@proappstore/cli 2.6.39 → 2.6.41

package/dist/index.js

@@ -16,6 +16,7 @@ import { integrateCommand } from './integrate.js';
 import { workerCommand } from './worker.js';
 import { hookCommand } from './hook.js';
 import { scheduleCommand } from './schedule.js';
+import { mcpAuthCommand } from './mcp-auth.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 const program = new Command();
@@ -60,6 +61,7 @@ program.addCommand(integrateCommand);
 program.addCommand(workerCommand);
 program.addCommand(hookCommand);
 program.addCommand(scheduleCommand);
+program.addCommand(mcpAuthCommand);
 program.parseAsync().catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`pas: ${msg}\n`);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,iBAAiB,EAAE,8FAA8F,CAAC;KACzH,MAAM,CAAC,eAAe,EAAE,6GAA6G,CAAC;KACtI,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAmJ,EAAE,EAAE;IACnL,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAEpC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,iBAAiB,EAAE,8FAA8F,CAAC;KACzH,MAAM,CAAC,eAAe,EAAE,6GAA6G,CAAC;KACtI,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAmJ,EAAE,EAAE;IACnL,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEnC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/mcp-auth.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const mcpAuthCommand: Command;
+//# sourceMappingURL=mcp-auth.d.ts.map

package/dist/mcp-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.d.ts","sourceRoot":"","sources":["../src/mcp-auth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwCpC,eAAO,MAAM,cAAc,SA4ExB,CAAC"}

package/dist/mcp-auth.js

@@ -0,0 +1,131 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Command } from 'commander';
+import { readConfig, resolveToken } from './lib/config.js';
+import { connect, DEFAULT_SERVER_NAME, DEFAULT_TOKEN_ENV, disconnect, identity, mcpResource, readCredential, RemoteAuthError, } from './mcp-remote-auth.js';
+// `pas mcp-auth` (#356): connect a headless machine's MCP client to ProAppStore, approved from a phone.
+// Protocol: docs/mcp-remote-auth-client.md.
+const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'));
+const MCP_ORIGIN = process.env.PAS_MCP_ORIGIN ?? 'https://mcp.proappstore.online';
+function realDeps() {
+    return {
+        fetch,
+        runPags: (args, stdin) => new Promise((resolve, reject) => {
+            const child = spawn('pags', args, { stdio: ['pipe', 'pipe', 'pipe'] });
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', (d) => { stdout += d.toString(); });
+            child.stderr.on('data', (d) => { stderr += d.toString(); });
+            child.on('error', reject);
+            child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+            child.stdin.end(stdin ?? '');
+        }),
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+        now: () => Date.now(),
+        out: (line) => { process.stdout.write(`${line}\n`); },
+        dir: join(homedir(), '.proappstore', 'mcp'),
+        pid: process.pid,
+        isAlive: (pid) => { try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        } },
+    };
+}
+function fail(e) {
+    process.stderr.write(`pas: ${e instanceof RemoteAuthError ? e.message : e instanceof Error ? e.message : String(e)}\n`);
+    process.exit(1);
+}
+export const mcpAuthCommand = new Command('mcp-auth')
+    .description('Connect this machine\'s MCP client to ProAppStore, approved from your phone (no browser on this machine).')
+    .addCommand(new Command('connect')
+    .description('Start a sign-in request, get it approved on your phone, and store the new MCP credential.')
+    .option('--app <id>', 'connect to one app\'s MCP endpoint (/mcp/apps/<id>) instead of the platform /mcp')
+    .option('--name <name>', 'local name for this connection', DEFAULT_SERVER_NAME)
+    .option('--agent <id>', 'the MCP client the credential is for, shown on the approval page', 'codex')
+    .option('--machine <label>', 'how this machine is named on the approval page', hostname())
+    .option('--no-relay', 'do not notify your phone through ProAgentStore; open the printed approval link yourself')
+    .action(async (opts) => {
+    try {
+        const cfg = await readConfig();
+        const resource = mcpResource(MCP_ORIGIN, opts.app);
+        const result = await connect(realDeps(), {
+            apiBase: cfg.apiBase,
+            bearer: resolveToken(),
+            resource,
+            name: opts.name,
+            agent: identity(opts.agent, opts.agent === 'codex' ? 'Codex' : opts.agent),
+            machine: identity(opts.machine, opts.machine),
+            relay: opts.relay,
+            clientVersion: pkg.version,
+        });
+        process.stdout.write([
+            `Connected "${result.name}" to ${result.resource}. The credential is stored in ~/.proappstore/mcp/${result.name}.json (0600).`,
+            'To use it from Codex (once, a separate server entry; your existing ones are untouched):',
+            `  codex mcp add ${result.name} --url ${result.resource} --bearer-token-env-var ${DEFAULT_TOKEN_ENV}`,
+            'then start Codex with the credential in its environment only:',
+            `  pas mcp-auth exec --name ${result.name} -- codex`,
+            '',
+        ].join('\n'));
+    }
+    catch (e) {
+        fail(e);
+    }
+}))
+    .addCommand(new Command('status')
+    .description('Show the stored connection (never the credential itself).')
+    .option('--name <name>', 'local connection name', DEFAULT_SERVER_NAME)
+    .action(async (opts) => {
+    try {
+        const stored = await readCredential(realDeps(), opts.name);
+        if (!stored) {
+            process.stdout.write(`No connection "${opts.name}". Run \`pas mcp-auth connect\`.\n`);
+            return;
+        }
+        const left = stored.expires_at - Date.now();
+        process.stdout.write(`"${opts.name}": ${stored.resource}, ${left > 0 ? `valid for ${Math.round(left / 60_000)} more minutes` : 'expired — run `pas mcp-auth connect` again'}.\n`);
+    }
+    catch (e) {
+        fail(e);
+    }
+}))
+    .addCommand(new Command('exec')
+    .description(`Run a command (e.g. codex) with the stored credential in ${DEFAULT_TOKEN_ENV}, for that process only.`)
+    .option('--name <name>', 'local connection name', DEFAULT_SERVER_NAME)
+    .option('--env-var <name>', 'environment variable to set', DEFAULT_TOKEN_ENV)
+    .argument('<command...>', 'the command to run, after --')
+    .action(async (command, opts) => {
+    try {
+        const stored = await readCredential(realDeps(), opts.name);
+        if (!stored)
+            throw new RemoteAuthError('no_credential', `No connection "${opts.name}". Run \`pas mcp-auth connect\` first.`);
+        if (stored.expires_at <= Date.now())
+            throw new RemoteAuthError('no_credential', `The connection "${opts.name}" has expired. Run \`pas mcp-auth connect\` again.`);
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(opts.envVar))
+            throw new RemoteAuthError('no_credential', `invalid environment variable name "${opts.envVar}"`);
+        const child = spawn(command[0], command.slice(1), { stdio: 'inherit', env: { ...process.env, [opts.envVar]: stored.access_token } });
+        child.on('error', (err) => fail(err));
+        child.on('close', (code) => process.exit(code ?? 1));
+    }
+    catch (e) {
+        fail(e);
+    }
+}))
+    .addCommand(new Command('disconnect')
+    .description('Forget this machine\'s stored connection (local only; your ProAppStore account and other machines are unaffected).')
+    .option('--name <name>', 'local connection name', DEFAULT_SERVER_NAME)
+    .action(async (opts) => {
+    try {
+        const existed = await disconnect(realDeps(), opts.name);
+        process.stdout.write(existed ? `Removed "${opts.name}" from this machine.\n` : `No connection "${opts.name}" on this machine.\n`);
+    }
+    catch (e) {
+        fail(e);
+    }
+}));
+//# sourceMappingURL=mcp-auth.js.map

package/dist/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../src/mcp-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,GAEpH,MAAM,sBAAsB,CAAC;AAE9B,wGAAwG;AACxG,4CAA4C;AAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AACzI,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,gCAAgC,CAAC;AAElF,SAAS,QAAQ;IACf,OAAO;QACL,KAAK;QACL,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAC1E,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC;QAC3C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,CAAU;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KAClD,WAAW,CAAC,2GAA2G,CAAC;KACxH,UAAU,CACT,IAAI,OAAO,CAAC,SAAS,CAAC;KACnB,WAAW,CAAC,2FAA2F,CAAC;KACxG,MAAM,CAAC,YAAY,EAAE,kFAAkF,CAAC;KACxG,MAAM,CAAC,eAAe,EAAE,gCAAgC,EAAE,mBAAmB,CAAC;KAC9E,MAAM,CAAC,cAAc,EAAE,kEAAkE,EAAE,OAAO,CAAC;KACnG,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,EAAE,QAAQ,EAAE,CAAC;KACzF,MAAM,CAAC,YAAY,EAAE,yFAAyF,CAAC;KAC/G,MAAM,CAAC,KAAK,EAAE,IAAoF,EAAE,EAAE;IACrG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE;YACvC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,YAAY,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1E,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,GAAG,CAAC,OAAO;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,cAAc,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,QAAQ,oDAAoD,MAAM,CAAC,IAAI,eAAe;YAC9H,yFAAyF;YACzF,mBAAmB,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,QAAQ,2BAA2B,iBAAiB,EAAE;YACrG,+DAA+D;YAC/D,8BAA8B,MAAM,CAAC,IAAI,WAAW;YACpD,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC1B,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC;KAClB,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CAAC,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/G,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,4CAA4C,KAAK,CAAC,CAAC;IACpL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC1B,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,WAAW,CAAC,4DAA4D,iBAAiB,0BAA0B,CAAC;KACpH,MAAM,CAAC,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,CAAC;KACrE,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,EAAE,iBAAiB,CAAC;KAC5E,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC;KACxD,MAAM,CAAC,KAAK,EAAE,OAAiB,EAAE,IAAsC,EAAE,EAAE;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kBAAkB,IAAI,CAAC,IAAI,wCAAwC,CAAC,CAAC;QAC7H,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,IAAI,oDAAoD,CAAC,CAAC;QAClK,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,sCAAsC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9I,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACtI,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC1B,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,YAAY,CAAC;KACtB,WAAW,CAAC,oHAAoH,CAAC;KACjI,MAAM,CAAC,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,sBAAsB,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC1B,CAAC,CAAC,CACL,CAAC"}

package/dist/mcp-remote-auth-relay.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-remote-auth-relay.test.d.ts.map

package/dist/mcp-remote-auth-relay.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-auth-relay.test.d.ts","sourceRoot":"","sources":["../src/mcp-remote-auth-relay.test.ts"],"names":[],"mappings":""}

package/dist/mcp-remote-auth-relay.test.js

@@ -0,0 +1,95 @@
+import { describe, expect, it } from 'vitest';
+import { assertRelaySafe, checkPagsVersion, identity, mcpResource, relayToAgent, RemoteAuthError, reportRelayState, } from './mcp-remote-auth.js';
+// #356: the PAGS relay contract (ProAgentStore docs/remote-auth-relay.md) as this client keeps it:
+// only the documented public fields leave the machine; exit 2 is a refusal, 1 is retried with the
+// same JSON; state reports are best effort.
+const DETAILS = {
+    request_id: `req_${'a'.repeat(43)}`,
+    agent: { id: 'codex', label: 'Codex' },
+    machine: { id: 'mac-42', label: 'Remote Mac' },
+    resource: 'https://mcp.proappstore.online/mcp',
+    scopes: [],
+    approval_url: `https://api.proappstore.online/v1/mcp/broker/v2/requests/req_${'a'.repeat(43)}/approve`,
+    expires_at: 1_800_000_600_000,
+};
+function pags(exits, calls = []) {
+    return {
+        fetch: (async () => { throw new Error('no network in relay tests'); }),
+        runPags: async (args, stdin) => {
+            calls.push({ args, ...(stdin !== undefined ? { stdin } : {}) });
+            const code = exits.shift() ?? 0;
+            return { code, stdout: code === 0 ? '{"id":"rar_1","url":"https://pags.test/console/remote-auth/rar_1","state":"pending","duplicate":false}\n' : '', stderr: '' };
+        },
+        sleep: async () => undefined,
+        now: () => 0,
+        out: () => undefined,
+        dir: '/nonexistent',
+        pid: 1,
+        isAlive: () => false,
+    };
+}
+describe('what may be relayed', () => {
+    it('accepts exactly the documented public fields', () => {
+        expect(() => assertRelaySafe(DETAILS)).not.toThrow();
+    });
+    it.each([
+        ['a top-level secret', { ...DETAILS, machine_proof: 'x' }],
+        ['a nested secret', { ...DETAILS, machine: { ...DETAILS.machine, private_key: 'x' } }],
+        ['a verifier', { ...DETAILS, code_verifier: 'x' }],
+        ['a token deep in an array', { ...DETAILS, scopes: [{ token: 'x' }] }],
+    ])('refuses %s before anything leaves the machine', (_what, details) => {
+        const calls = [];
+        expect(() => assertRelaySafe(details)).toThrow(RemoteAuthError);
+        return expect(relayToAgent(pags([], calls), details)).rejects.toMatchObject({ code: 'relay_refused' }).then(() => expect(calls).toEqual([]));
+    });
+    it('refuses an approval URL carrying parameters', () => {
+        expect(() => assertRelaySafe({ ...DETAILS, approval_url: `${DETAILS.approval_url}?code=x` })).toThrow(/parameters/);
+        expect(() => assertRelaySafe({ ...DETAILS, approval_url: 'http://api.proappstore.online/x' })).toThrow(/parameters/);
+    });
+});
+describe('relaying', () => {
+    it('sends the request once on stdin and returns the PAGS request', async () => {
+        const calls = [];
+        expect(await relayToAgent(pags([0], calls), DETAILS)).toMatchObject({ id: 'rar_1', duplicate: false });
+        expect(calls).toEqual([{ args: ['remote-auth', 'relay'], stdin: JSON.stringify(DETAILS) }]);
+    });
+    it('retries a transport failure (exit 1) with the identical JSON, so PAGS treats it as the same request', async () => {
+        const calls = [];
+        await relayToAgent(pags([1, 1, 0], calls), DETAILS);
+        expect(calls).toHaveLength(3);
+        expect(new Set(calls.map((c) => c.stdin)).size).toBe(1);
+    });
+    it('gives up after three transport failures, and never retries a refusal (exit 2)', async () => {
+        await expect(relayToAgent(pags([1, 1, 1]), DETAILS)).rejects.toMatchObject({ code: 'network' });
+        const calls = [];
+        await expect(relayToAgent(pags([2], calls), DETAILS)).rejects.toMatchObject({ code: 'relay_refused' });
+        expect(calls).toHaveLength(1);
+    });
+    it('reports a state as `pags remote-auth state <id> <state>`, and a failed report is not fatal', async () => {
+        const calls = [];
+        expect(await reportRelayState(pags([0], calls), 'rar_1', 'approved_awaiting_machine')).toBe(true);
+        expect(calls[0].args).toEqual(['remote-auth', 'state', 'rar_1', 'approved_awaiting_machine']);
+        expect(await reportRelayState(pags([1]), 'rar_1', 'connected')).toBe(false);
+        const broken = { ...pags([]), runPags: async () => { throw new Error('gone'); } };
+        expect(await reportRelayState(broken, 'rar_1', 'connected')).toBe(false);
+    });
+});
+describe('preflight', () => {
+    it.each([['0.4.121', true], ['pags 0.4.130', true], ['0.5.0', true], ['1.0.0', true], ['0.4.120', false], ['0.3.999', false]])('pags %s supported: %s', async (version, ok) => {
+        const deps = { ...pags([]), runPags: async () => ({ code: 0, stdout: version, stderr: '' }) };
+        if (ok)
+            await expect(checkPagsVersion(deps)).resolves.toBeTruthy();
+        else
+            await expect(checkPagsVersion(deps)).rejects.toMatchObject({ code: 'old_cli' });
+    });
+    it('the resource is exactly /mcp or /mcp/apps/:appId on an https origin', () => {
+        expect(mcpResource('https://mcp.proappstore.online/')).toBe('https://mcp.proappstore.online/mcp');
+        expect(mcpResource('https://mcp.proappstore.online', 'stash')).toBe('https://mcp.proappstore.online/mcp/apps/stash');
+        expect(() => mcpResource('https://mcp.proappstore.online', 'Bad/App')).toThrow(RemoteAuthError);
+        expect(() => mcpResource('http://mcp.proappstore.online')).toThrow(/https/);
+    });
+    it('agent and machine names are made broker-safe', () => {
+        expect(identity('Serge\'s MacBook Pro', 'Serge’s MacBook Pro')).toEqual({ id: 'Serge-s-MacBook-Pro', label: 'Serge?s MacBook Pro' });
+    });
+});
+//# sourceMappingURL=mcp-remote-auth-relay.test.js.map

package/dist/mcp-remote-auth-relay.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-auth-relay.test.js","sourceRoot":"","sources":["../src/mcp-remote-auth-relay.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,GAE1G,MAAM,sBAAsB,CAAC;AAE9B,mGAAmG;AACnG,kGAAkG;AAClG,4CAA4C;AAE5C,MAAM,OAAO,GAAiB;IAC5B,UAAU,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;IACnC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;IACtC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;IAC9C,QAAQ,EAAE,oCAAoC;IAC9C,MAAM,EAAE,EAAE;IACV,YAAY,EAAE,gEAAgE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU;IACtG,UAAU,EAAE,iBAAiB;CAC9B,CAAC;AAEF,SAAS,IAAI,CAAC,KAAe,EAAE,QAA8C,EAAE;IAC7E,OAAO;QACL,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAiB;QACtF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,0GAA0G,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACpK,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACZ,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;QACpB,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,oBAAoB,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC1D,CAAC,iBAAiB,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;QACtF,CAAC,YAAY,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAClD,CAAC,0BAA0B,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC,+CAA+C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACrE,MAAM,KAAK,GAAyB,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,OAAkC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1K,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpH,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,MAAM,KAAK,GAAyB,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,KAAK,GAAyB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAC5K,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAC9F,IAAI,EAAE;YAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;;YAC9D,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClG,MAAM,CAAC,WAAW,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACrH,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvI,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-remote-auth.d.ts

@@ -0,0 +1,140 @@
+/**
+ * PAS #356: the machine (client) half of remote MCP sign-in from a phone.
+ *
+ * Contracts, not invented here:
+ *   - the PAS broker v2 (#355, docs/mcp-remote-auth-broker.md, backend/src/routes/mcp-broker.ts);
+ *   - the PAGS relay (ProAgentStore #1005, its docs/remote-auth-relay.md): `pags remote-auth relay`
+ *     takes the request's public details on stdin and pushes the owner a link to that one request.
+ *
+ * The machine keeps its proof, PKCE verifier and P-256 private key; only their hash, the challenge
+ * and the public key leave it. The result is ECDH-encrypted to this machine. Nothing secret is ever
+ * written to stdout/stderr, a URL, the relay or an error message.
+ */
+export declare const BROKER_PREFIX = "/v1/mcp/broker/v2";
+export declare const BROKER_VERSION = "2026-10-10";
+export declare const MIN_PAGS_VERSION = "0.4.121";
+/** Broker poll floor: the server answers an earlier poll with `429 slow_down`. */
+export declare const POLL_MS = 2000;
+/** A separate Codex server name by default, so an existing working entry is never touched. */
+export declare const DEFAULT_SERVER_NAME = "proappstore-remote";
+export declare const DEFAULT_TOKEN_ENV = "PAS_REMOTE_MCP_TOKEN";
+export declare const RELAY_STATES: readonly ["pending", "approving", "approved_awaiting_machine", "consumed", "connected", "denied", "expired", "cancelled", "failed"];
+export type BrokerStatus = typeof RELAY_STATES[number];
+export type RemoteAuthErrorCode = 'not_signed_in' | 'invalid_resource' | 'busy' | 'pags_missing' | 'old_cli' | 'relay_refused' | 'unavailable' | 'denied' | 'cancelled' | 'expired' | 'failed' | 'network' | 'health_check_failed' | 'no_credential';
+/** A user-readable, actionable failure. Its message never carries secret material. */
+export declare class RemoteAuthError extends Error {
+    readonly code: RemoteAuthErrorCode;
+    constructor(code: RemoteAuthErrorCode, message: string);
+}
+export interface Identity {
+    id: string;
+    label: string;
+}
+export interface RemoteAuthDeps {
+    fetch: typeof fetch;
+    /** Run `pags <args>`, `stdin` piped in. A missing binary rejects with an ENOENT error. */
+    runPags: (args: string[], stdin?: string) => Promise<{
+        code: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+    /** One line to the user (stdout). Never passed a secret. */
+    out: (line: string) => void;
+    /** Protected state directory, e.g. ~/.proappstore/mcp. */
+    dir: string;
+    pid: number;
+    isAlive: (pid: number) => boolean;
+}
+export interface MachineSecrets {
+    /** Sent only to the broker's machine endpoints, never relayed or printed. */
+    proof: string;
+    verifier: string;
+    privateKeyPkcs8: string;
+    /** Public: sent when the request is created. */
+    proofHash: string;
+    challenge: string;
+    publicKeySpki: string;
+}
+/** A fresh machine proof, PKCE S256 pair and P-256 key for one request. */
+export declare function generateMachineSecrets(): Promise<MachineSecrets>;
+export interface Envelope {
+    iv: string;
+    ephemeral_public_key: string;
+    ciphertext: string;
+}
+export interface McpCredential {
+    access_token: string;
+    token_type: string;
+    resource: string;
+    expires_in: number;
+}
+/** Open the broker's sealed result: ECDH P-256 → SHA-256 → AES-GCM, the request id as associated data. */
+export declare function openEnvelope(envelope: Envelope, privateKeyPkcs8: string, requestId: string): Promise<McpCredential>;
+/** Exactly `<origin>/mcp` or `<origin>/mcp/apps/:appId` — the only resources the broker accepts. */
+export declare function mcpResource(origin: string, appId?: string): string;
+/** A broker-valid identity: the id restricted to [A-Za-z0-9._:-], the label to printable ASCII. */
+export declare function identity(id: string, label: string): Identity;
+export interface RelayDetails {
+    request_id: string;
+    agent: Identity;
+    machine: Identity;
+    resource: string;
+    scopes: [];
+    approval_url: string;
+    expires_at: number;
+}
+export interface RelayResult {
+    id: string;
+    url: string;
+    state: string;
+    duplicate: boolean;
+}
+/** Only the documented public fields, at any depth, and an approval URL with no query: anything else is refused before it leaves the machine. */
+export declare function assertRelaySafe(value: unknown, path?: string): void;
+/** The `pags` CLI must exist and be at least 0.4.121 (the first with `remote-auth`). */
+export declare function checkPagsVersion(deps: RemoteAuthDeps): Promise<string>;
+/** `pags remote-auth relay`: exit 2 is a refused input; 1 is transport, retried with the same JSON (a duplicate, no second push). */
+export declare function relayToAgent(deps: RemoteAuthDeps, details: RelayDetails): Promise<RelayResult>;
+/** `pags remote-auth state <rar_id> <state>`. Best effort: the page is a view; the broker is authoritative. */
+export declare function reportRelayState(deps: RemoteAuthDeps, rarId: string, state: BrokerStatus): Promise<boolean>;
+/** A harmless authenticated MCP read (JSON-RPC `initialize`); the MCP worker records it as the broker's connected receipt. */
+export declare function performMcpHealthCheck(deps: RemoteAuthDeps, resource: string, token: string, clientVersion: string): Promise<boolean>;
+export interface StoredCredential {
+    version: 1;
+    resource: string;
+    token_type: string;
+    access_token: string;
+    expires_at: number;
+    installed_at: number;
+}
+/** Replace the stored credential only now that it is known to work. */
+export declare function installMcpCredential(deps: RemoteAuthDeps, name: string, credential: McpCredential): Promise<void>;
+export declare function readCredential(deps: RemoteAuthDeps, name: string): Promise<StoredCredential | null>;
+/** Local only: forget this machine's stored credential and any open attempt. No global logout. */
+export declare function disconnect(deps: RemoteAuthDeps, name: string): Promise<boolean>;
+export interface ConnectOptions {
+    apiBase: string;
+    /** The owner's PAS session from `pas login`, used only to create the request. */
+    bearer: string | null;
+    resource: string;
+    name: string;
+    agent: Identity;
+    machine: Identity;
+    relay: boolean;
+    clientVersion: string;
+}
+export interface ConnectResult {
+    requestId: string;
+    resource: string;
+    name: string;
+    resumed: boolean;
+}
+/**
+ * Create (or resume) one request, relay it, wait for the owner, redeem, prove the credential with an
+ * authenticated MCP read, install it, and only then report `connected`. The previous credential is
+ * replaced only after the read succeeded.
+ */
+export declare function connect(deps: RemoteAuthDeps, opts: ConnectOptions): Promise<ConnectResult>;
+//# sourceMappingURL=mcp-remote-auth.d.ts.map

package/dist/mcp-remote-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-auth.d.ts","sourceRoot":"","sources":["../src/mcp-remote-auth.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C,kFAAkF;AAClF,eAAO,MAAM,OAAO,OAAQ,CAAC;AAO7B,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AACxD,eAAO,MAAM,iBAAiB,yBAAyB,CAAC;AACxD,eAAO,MAAM,YAAY,qIAAsI,CAAC;AAChK,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAGvD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GAAG,kBAAkB,GAAG,MAAM,GAAG,cAAc,GAAG,SAAS,GAAG,eAAe,GAC5F,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,qBAAqB,GAAG,eAAe,CAAC;AAExH,sFAAsF;AACtF,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,IAAI,EAAE,mBAAmB;gBAAzB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAIhE;AAED,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAEvD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,0FAA0F;IAC1F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAgBD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,cAAc,CAAC,CAYtE;AAED,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAC1F,MAAM,WAAW,aAAa;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAEjH,0GAA0G;AAC1G,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAazH;AAOD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAOlE;AAED,mGAAmG;AACnG,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAK5D;AA+BD,MAAM,WAAW,YAAY;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAChK,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AAI3F,iJAAiJ;AACjJ,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,IAAI,CAY/D;AAOD,wFAAwF;AACxF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAa5E;AAED,qIAAqI;AACrI,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED,+GAA+G;AAC/G,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAMjH;AAID,8HAA8H;AAC9H,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAe1I;AAED,MAAM,WAAW,gBAAgB;IAAG,OAAO,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AA4BtJ,uEAAuE;AACvE,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvH;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAEzG;AAED,kGAAkG;AAClG,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKrF;AAkCD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAEtG;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAQhG"}