@privos_ai/app-server 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PrivOS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,90 @@
+# @privos_ai/app-server
+
+Business-agnostic PrivOS MCP App server runtime for **Direct HTTP** and **Relay WebSocket**.
+
+## Install
+
+```bash
+npm install @privos_ai/app-server
+# peer: express
+```
+
+## Quick start (Direct router only)
+
+```ts
+import express from 'express';
+import { createDirectRouter } from '@privos_ai/app-server';
+
+const app = express();
+app.get('/health', (_req, res) => res.json({ ok: true }));
+app.use(
+  createDirectRouter({
+    descriptor: { id: 'com.example.app', name: 'Example', version: '1.0.0' },
+    handler: async (request) => {
+      if (request.method === 'tools/list') return { tools: [] };
+      throw Object.assign(new Error('Method not found'), { code: -32601 });
+    },
+  }),
+);
+```
+
+## Quick start (HTTP ingress helper)
+
+For Relay+HTTP dual mode or a minimal Direct binary — health/ready/listen included:
+
+```ts
+import {
+  startHttpIngress,
+  resolveHttpIngressListen,
+  connectRelay,
+} from '@privos_ai/app-server';
+
+const listen = resolveHttpIngressListen({ defaultPort: 8080 });
+const shared = {
+  descriptor: { id: 'com.example.app', name: 'Example', version: '1.0.0' },
+  handler: async (request) => {
+    if (request.method === 'tools/list') return { tools: [] };
+    throw Object.assign(new Error('Method not found'), { code: -32601 });
+  },
+};
+
+if (listen.enabled) {
+  await startHttpIngress({
+    ...shared,
+    port: listen.port,
+    publicUrl: listen.publicUrl,
+    ready: {
+      check: async () => ({ ok: true, body: { /* app checks */ } }),
+    },
+    // Optional: mount /ui, static assets, webhooks before listen
+    configure: async (app) => {
+      // app.use('/ui', …)
+    },
+  });
+}
+
+connectRelay({ ...shared, privosUrl, clientId, clientSecret });
+```
+
+Env: `HTTP_INGRESS`, `HTTP_PORT` / `PORT`, `PUBLIC_URL`.
+
+Runtime owns `initialize`, `notifications/*`, and the configured primary UI resource.  
+Your handler owns `tools/list`, `tools/call`, and custom resources.
+
+## Auth
+
+```ts
+import { verifyPrivosUser } from '@privos_ai/app-server/auth';
+```
+
+## Scripts
+
+- `npm run build` — emit `dist/` (JS + `.d.ts`)
+- `npm test` — Vitest (in-process mock Hub only)
+- `npm run typecheck`
+- `npm pack` — runs `prepack` build; package contains `dist/` only
+- `npx tsx scripts/probe-relay-contract.ts` — staging Phase 0 probe (requires credentials; exit 2 when blocked)
+
+## License
+
+MIT

package/dist/app-descriptor.d.ts

@@ -0,0 +1,39 @@
+export declare const MCP_PROTOCOL_VERSION = "2025-03-26";
+export declare const MCP_UI_MIME = "text/html;profile=mcp-app";
+export interface AppDescriptor {
+    id: string;
+    name: string;
+    version: string;
+    title?: string;
+    description?: string;
+    homepage?: string;
+    author?: {
+        name: string;
+        email?: string;
+        website?: string;
+    };
+    scopes?: readonly string[];
+    /** Direct manifest icon path/URL (e.g. `/public/icon.svg`). */
+    manifestIcon?: string;
+    /** Pairing / initialize icon (often a data URI for relay). */
+    relayIcon?: string;
+    /** Extra capabilities merged under runtime-owned defaults; may not override reserved keys. */
+    capabilities?: Record<string, unknown>;
+}
+export declare function validateDescriptorCapabilities(capabilities: Record<string, unknown> | undefined): void;
+export declare function buildInitializeResult(descriptor: AppDescriptor, options?: {
+    uiEnabled?: boolean;
+}): {
+    protocolVersion: string;
+    capabilities: Record<string, unknown>;
+    serverInfo: Record<string, unknown>;
+};
+export declare function buildManifestJson(descriptor: AppDescriptor): Record<string, unknown>;
+export declare function buildPairingMetadata(descriptor: AppDescriptor): {
+    name: string;
+    description: string;
+    version: string;
+    icon?: string;
+    scopes?: string[];
+};
+//# sourceMappingURL=app-descriptor.d.ts.map

package/dist/app-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-descriptor.d.ts","sourceRoot":"","sources":["../src/app-descriptor.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,eAAO,MAAM,WAAW,8BAA8B,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID,wBAAgB,8BAA8B,CAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC/C,IAAI,CASN;AAED,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,aAAa,EACzB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/B;IACF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CA6BA;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBpF;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,aAAa,GAAG;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAQA"}

package/dist/app-descriptor.js

@@ -0,0 +1,71 @@
+export const MCP_PROTOCOL_VERSION = '2025-03-26';
+export const MCP_UI_MIME = 'text/html;profile=mcp-app';
+const RESERVED_CAPABILITY_KEYS = new Set(['tools', 'extensions']);
+export function validateDescriptorCapabilities(capabilities) {
+    if (!capabilities)
+        return;
+    for (const key of Object.keys(capabilities)) {
+        if (RESERVED_CAPABILITY_KEYS.has(key)) {
+            throw new Error(`descriptor.capabilities must not override reserved capability "${key}"`);
+        }
+    }
+}
+export function buildInitializeResult(descriptor, options) {
+    validateDescriptorCapabilities(descriptor.capabilities);
+    const capabilities = {
+        tools: {},
+        ...(options?.uiEnabled
+            ? {
+                extensions: {
+                    'io.modelcontextprotocol/ui': {
+                        mimeTypes: [MCP_UI_MIME],
+                    },
+                },
+            }
+            : {}),
+        ...(descriptor.capabilities ?? {}),
+    };
+    const serverInfo = {
+        name: descriptor.title || descriptor.name || descriptor.id,
+        version: descriptor.version,
+    };
+    if (descriptor.relayIcon)
+        serverInfo.icon = descriptor.relayIcon;
+    if (descriptor.scopes?.length)
+        serverInfo.scopes = [...descriptor.scopes];
+    return {
+        protocolVersion: MCP_PROTOCOL_VERSION,
+        capabilities,
+        serverInfo,
+    };
+}
+export function buildManifestJson(descriptor) {
+    return {
+        name: descriptor.id,
+        version: descriptor.version,
+        title: descriptor.title || descriptor.name,
+        description: descriptor.description ?? '',
+        ...(descriptor.manifestIcon ? { icon: descriptor.manifestIcon } : {}),
+        ...(descriptor.author
+            ? {
+                author: {
+                    name: descriptor.author.name,
+                    ...(descriptor.author.email ? { email: descriptor.author.email } : {}),
+                    ...(descriptor.author.website ? { website: descriptor.author.website } : {}),
+                },
+            }
+            : {}),
+        ...(descriptor.homepage ? { homepage: descriptor.homepage } : {}),
+        ...(descriptor.scopes ? { scopes: [...descriptor.scopes] } : {}),
+    };
+}
+export function buildPairingMetadata(descriptor) {
+    return {
+        name: descriptor.title || descriptor.name || descriptor.id,
+        description: descriptor.description ?? '',
+        version: descriptor.version,
+        ...(descriptor.relayIcon ? { icon: descriptor.relayIcon } : {}),
+        ...(descriptor.scopes?.length ? { scopes: [...descriptor.scopes] } : {}),
+    };
+}
+//# sourceMappingURL=app-descriptor.js.map

package/dist/app-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-descriptor.js","sourceRoot":"","sources":["../src/app-descriptor.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAmBvD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,8BAA8B,CAC7C,YAAiD;IAEjD,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,kEAAkE,GAAG,GAAG,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,UAAyB,EACzB,OAAiC;IAMjC,8BAA8B,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAExD,MAAM,YAAY,GAA4B;QAC7C,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,OAAO,EAAE,SAAS;YACrB,CAAC,CAAC;gBACA,UAAU,EAAE;oBACX,4BAA4B,EAAE;wBAC7B,SAAS,EAAE,CAAC,WAAW,CAAC;qBACxB;iBACD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;KAClC,CAAC;IAEF,MAAM,UAAU,GAA4B;QAC3C,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QAC1D,OAAO,EAAE,UAAU,CAAC,OAAO;KAC3B,CAAC;IACF,IAAI,UAAU,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IACjE,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM;QAAE,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAE1E,OAAO;QACN,eAAe,EAAE,oBAAoB;QACrC,YAAY;QACZ,UAAU;KACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IAC1D,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,EAAE;QACnB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI;QAC1C,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,EAAE;QACzC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,MAAM;YACpB,CAAC,CAAC;gBACA,MAAM,EAAE;oBACP,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;oBAC5B,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5E;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAyB;IAO7D,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QAC1D,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,EAAE;QACzC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACH,CAAC"}

package/dist/auth/user-token.d.ts

@@ -0,0 +1,44 @@
+import { type JSONWebKeySet } from 'jose';
+import type { VerifiedActor } from '../context/tool-call-context.js';
+export interface AuthOptions {
+    jwksUrl: string | URL | (() => string | URL);
+    audience: string | readonly string[] | (() => string | readonly string[]);
+    issuer?: string | readonly string[];
+    clockToleranceSeconds?: number;
+    /** Mapped to jose `createRemoteJWKSet` `cacheMaxAge` (ms). */
+    jwksCacheTtlMs?: number;
+    fetchTimeoutMs?: number;
+    /**
+     * Test/injection escape hatch — when set, skips remote JWKS fetch.
+     * Production code should leave this unset.
+     */
+    localJwks?: JSONWebKeySet;
+}
+export interface CallerCredential {
+    token: string;
+    /** e.g. Direct `X-MCP-User-Id` — cross-checked against verified `sub`. */
+    assertedUserId?: string;
+    source: 'direct-header' | 'relay-metadata' | 'custom';
+}
+export type VerifyUserTokenResult = {
+    ok: true;
+    actor: VerifiedActor;
+} | {
+    ok: false;
+    reason: 'missing' | 'invalid';
+    message: string;
+};
+/** Test helper — verify against an in-memory JWKS (no network). */
+export declare function createLocalJwksVerifier(jwks: JSONWebKeySet): (protectedHeader?: import("jose").JWSHeaderParameters, token?: import("jose").FlattenedJWSInput) => Promise<import("jose").KeyLike>;
+export declare function clearJwksCache(): void;
+/**
+ * Verify a Hub-signed RS256 user JWT via JWKS.
+ * Algorithm is fixed to RS256 — HS256 / none are rejected by jose verify options.
+ */
+export declare function verifyUserToken(token: string | undefined, options: AuthOptions, assertedUserId?: string): Promise<VerifyUserTokenResult>;
+/**
+ * Convenience for app-owned HTTP routes (non-MCP).
+ * Throws on missing/invalid token — mirrors the former template `verifyPrivosUser`.
+ */
+export declare function verifyPrivosUser(authHeader: string | undefined, options: AuthOptions): Promise<VerifiedActor>;
+//# sourceMappingURL=user-token.d.ts.map

package/dist/auth/user-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-token.d.ts","sourceRoot":"","sources":["../../src/auth/user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,aAAa,EAElB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,QAAQ,CAAC;CACtD;AAED,MAAM,MAAM,qBAAqB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAuCjE,mEAAmE;AACnE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,uIAE1D;AAED,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAwBD;;;GAGG;AACH,wBAAsB,eAAe,CACpC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,WAAW,EACpB,cAAc,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAQxB"}

package/dist/auth/user-token.js

@@ -0,0 +1,108 @@
+import { createLocalJWKSet, createRemoteJWKSet, jwtVerify, } from 'jose';
+const jwksCache = new Map();
+function resolveUrl(value) {
+    const raw = typeof value === 'function' ? value() : value;
+    return raw instanceof URL ? raw : new URL(raw);
+}
+function resolveAudience(value) {
+    const raw = typeof value === 'function' ? value() : value;
+    if (typeof raw === 'string')
+        return raw;
+    return [...raw];
+}
+function resolveIssuer(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === 'string')
+        return value;
+    return [...value];
+}
+function getJwks(options) {
+    const url = resolveUrl(options.jwksUrl);
+    const cacheKey = `${url.toString()}|${options.jwksCacheTtlMs ?? ''}|${options.fetchTimeoutMs ?? ''}`;
+    let jwks = jwksCache.get(cacheKey);
+    if (!jwks) {
+        jwks = createRemoteJWKSet(url, {
+            timeoutDuration: options.fetchTimeoutMs ?? 5_000,
+            ...(options.jwksCacheTtlMs !== undefined
+                ? { cacheMaxAge: options.jwksCacheTtlMs }
+                : {}),
+        });
+        jwksCache.set(cacheKey, jwks);
+    }
+    return jwks;
+}
+/** Test helper — verify against an in-memory JWKS (no network). */
+export function createLocalJwksVerifier(jwks) {
+    return createLocalJWKSet(jwks);
+}
+export function clearJwksCache() {
+    jwksCache.clear();
+}
+function getVerifier(options) {
+    if (options.localJwks) {
+        return createLocalJWKSet(options.localJwks);
+    }
+    return getJwks(options);
+}
+function actorFromPayload(payload) {
+    if (!payload.sub) {
+        throw new Error('JWT missing sub claim');
+    }
+    const username = typeof payload.preferred_username === 'string' ? payload.preferred_username : undefined;
+    const roomId = typeof payload.rid === 'string' ? payload.rid : undefined;
+    return {
+        userId: payload.sub,
+        ...(username !== undefined ? { username } : {}),
+        ...(roomId !== undefined ? { roomId } : {}),
+        claims: { ...payload },
+    };
+}
+/**
+ * Verify a Hub-signed RS256 user JWT via JWKS.
+ * Algorithm is fixed to RS256 — HS256 / none are rejected by jose verify options.
+ */
+export async function verifyUserToken(token, options, assertedUserId) {
+    if (!token) {
+        return { ok: false, reason: 'missing', message: 'Missing caller token' };
+    }
+    try {
+        const audience = resolveAudience(options.audience);
+        const issuer = resolveIssuer(options.issuer);
+        const { payload } = await jwtVerify(token, getVerifier(options), {
+            audience,
+            algorithms: ['RS256'],
+            clockTolerance: options.clockToleranceSeconds ?? 30,
+            ...(issuer ? { issuer } : {}),
+        });
+        const actor = actorFromPayload(payload);
+        if (assertedUserId !== undefined && assertedUserId !== '' && assertedUserId !== actor.userId) {
+            return {
+                ok: false,
+                reason: 'invalid',
+                message: 'X-MCP-User-Id does not match verified token subject',
+            };
+        }
+        return { ok: true, actor };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: 'invalid',
+            message: err instanceof Error ? err.message : 'Token verification failed',
+        };
+    }
+}
+/**
+ * Convenience for app-owned HTTP routes (non-MCP).
+ * Throws on missing/invalid token — mirrors the former template `verifyPrivosUser`.
+ */
+export async function verifyPrivosUser(authHeader, options) {
+    const token = authHeader?.startsWith('Bearer ') ? authHeader.slice('Bearer '.length).trim() : undefined;
+    const result = await verifyUserToken(token, options);
+    if (!result.ok) {
+        throw new Error(result.message);
+    }
+    return result.actor;
+}
+//# sourceMappingURL=user-token.js.map

package/dist/auth/user-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-token.js","sourceRoot":"","sources":["../../src/auth/user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,GAIT,MAAM,MAAM,CAAC;AA8Bd,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,UAAU,CAAC,KAA0C;IAC7D,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACvB,KAAsE;IAEtE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAA6C;IACnE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,OAAoB;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;IACrG,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE;YAC9B,eAAe,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;YAChD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IAC1D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAoB;IACxC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAmB;IAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,QAAQ,GACb,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO;QACN,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,EAAE,GAAG,OAAO,EAA6B;KACjD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,KAAyB,EACzB,OAAoB,EACpB,cAAuB;IAEvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE;YAChE,QAAQ;YACR,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;YACnD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9F,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qDAAqD;aAC9D,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;SACzE,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,UAA8B,EAC9B,OAAoB;IAEpB,MAAM,KAAK,GACV,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC"}

package/dist/context/identity-assertions.d.ts

@@ -0,0 +1,18 @@
+import type { IdentityEnforcementMode } from './identity-mode.js';
+import type { ToolCallContext, VerifiedActor } from './tool-call-context.js';
+export declare class IdentityAssertionError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Pure helper — does not read tool arguments.
+ * App decides whether a call requires an actor, then calls this.
+ */
+export declare function assertActorAvailable(context: ToolCallContext, mode: IdentityEnforcementMode): VerifiedActor;
+/**
+ * Pure helper — `legacyId` must be extracted by the app and passed explicitly.
+ * Runtime never inspects MCP tool arguments.
+ * Mismatch rejects in both observe and enforce modes.
+ */
+export declare function assertActorMatchesLegacyId(actor: VerifiedActor, legacyId: string | undefined | null): void;
+//# sourceMappingURL=identity-assertions.d.ts.map

package/dist/context/identity-assertions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-assertions.d.ts","sourceRoot":"","sources":["../../src/context/identity-assertions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE7E,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAKzC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,uBAAuB,GAC3B,aAAa,CAuBf;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,IAAI,CAQN"}

package/dist/context/identity-assertions.js

@@ -0,0 +1,37 @@
+export class IdentityAssertionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'IdentityAssertionError';
+        this.code = code;
+    }
+}
+/**
+ * Pure helper — does not read tool arguments.
+ * App decides whether a call requires an actor, then calls this.
+ */
+export function assertActorAvailable(context, mode) {
+    if (context.identityState === 'verified' && context.actor) {
+        return context.actor;
+    }
+    if (context.identityState === 'invalid') {
+        throw new IdentityAssertionError('IDENTITY_INVALID', 'Caller identity token is invalid');
+    }
+    if (mode === 'enforce') {
+        throw new IdentityAssertionError('IDENTITY_REQUIRED', 'Verified caller identity is required');
+    }
+    throw new IdentityAssertionError('IDENTITY_MISSING', 'Verified caller identity is missing');
+}
+/**
+ * Pure helper — `legacyId` must be extracted by the app and passed explicitly.
+ * Runtime never inspects MCP tool arguments.
+ * Mismatch rejects in both observe and enforce modes.
+ */
+export function assertActorMatchesLegacyId(actor, legacyId) {
+    if (legacyId == null || legacyId === '')
+        return;
+    if (actor.userId !== legacyId) {
+        throw new IdentityAssertionError('IDENTITY_MISMATCH', 'Verified actor does not match legacy user id');
+    }
+}
+//# sourceMappingURL=identity-assertions.js.map

package/dist/context/identity-assertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-assertions.js","sourceRoot":"","sources":["../../src/context/identity-assertions.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACvC,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAwB,EACxB,IAA6B;IAE7B,IAAI,OAAO,CAAC,aAAa,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,sBAAsB,CAC/B,kBAAkB,EAClB,kCAAkC,CAClC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,sCAAsC,CACtC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,sBAAsB,CAC/B,kBAAkB,EAClB,qCAAqC,CACrC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,KAAoB,EACpB,QAAmC;IAEnC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,8CAA8C,CAC9C,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/context/identity-mode.d.ts

@@ -0,0 +1,3 @@
+export type IdentityEnforcementMode = 'observe' | 'enforce';
+export declare function parseIdentityEnforcementMode(value: string | undefined, fallback?: IdentityEnforcementMode): IdentityEnforcementMode;
+//# sourceMappingURL=identity-mode.d.ts.map

package/dist/context/identity-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-mode.d.ts","sourceRoot":"","sources":["../../src/context/identity-mode.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE5D,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,GAAE,uBAAmC,GAC3C,uBAAuB,CAGzB"}

package/dist/context/identity-mode.js

@@ -0,0 +1,6 @@
+export function parseIdentityEnforcementMode(value, fallback = 'observe') {
+    if (value === 'observe' || value === 'enforce')
+        return value;
+    return fallback;
+}
+//# sourceMappingURL=identity-mode.js.map

package/dist/context/identity-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-mode.js","sourceRoot":"","sources":["../../src/context/identity-mode.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,4BAA4B,CAC3C,KAAyB,EACzB,WAAoC,SAAS;IAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/context/tool-call-context.d.ts

@@ -0,0 +1,29 @@
+export interface VerifiedActor {
+    /** JWT `sub` — stable opaque user id. */
+    userId: string;
+    /** JWT `preferred_username` when present — display only. */
+    username?: string;
+    /** JWT `rid` when present. */
+    roomId?: string;
+    /** Raw claims subset safe for app policy (no token string). */
+    claims: Readonly<Record<string, unknown>>;
+}
+export type IdentityState = 'verified' | 'missing' | 'invalid';
+export interface ToolCallContext {
+    transport: 'direct' | 'relay';
+    requestId?: string | number | null;
+    actor?: VerifiedActor;
+    roomId?: string;
+    appId?: string;
+    traceId?: string;
+    identityState: IdentityState;
+    /**
+     * Scope for duplicate in-flight JSON-RPC id detection.
+     * Direct: MCP-Session-Id or per-request ephemeral id.
+     * Relay: WebSocket connection generation.
+     */
+    sessionScope: string;
+    /** Aborted when the runtime request timeout fires. Handlers should honor when possible. */
+    signal?: AbortSignal;
+}
+//# sourceMappingURL=tool-call-context.d.ts.map

package/dist/context/tool-call-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-call-context.d.ts","sourceRoot":"","sources":["../../src/context/tool-call-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB"}

package/dist/context/tool-call-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tool-call-context.js.map

package/dist/context/tool-call-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-call-context.js","sourceRoot":"","sources":["../../src/context/tool-call-context.ts"],"names":[],"mappings":""}

package/dist/direct/express-router.d.ts

@@ -0,0 +1,35 @@
+import { Router, type Request } from 'express';
+import { type AppDescriptor } from '../app-descriptor.js';
+import type { AuthOptions } from '../auth/user-token.js';
+import { AppServerRuntime, extractDirectCallerCredential, type AppErrorMapper, type AppMcpHandler, type AppServerRuntimeOptions, type CallerCredentialExtractor, type RuntimeLimits, type UiResourceProvider } from '../runtime.js';
+export interface DirectRouterOptions {
+    descriptor: AppDescriptor | (() => AppDescriptor | Promise<AppDescriptor>);
+    handler: AppMcpHandler;
+    ui?: UiResourceProvider;
+    auth?: AuthOptions;
+    mapAppError?: AppErrorMapper;
+    limits?: RuntimeLimits;
+    logger?: AppServerRuntimeOptions['logger'];
+    /** Default `/mcp`. */
+    mcpPath?: string;
+    /** Default `/.well-known/mcp/manifest.json`. */
+    manifestPath?: string;
+    /**
+     * Extra CORS allowed headers. Identity/protocol headers are always included
+     * and cannot be removed by omitting them here.
+     */
+    corsAllowHeaders?: string[];
+    /** Override credential extraction. Must not read body/arguments. */
+    extractCallerCredential?: CallerCredentialExtractor<{
+        headers: Request['headers'];
+    }>;
+    runtime?: AppServerRuntime;
+}
+/**
+ * Composable Express Router for Direct MCP transport.
+ * Mount with `app.use(createDirectRouter(opts))` — does not create or listen on an app,
+ * and does not own `/ui`, health, ready, or register routes.
+ */
+export declare function createDirectRouter(options: DirectRouterOptions): Router;
+export { AppServerRuntime, extractDirectCallerCredential };
+//# sourceMappingURL=express-router.d.ts.map

package/dist/direct/express-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-router.d.ts","sourceRoot":"","sources":["../../src/direct/express-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAoC,MAAM,SAAS,CAAC;AAGjF,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOzD,OAAO,EACN,gBAAgB,EAGhB,6BAA6B,EAE7B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,aAAa,CAAC;IACvB,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;QACnD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAUD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAgFvE;AAyFD,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC"}