return { receipt: prepared.receipt, owners };
+        }),
+        activateRollback: (receipt) => mutate((draft) => {
+            const prepared = draft.writer?.rollback;
+            if (!prepared ||
+                receipt.migrationId !== draft.writer?.importedId ||
+                receipt.digest !== prepared.receipt.digest ||
+                prepared.importedDigest !== draft.writer.importedDigest ||
+                prepared.ownersDigest !== rollbackOwners(draft).digest ||
+                Object.entries(prepared.identities).some(([id, value]) => value.digest !== rollbackDigest(draft.identities[id])))
+                throw new Error("Rollback preparation changed before activation");
+            draft.writer.rollbackActivated = {
+                migrationId: receipt.migrationId,
+                importedDigest: prepared.importedDigest,
+                receiptDigest: receipt.digest,
+            };
+        }),
+        migrationStatus: async () => {
+            await writes;
+            return {
+                fenced: state.writer?.fenced ?? false,
+                ...(state.writer?.rollbackActivated
+                    ? {
+                        rollbackActivated: state.writer.rollbackActivated.migrationId ===
+                            state.writer.importedId &&
+                            state.writer.rollbackActivated.importedDigest ===
+                                state.writer.importedDigest &&
+                            state.writer.rollbackActivated.receiptDigest ===
+                                state.writer.rollback?.receipt.digest,
+                    }
+                    : {}),
+                ...(state.writer?.importedId
+                    ? { importedId: state.writer.importedId }
+                    : {}),
+            };
+        },
+        fenceAndExport(migrationId, target) {
+            if (!migrationId || !target)
+                return Promise.reject(new Error("Migration identity required"));
+            const result = operations.then(async () => {
+                const exported = writes.then(async () => {
+                    if (state.writer?.fenced &&
+                        (state.writer.migrationId !== migrationId ||
+                            state.writer.target !== target))
+                        throw new Error("MCP writer already fenced for another migration");
+                    const draft = structuredClone(state);
+                    draft.writer = { ...draft.writer, fenced: true, migrationId, target };
+                    await persist(options.path, key, draft);
+                    state = draft;
+                    return Buffer.from(JSON.stringify({ v: 1, migrationId, state: draft }));
+                });
+                writes = exported.catch(() => undefined);
+                return exported;
+            });
+            operations = result.catch(() => undefined);
+            return result;
+        },
+        importSnapshot(snapshot, migrationId) {
+            const result = operations.then(async () => {
+                const imported = writes.then(async () => {
+                    const digest = createHash("sha256").update(snapshot).digest("hex");
+                    if (state.writer?.importedId === migrationId &&
+                        state.writer.importedDigest === digest &&
+                        !state.writer.fenced)
+                        return {
+                            connections: Object.keys(state.connections).length,
+                            digest,
+                        };
+                    if (!state.writer?.fenced &&
+                        (Object.keys(state.connections).length ||
+                            Object.keys(state.authorizations).length))
+                        throw new Error("Cannot replace active MCP writer");
+                    const incoming = JSON.parse(Buffer.from(snapshot).toString("utf8"));
+                    if (incoming.v !== 1 ||
+                        incoming.migrationId !== migrationId ||
+                        !incoming.state?.writer?.fenced ||
+                        incoming.state.writer.migrationId !== migrationId ||
+                        !incoming.state.connections ||
+                        !incoming.state.authorizations ||
+                        !incoming.state.owners ||
+                        !incoming.state.identities)
+                        throw new Error("Invalid fenced MCP snapshot");
+                    const draft = incoming.state;
+                    draft.writer = {
+                        fenced: false,
+                        importedId: migrationId,
+                        importedDigest: digest,
+                    };
+                    await persist(options.path, key, draft);
+                    state = draft;
+                    return { connections: Object.keys(draft.connections).length, digest };
+                });
+                writes = imported.catch(() => undefined);
+                return imported;
+            });
+            operations = result.catch(() => undefined);
+            return result;
+        },
+        connections: {
+            create: (record) => mutate((draft) => {
+                if (draft.connections[record.id])
+                    throw new Error("MCP connection already exists");
+                draft.connections[record.id] = structuredClone(record);
+            }),
+            list: () => read((current) => Object.values(current.connections)),
+            getById: (id) => read((current) => current.connections[id] ?? null),
+            getByTokenHash: (hash) => read((current) => Object.values(current.connections).find((record) => record.tokenHash === hash &&
+                record.status === "approved" &&
+                !isMcpTokenExpired(record)) ?? null),
+            getByRefreshTokenHash: (hash) => read((current) => Object.values(current.connections).find((record) => matchesMcpRefreshHash(record, hash)) ?? null),
+            update: (id, patch) => mutate((draft) => {
+                const record = draft.connections[id];
+                if (!record)
+                    return null;
+                return (draft.connections[id] = { ...record, ...patch });
+            }),
+        },
+        authorizations: {
+            create: (record) => mutate((draft) => {
+                if (draft.authorizations[record.id])
+                    throw new Error("MCP authorization already exists");
+                draft.authorizations[record.id] = structuredClone(record);
+            }),
+            getById: (id) => read((current) => current.authorizations[id] ?? null),
+            getByCodeHash: (hash) => read((current) => Object.values(current.authorizations).find((record) => record.authorizationCodeHash === hash) ?? null),
+            update: (id, patch) => mutate((draft) => {
+                const record = draft.authorizations[id];
+                if (!record)
+                    return null;
+                return (draft.authorizations[id] = { ...record, ...patch });
+            }),
+            delete: (id) => mutate((draft) => {
+                delete draft.authorizations[id];
+            }),
+        },
+        bindOwner: (connectionId, binding) => mutate((draft) => {
+            if (!draft.connections[connectionId])
+                throw new Error("Unknown MCP connection");
+            const prior = draft.owners[connectionId];
+            if (prior &&
+                (prior.owner.toLowerCase() !== binding.owner.toLowerCase() ||
+                    prior.chainId !== binding.chainId)) {
+                throw new Error("MCP connection owner cannot change");
+            }
+            draft.owners[connectionId] = structuredClone(binding);
+        }),
+        getOwner: (id) => read((current) => current.owners[id] ?? null),
+        rememberIdentity: (identity) => mutate((draft) => {
+            const previous = draft.identities[identity.userPsId];
+            if (!previous || identity.epoch >= previous.epoch) {
+                draft.identities[identity.userPsId] = structuredClone(identity);
+            }
+        }),
+        getIdentity: (id) => read((current) => current.identities[id] ?? null),
+        exclusive(operation) {
+            const result = operations.then(operation);
+            operations = result.catch(() => undefined);
+            return result;
+        },
+    };
+}
+function rollbackDigest(value) {
+    const canonical = JSON.stringify(value, (_key, item) => {
+        if (item && typeof item === "object" && !Array.isArray(item))
+            return Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b)));
+        return item;
+    });
+    return createHash("sha256").update(canonical).digest("hex");
+}
+function rollbackOwners(state) {
+    const connections = Object.values(state.connections)
+        .filter((connection) => connection.status === "approved")
+        .sort((a, b) => a.id.localeCompare(b.id));
+    const bindings = new Map();
+    const entries = connections.map((connection) => {
+        const binding = state.owners[connection.id];
+        if (!binding)
+            throw new Error("Approved rollback connection has no owner");
+        const id = userPsId(binding.chainId, binding.owner);
+        bindings.set(id, binding);
+        return {
+            connectionId: connection.id,
+            owner: binding.owner.toLowerCase(),
+            chainId: binding.chainId,
+        };
+    });
+    return {
+        bindings: [...bindings.values()],
+        digest: rollbackDigest(entries),
+        connections: connections.length,
+    };
+}
+async function persist(path, key, state) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    cipher.setAAD(AAD);
+    const plaintext = Buffer.from(JSON.stringify(state));
+    let ciphertext;
+    try {
+        ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    }
+    finally {
+        plaintext.fill(0);
+    }
+    const serialized = JSON.stringify({
+        v: 1,
+        iv: iv.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    });
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    try {
+        const file = await open(temporary, "wx", 0o600);
+        try {
+            await file.writeFile(serialized, "utf8");
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await rename(temporary, path);
+        const directory = await open(dirname(path), "r");
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+//# sourceMappingURL=durable-state.js.map

package/dist/mcp/durable-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-state.js","sourceRoot":"","sources":["../../src/mcp/durable-state.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAKtB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AAIpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEjD;;8CAE8C;AAC9C,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,4CAAqB,CAAA;AACvB,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B;AAED;;0EAE0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC;AAE5E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,KAAc;QACxB,KAAK,CACH,qFAAqF,EACrF,EAAE,KAAK,EAAE,CACV,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAgFD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAIzC;IACC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,GAAU;QACjB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;KACf,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAK/D,CAAC;QACF,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CACnC,CAAC;QACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC3D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAU,CAAC;YACxD,KAAK,CAAC,UAAU,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,WAAW,KAAK,mBAAmB,CAAC,QAAQ;YAC9C,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IAED,IAAI,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,IAAI,UAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM;YACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAI,MAA2B,EAAc,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACpC,YAAY,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAK,MAA6B,EAAc,EAAE;QAClE,MAAM,MAAM,CAAC;QACb,YAAY,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,OAAO;QACL,6EAA6E;QAC7E,iEAAiE;QACjE,qBAAqB,EAAE,KAAK,IAAI,EAAE;YAChC,MAAM,MAAM,CAAC;YACb,OAAO,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,eAAe,CAAC,WAAW,EAAE,OAAO;YAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBACtC,YAAY,EAAE,CAAC;oBACf,IACE,CAAC,WAAW;wBACZ,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,WAAW;wBACxC,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc;wBAE5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBACpE,qEAAqE;oBACrE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;oBACvC,OAAO,OAAO,CAAC,MAAO,CAAC,QAAQ,CAAC;oBAChC,OAAO,OAAO,CAAC,MAAO,CAAC,iBAAiB,CAAC;oBACzC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC1C,KAAK,GAAG,OAAO,CAAC;oBAChB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACvC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;oBACrC,MAAM,UAAU,GAAsC,EAAE,CAAC;oBACzD,uEAAuE;oBACvE,8DAA8D;oBAC9D,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;wBACpD,IACE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,EAAE;4BACjC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;4BAC9C,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;4BAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;4BAC1C,QAAQ,CAAC,UAAU,GAAG,CAAC;4BAEvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;wBAChE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBAC1D,UAAU,CAAC,EAAE,CAAC,GAAG;4BACf,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC;4BACzC,UAAU,EAAE,QAAQ,CAAC,UAAU;yBAChC,CAAC;oBACJ,CAAC;oBACD,MAAM,OAAO,GAAG;wBACd,WAAW;wBACX,MAAM,EAAE,cAAc,CAAC;4BACrB,WAAW;4BACX,cAAc,EAAE,KAAK,CAAC,MAAO,CAAC,cAAc;4BAC5C,YAAY,EAAE,QAAQ,CAAC,MAAM;4BAC7B,UAAU;yBACX,CAAC;wBACF,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;wBAChC,WAAW,EAAE,QAAQ,CAAC,WAAW;qBAClC,CAAC;oBACF,KAAK,CAAC,MAAO,CAAC,QAAQ,GAAG;wBACvB,cAAc,EAAE,KAAK,CAAC,MAAO,CAAC,cAAe;wBAC7C,YAAY,EAAE,QAAQ,CAAC,MAAM;wBAC7B,UAAU;wBACV,OAAO;qBACR,CAAC;oBACF,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxC,KAAK,GAAG,KAAK,CAAC;oBACd,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,sBAAsB,EAAE,GAAG,EAAE,CAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACzC,IACE,CAAC,QAAQ;gBACT,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,EAAE,UAAU;gBAC3D,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,cAAc;gBACzD,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM;gBACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;gBAEpE,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;YACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxC,IACE,CAAC,QAAQ;oBACT,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,cAAc,CAAC,QAAQ,CAAC;oBAE5D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO;oBACP,QAAQ;oBACR,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAE,CAAC,UAAU;iBAChD,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC,CAAC;QACJ,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;YACxC,IACE,CAAC,QAAQ;gBACT,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU;gBAChD,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM;gBAC1C,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc;gBACvD,QAAQ,CAAC,YAAY,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM;gBACtD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CACd,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CACxD;gBAED,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,iBAAiB,GAAG;gBAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,aAAa,EAAE,OAAO,CAAC,MAAM;aAC9B,CAAC;QACJ,CAAC,CAAC;QACJ,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK;gBACrC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB;oBACjC,CAAC,CAAC;wBACE,iBAAiB,EACf,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW;4BACxC,KAAK,CAAC,MAAM,CAAC,UAAU;4BACzB,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc;gCAC3C,KAAK,CAAC,MAAM,CAAC,cAAc;4BAC7B,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa;gCAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM;qBAC1C;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU;oBAC1B,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE;oBACzC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,WAAW,EAAE,MAAM;YAChC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM;gBACzB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBACtC,IACE,KAAK,CAAC,MAAM,EAAE,MAAM;wBACpB,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;4BACvC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;wBAEjC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;oBACrE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;oBACrC,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;oBACtE,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxC,KAAK,GAAG,KAAK,CAAC;oBACd,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CACpD,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,cAAc,CACZ,QAAQ,EACR,WAAW;YAEX,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnE,IACE,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,WAAW;wBACxC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,MAAM;wBACtC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;wBAEpB,OAAO;4BACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM;4BAClD,MAAM;yBACP,CAAC;oBACJ,IACE,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM;wBACrB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM;4BACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;wBAE3C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACa,CAAC;oBACtD,IACE,QAAQ,CAAC,CAAC,KAAK,CAAC;wBAChB,QAAQ,CAAC,WAAW,KAAK,WAAW;wBACpC,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM;wBAC/B,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;wBACjD,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW;wBAC3B,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc;wBAC9B,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;wBACtB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU;wBAE1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;oBAC7B,KAAK,CAAC,MAAM,GAAG;wBACb,MAAM,EAAE,KAAK;wBACb,UAAU,EAAE,WAAW;wBACvB,cAAc,EAAE,MAAM;qBACvB,CAAC;oBACF,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxC,KAAK,GAAG,KAAK,CAAC;oBACd,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACxE,CAAC,CAAC,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC,CAAC;YACJ,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACjE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;YACnE,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACvB,IAAI,CACF,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,SAAS,KAAK,IAAI;gBACzB,MAAM,CAAC,MAAM,KAAK,UAAU;gBAC5B,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAC7B,IAAI,IAAI,CACZ;YACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CACF,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CACpC,IAAI,IAAI,CACZ;YACH,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC;SACL;QACD,cAAc,EAAE;YACd,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACtD,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC,CAAC;YACJ,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;YACtE,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CACF,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,KAAK,IAAI,CAClD,IAAI,IAAI,CACZ;YACH,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC;YACJ,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC;SACL;QACD,SAAS,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CACnC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzC,IACE,KAAK;gBACL,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;oBACxD,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EACpC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC;QACJ,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC/D,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAClD,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC;QACJ,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACtE,SAAS,CAAI,SAA2B;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1C,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAa,EAAE,EAAE;QAC9D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAC5D,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAKlC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;SACjD,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO;YACL,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC;QAC/B,WAAW,EAAE,WAAW,CAAC,MAAM;KAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,KAAY;IAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/mcp/grants.d.ts

@@ -0,0 +1,12 @@
+import type { GatewayClient, DataPortabilityGatewayConfig } from "@opendatalabs/vana-sdk/node";
+import type { McpConnectionGrant, McpConnectionRecord } from "@opendatalabs/personal-server-ts-core/mcp";
+import type { McpOwnerBinding } from "./durable-state.js";
+export declare function verifyTeeMcpGrants(options: {
+    connection: McpConnectionRecord;
+    binding: McpOwnerBinding;
+    grants: McpConnectionGrant[];
+    gateway: Pick<GatewayClient, "getGrant" | "getBuilder">;
+    gatewayConfig: DataPortabilityGatewayConfig;
+    chainId: number;
+}): Promise<void>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/mcp/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/mcp/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,4BAA4B,EAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,UAAU,EAAE,mBAAmB,CAAC;IAChC,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;IACxD,aAAa,EAAE,4BAA4B,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkChB"}

package/dist/mcp/grants.js

@@ -0,0 +1,33 @@
+import { verifySignedArtifacts } from "@opendatalabs/personal-server-ts-core/policy";
+export async function verifyTeeMcpGrants(options) {
+    if (options.binding.chainId !== options.chainId)
+        throw new Error("MCP chain mismatch");
+    const builder = await options.gateway.getBuilder(options.connection.granteeAddress);
+    if (!builder ||
+        builder.granteeAddress.toLowerCase() !==
+            options.connection.granteeAddress.toLowerCase() ||
+        builder.publicKey.toLowerCase() !==
+            options.connection.granteePublicKey.toLowerCase())
+        throw new Error("MCP grantee mismatch");
+    for (const requested of options.grants) {
+        const grant = await options.gateway.getGrant(requested.grantId);
+        if (!grant || grant.id.toLowerCase() !== requested.grantId.toLowerCase())
+            throw new Error("MCP grant missing");
+        await verifySignedArtifacts({
+            grant,
+            builder,
+            gatewayConfig: options.gatewayConfig,
+            ownerAddress: options.binding.owner,
+        });
+        if (requested.scopes.some((scope) => !grant.scopes.includes(scope)))
+            throw new Error("MCP scope mismatch");
+        if (grant.expiresAt && grant.expiresAt !== "0") {
+            const expiry = /^\d+$/.test(grant.expiresAt)
+                ? Number(grant.expiresAt) * 1000
+                : Date.parse(grant.expiresAt);
+            if (!Number.isFinite(expiry) || expiry <= Date.now())
+                throw new Error("MCP grant expired");
+        }
+    }
+}
+//# sourceMappingURL=grants.js.map

package/dist/mcp/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/mcp/grants.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAOrF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAOxC;IACC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QAC7C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAC9C,OAAO,CAAC,UAAU,CAAC,cAAc,CAClC,CAAC;IACF,IACE,CAAC,OAAO;QACR,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE;YAClC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE;QACjD,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC7B,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE;QAEnD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE;YACtE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,MAAM,qBAAqB,CAAC;YAC1B,KAAK;YACL,OAAO;YACP,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;SACpC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC1C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI;gBAChC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE;gBAClD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,4 @@
+export { createTeeMcpIngress, McpOwnerAccessRevokedError, OWNER_ACCESS_REVOKED_CODE, type TeeMcpIngressDeps, } from "./tee-ingress.js";
+export { openMcpDurableState, McpStateRequirement, McpStateRequiredError, MCP_STATE_REQUIRED_MISSING_CODE, type McpDurableState, type McpOwnerBinding, type McpWakeupIdentity, type McpRollbackIdentity, type McpRollbackReceipt, } from "./durable-state.js";
+export { verifyTeeMcpGrants } from "./grants.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,+BAA+B,EAC/B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/mcp/index.js

@@ -0,0 +1,4 @@
+export { createTeeMcpIngress, McpOwnerAccessRevokedError, OWNER_ACCESS_REVOKED_CODE, } from "./tee-ingress.js";
+export { openMcpDurableState, McpStateRequirement, McpStateRequiredError, MCP_STATE_REQUIRED_MISSING_CODE, } from "./durable-state.js";
+export { verifyTeeMcpGrants } from "./grants.js";
+//# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,+BAA+B,GAMhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/mcp/tee-ingress.d.ts

@@ -0,0 +1,29 @@
+import { Hono } from "hono";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
+import { type McpConnectionGrant, type McpConnectionRecord } from "@opendatalabs/personal-server-ts-core/mcp";
+import type { McpDurableState, McpOwnerBinding } from "./durable-state.js";
+/** Stable, non-retryable code for a caller whose owner withdrew enclave access
+ * (server deregistered, identity epoch bumped, delegation revoked). Retrying
+ * cannot help; the owner has to approve this enclave again. */
+export declare const OWNER_ACCESS_REVOKED_CODE = "OWNER_ACCESS_REVOKED";
+/** Thrown by `dispatch`/`ownerReady` providers when the live protocol identity
+ * shows the owner no longer authorizes this enclave. */
+export declare class McpOwnerAccessRevokedError extends Error {
+    constructor();
+}
+export interface TeeMcpIngressDeps {
+    state: McpDurableState;
+    origin: string;
+    approvalUrl: string;
+    allowedRedirectUris: string[];
+    gateway: GatewayClient;
+    registerGrantee(connection: McpConnectionRecord, redirectUri: string): Promise<void>;
+    verifyGrants(connection: McpConnectionRecord, binding: McpOwnerBinding, grants: McpConnectionGrant[]): Promise<void>;
+    dispatch(request: Request, connection: McpConnectionRecord, binding: McpOwnerBinding): Promise<Response>;
+    ownerReady?(binding: McpOwnerBinding): Promise<boolean>;
+    /** Runs only after signed grants are verified, before durable approval. */
+    beforeOwnerApproval?(binding: McpOwnerBinding): Promise<void>;
+}
+/** Public ingress: HTTPS terminates in the same CVM as this process. */
+export declare function createTeeMcpIngress(deps: TeeMcpIngressDeps): Hono;
+//# sourceMappingURL=tee-ingress.d.ts.map

package/dist/mcp/tee-ingress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-ingress.d.ts","sourceRoot":"","sources":["../../src/mcp/tee-ingress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE3E;;+DAE+D;AAC/D,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAIhE;wDACwD;AACxD,qBAAa,0BAA2B,SAAQ,KAAK;;CAKpD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,CACb,UAAU,EAAE,mBAAmB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,QAAQ,CACN,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,UAAU,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,2EAA2E;IAC3E,mBAAmB,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAgNjE"}