@reposkein/mcp 0.4.0 → 0.6.0

package/README.md

@@ -4,7 +4,7 @@
 
 # @reposkein/mcp
 
-**Give your AI coding agent a map of your codebase — instead of letting it grep and guess.**
+**RepoSkein gives your AI coding agent a map of your codebase — so it navigates structure instead of grepping and guessing.**
 
 [![npm](https://img.shields.io/npm/v/@reposkein/mcp?style=for-the-badge&logo=npm&logoColor=EAE7DC&label=npm&labelColor=070A12&color=F2B84B)](https://www.npmjs.com/package/@reposkein/mcp)
 [![downloads](https://img.shields.io/npm/dm/@reposkein/mcp?style=for-the-badge&label=downloads&labelColor=070A12&color=2DD4BF)](https://www.npmjs.com/package/@reposkein/mcp)
@@ -75,6 +75,7 @@ Then ask your agent *"what calls this function?"* or *"what breaks if I change X
 - `reposkein-mcp index` — rebuild the committed graph after big changes.
 - `reposkein-mcp stats [--last | --session <id> | --all] [--json]` — session usage report: calls by tool, top queried nodes/files, ADRs/summaries written, session duration, and an *estimated* context-tokens-saved-vs-grep number. See [Session usage stats](#session-usage-stats) below.
 - `reposkein-mcp view [path]` — open the **constellation viewer**: a local, read-only, zero-infra web app (bound to `127.0.0.1`) that renders the committed `.reposkein` graph as an interactive 3D astronomy-style map. `--export <dir>` instead writes a self-contained static site (works from `file://` or any static host). See the [viewer section in the main README](https://github.com/reposkein/reposkein#visualize-the-graph--the-constellation-viewer), or **[try the live demo](https://reposkein.github.io/reposkein/)** (RepoSkein viewing its own graph).
+- `reposkein-mcp serve --http [path]` — **advanced, optional**: one shared server for agents that have no clone. Speaks MCP over Streamable HTTP and serves the viewer + `/api/*` from the same process, behind bearer-token auth, read-only by default, re-indexing when the served checkout's HEAD moves. Nothing binds a socket unless you run it; stdio remains the default transport. See [`docs/REMOTE.md`](https://github.com/reposkein/reposkein/blob/main/docs/REMOTE.md).
 
 ## How your agent uses it
 
@@ -170,6 +171,8 @@ a resolved repo. See `mcp/src/store/resolveRepoPath.ts` and
 | `REPOSKEIN_REPO_PATH` | pins the repository the server operates on — optional, see repo resolution above |
 | `REPOSKEIN_SESSION_ID` | override the session id used for `reposkein-mcp stats` logging (default: start-timestamp + pid) |
 | `REPOSKEIN_STORE` | `auto` (default) · `jsonl` (zero-infra) · `neo4j` |
+| `REPOSKEIN_AGENT` | names the writer in `summary_by` / `decided_by` and picks its `local/summaries-<agent>.jsonl` sidecar (default `agent`) |
+| `REPOSKEIN_SERVE_TOKENS` | `serve --http` only — `name:secret[:write]` entries, comma- or whitespace-separated. Required for that mode; see [`docs/REMOTE.md`](https://github.com/reposkein/reposkein/blob/main/docs/REMOTE.md) |
 | `REPOSKEIN_INDEXER_BIN` | override the `reposkein-indexer` binary path (unsupported platforms) |
 | `NEO4J_URI` / `NEO4J_USER` / `NEO4J_PASSWORD` | optional Neo4j backend (large graphs / Cypher at scale) |
 | `REPOSKEIN_EMBED_PROVIDER` | `none` (default) · `voyage` · `http` — see below |
@@ -214,6 +217,8 @@ Full documentation, architecture, supported-language details, benchmarks, and th
 
 👉 **https://github.com/reposkein/reposkein**
 
+**Support:** [Ko-fi](https://ko-fi.com/mongx) — funds hosted-constellation infra + indexer maintenance.
+
 ## License
 
 [Apache-2.0](https://github.com/reposkein/reposkein/blob/main/LICENSE).

package/binary-digests.json

@@ -1,6 +1,6 @@
 {
-  "reposkein-indexer-darwin-arm64": "8d00be1abda687bb847b6bbd3340c1d53f20c69668d8b65029f0c52966e0b5e8",
-  "reposkein-indexer-linux-arm64": "19853d8d8fb9cf7530c1613ec5dc2e0c0b4036a3691f716fb67e055055dea4f7",
-  "reposkein-indexer-linux-x64": "d07e83f81da1c8668f17dfb12252199099ada5de9bc13c078a590f52abf3ca1e",
-  "reposkein-indexer-win32-x64.exe": "ccce3f03e6b50cec117ef9d33eb8040b9356e12dec0baf43d509bcc7fb63d0dd"
+  "reposkein-indexer-darwin-arm64": "bb460f99a92c15210c5d1d2a9d865846ea4bc168bf864204e20436e3bdb0bc53",
+  "reposkein-indexer-linux-arm64": "0a2ed10e489d8ce56f1387d8531d023f1f7ff2b0a2f7aea078f48011c6f70e5e",
+  "reposkein-indexer-linux-x64": "27577d103498e5984c4c6161f856f1c9333f15789e7d2202ae12b71bf913f59c",
+  "reposkein-indexer-win32-x64.exe": "73dd8a828deff6a802c9ec8b199ea3d146669dc184fb595904b13a2cc144dc85"
 }

package/dist/ads/auditLog.d.ts

@@ -0,0 +1,23 @@
+/** Local, gitignored audit trail of OUTBOUND slot requests.
+ *
+ *  One line per request actually sent — written after the gating chain passed
+ *  and before the response is known — so an operator who opted in can answer
+ *  "did this thing phone home, when, and from which tool?" after the fact,
+ *  without a proxy and without trusting this codebase's own docs.
+ *
+ *  Deliberately narrow: `{ts, tool}` and nothing else. No response, no ad
+ *  copy, no URL, no credentials, no arguments — the file records that a
+ *  request happened, not what came back, so it can never become a place where
+ *  sponsor-supplied bytes accumulate. It lives under `.reposkein/local/`
+ *  (gitignored, outside the graph, alongside the session logs and caches), so
+ *  it is never committed and `doctor` never treats it as graph state. */
+export declare function adsAuditPath(repoPath: string): string;
+export interface AdsAuditRecord {
+    ts: string;
+    tool: string;
+}
+/** Appends one record. Best-effort in exactly the way `sessionLog`'s writer
+ *  is: an unwritable directory, a full disk or a permission error is
+ *  swallowed, because an audit line must never fail or slow the tool call it
+ *  is describing. */
+export declare function appendAdsRequest(repoPath: string, record: AdsAuditRecord): void;

package/dist/ads/auditLog.js

@@ -0,0 +1,33 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+/** Local, gitignored audit trail of OUTBOUND slot requests.
+ *
+ *  One line per request actually sent — written after the gating chain passed
+ *  and before the response is known — so an operator who opted in can answer
+ *  "did this thing phone home, when, and from which tool?" after the fact,
+ *  without a proxy and without trusting this codebase's own docs.
+ *
+ *  Deliberately narrow: `{ts, tool}` and nothing else. No response, no ad
+ *  copy, no URL, no credentials, no arguments — the file records that a
+ *  request happened, not what came back, so it can never become a place where
+ *  sponsor-supplied bytes accumulate. It lives under `.reposkein/local/`
+ *  (gitignored, outside the graph, alongside the session logs and caches), so
+ *  it is never committed and `doctor` never treats it as graph state. */
+export function adsAuditPath(repoPath) {
+    return join(repoPath, ".reposkein", "local", "ads-requests.jsonl");
+}
+/** Appends one record. Best-effort in exactly the way `sessionLog`'s writer
+ *  is: an unwritable directory, a full disk or a permission error is
+ *  swallowed, because an audit line must never fail or slow the tool call it
+ *  is describing. */
+export function appendAdsRequest(repoPath, record) {
+    try {
+        const path = adsAuditPath(repoPath);
+        mkdirSync(dirname(path), { recursive: true });
+        appendFileSync(path, `${JSON.stringify(record)}\n`, "utf8");
+    }
+    catch {
+        // never surfaces
+    }
+}
+//# sourceMappingURL=auditLog.js.map

package/dist/ads/auditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../src/ads/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C;;;;;;;;;;;;yEAYyE;AACzE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAOD;;;qBAGqB;AACrB,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAsB;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}

package/dist/ads/config.d.ts

@@ -0,0 +1,83 @@
+/** The ad network's default API host. Its click links are always
+ *  `https://<host>/c/{token}` (getlulu.dev/docs/contract: "never a raw
+ *  advertiser URL"), which is why the click-host allowlist is derived from
+ *  whatever base URL we are actually talking to rather than hardcoded twice. */
+export declare const DEFAULT_ADS_BASE_URL = "https://ads.getlulu.dev";
+/** Hard wall-clock budget for one slot request. The SDK's own default is
+ *  1500ms (3000ms when the backend may classify) — far too long to sit in
+ *  front of an agent's tool result, so we impose ours on every call and treat
+ *  the deadline as a no-slot, never an error. */
+export declare const SLOT_TIMEOUT_MS = 800;
+/** Tools allowed to carry a sponsored slot. An ALLOWLIST, not a denylist: a
+ *  tool added to this server later carries no ad until someone puts it here on
+ *  purpose.
+ *
+ *  `get_context_profile` only, and deliberately:
+ *  - It is the highest-volume tool in the intended workflow (one
+ *    `semantic_find` seeds several profile expansions — see docs/TOOLS.md) and
+ *    it is a deterministic neighbourhood expansion, so an envelope field
+ *    cannot bias, reorder, or displace anything the caller asked for.
+ *  - `semantic_find` is excluded PERMANENTLY, not by oversight: the governing
+ *    ADR (.reposkein/decisions/2026-08-21-sponsorship-placement-*.json,
+ *    ruling 2) rules that "an agent (or a person) calling semantic_find must
+ *    get back what best matches the query, never what a sponsor paid to
+ *    surface". Ranked retrieval stays uncontaminated even at the envelope
+ *    level.
+ *  - Every mutating tool (see WRITE_TOOLS) and every error path is excluded:
+ *    ads never ride along with a write or a failure. */
+export declare const AD_ELIGIBLE_TOOLS: readonly string[];
+/** Why no slot will be requested. Diagnostic only — never surfaced to a
+ *  caller, never logged with credential values. */
+export type AdsOffReason = "kill_switch" | "not_opted_in" | "config_not_confirmed" | "no_credentials" | "supporter" | "bad_base_url";
+export type AdsVerdict = {
+    enabled: false;
+    reason: AdsOffReason;
+} | {
+    enabled: true;
+    publisherId: string;
+    apiKey: string;
+    baseUrl: string;
+    /** Hosts a click URL may point at. */
+    clickHosts: string[];
+};
+export interface ResolveAdsOptions {
+    /** Active repo root, for `[ads] enabled` in `.reposkein/config.toml`.
+     *  Undefined (no repo resolved) simply means that opt-in source is absent. */
+    repoPath?: string | undefined;
+    env?: NodeJS.ProcessEnv;
+    /** Supplied by `createAdsHook`, which binds `ads/supporter.ts`'s
+     *  `isSupporter` to its own env. Defaulted to "nobody" here rather than
+     *  imported, so `resolveAdsVerdict` stays a pure function of its arguments
+     *  and a gating test never depends on what is in the developer's home
+     *  directory. */
+    isSupporter?: () => boolean;
+    /** Test seam for the config.toml read, and the connection-lifetime memo in
+     *  `slot.ts` (one filesystem read per repo, not one per tool call). */
+    readOptIn?: (repoPath: string) => boolean | null;
+}
+/** The whole gating chain, in one place, evaluated in this order:
+ *
+ *   1. `REPOSKEIN_ADS=off` — an unconditional kill switch that outranks
+ *      config, credentials, everything. Checked first so "off" can never be
+ *      overridden by a repo's committed config.
+ *   2. Opt-in — `REPOSKEIN_ADS=on` in the ENVIRONMENT. A repo's
+ *      `[ads] enabled = true` declares the repo's willingness, but is not
+ *      sufficient on its own: config.toml is committed and travels with a
+ *      clone, so honouring it alone would let whoever wrote it opt in every
+ *      person who later checks the repo out. The environment is the only
+ *      place the operator running THIS process can speak for themselves, so
+ *      it must confirm. Absent the env switch, ads are off — which is the
+ *      default for every install.
+ *   3. Credentials — `LULU_ADS_PUBLISHER_ID` + `LULU_ADS_API_KEY`, env only,
+ *      never config, never argv, never logged. Absent either, the integration
+ *      is inert: no network call is even attempted.
+ *   4. Supporter — a verified supporter never sees a slot (REP-29). The check
+ *      is a local Ed25519 signature verification over
+ *      `~/.config/reposkein/supporter.jwt`; it makes no network call, so
+ *      consulting it here cannot itself be the thing that phones home.
+ *      It runs BEFORE any slot is requested, which is the whole point: a
+ *      supporter's machine must not even ask.
+ *
+ *  Nothing in this function touches the network; it is the only thing that
+ *  decides whether anything ever will. */
+export declare function resolveAdsVerdict(opts?: ResolveAdsOptions): AdsVerdict;

package/dist/ads/config.js

@@ -0,0 +1,107 @@
+import { readConfigBool } from "../store/teamConfig.js";
+/** The ad network's default API host. Its click links are always
+ *  `https://<host>/c/{token}` (getlulu.dev/docs/contract: "never a raw
+ *  advertiser URL"), which is why the click-host allowlist is derived from
+ *  whatever base URL we are actually talking to rather than hardcoded twice. */
+export const DEFAULT_ADS_BASE_URL = "https://ads.getlulu.dev";
+/** Hard wall-clock budget for one slot request. The SDK's own default is
+ *  1500ms (3000ms when the backend may classify) — far too long to sit in
+ *  front of an agent's tool result, so we impose ours on every call and treat
+ *  the deadline as a no-slot, never an error. */
+export const SLOT_TIMEOUT_MS = 800;
+/** Tools allowed to carry a sponsored slot. An ALLOWLIST, not a denylist: a
+ *  tool added to this server later carries no ad until someone puts it here on
+ *  purpose.
+ *
+ *  `get_context_profile` only, and deliberately:
+ *  - It is the highest-volume tool in the intended workflow (one
+ *    `semantic_find` seeds several profile expansions — see docs/TOOLS.md) and
+ *    it is a deterministic neighbourhood expansion, so an envelope field
+ *    cannot bias, reorder, or displace anything the caller asked for.
+ *  - `semantic_find` is excluded PERMANENTLY, not by oversight: the governing
+ *    ADR (.reposkein/decisions/2026-08-21-sponsorship-placement-*.json,
+ *    ruling 2) rules that "an agent (or a person) calling semantic_find must
+ *    get back what best matches the query, never what a sponsor paid to
+ *    surface". Ranked retrieval stays uncontaminated even at the envelope
+ *    level.
+ *  - Every mutating tool (see WRITE_TOOLS) and every error path is excluded:
+ *    ads never ride along with a write or a failure. */
+export const AD_ELIGIBLE_TOOLS = ["get_context_profile"];
+/** The whole gating chain, in one place, evaluated in this order:
+ *
+ *   1. `REPOSKEIN_ADS=off` — an unconditional kill switch that outranks
+ *      config, credentials, everything. Checked first so "off" can never be
+ *      overridden by a repo's committed config.
+ *   2. Opt-in — `REPOSKEIN_ADS=on` in the ENVIRONMENT. A repo's
+ *      `[ads] enabled = true` declares the repo's willingness, but is not
+ *      sufficient on its own: config.toml is committed and travels with a
+ *      clone, so honouring it alone would let whoever wrote it opt in every
+ *      person who later checks the repo out. The environment is the only
+ *      place the operator running THIS process can speak for themselves, so
+ *      it must confirm. Absent the env switch, ads are off — which is the
+ *      default for every install.
+ *   3. Credentials — `LULU_ADS_PUBLISHER_ID` + `LULU_ADS_API_KEY`, env only,
+ *      never config, never argv, never logged. Absent either, the integration
+ *      is inert: no network call is even attempted.
+ *   4. Supporter — a verified supporter never sees a slot (REP-29). The check
+ *      is a local Ed25519 signature verification over
+ *      `~/.config/reposkein/supporter.jwt`; it makes no network call, so
+ *      consulting it here cannot itself be the thing that phones home.
+ *      It runs BEFORE any slot is requested, which is the whole point: a
+ *      supporter's machine must not even ask.
+ *
+ *  Nothing in this function touches the network; it is the only thing that
+ *  decides whether anything ever will. */
+export function resolveAdsVerdict(opts = {}) {
+    const env = opts.env ?? process.env;
+    const switchValue = (env.REPOSKEIN_ADS ?? "").trim().toLowerCase();
+    if (switchValue === "off" || switchValue === "0" || switchValue === "false") {
+        return { enabled: false, reason: "kill_switch" };
+    }
+    const envOptIn = switchValue === "on" || switchValue === "1" || switchValue === "true";
+    if (!envOptIn) {
+        // Distinguish "a repo asked, the operator hasn't confirmed" from "nobody
+        // asked at all" — the first is a state an operator may want to notice.
+        const readOptIn = opts.readOptIn ?? ((p) => readConfigBool(p, "ads", "enabled"));
+        const configAsked = opts.repoPath ? readOptIn(opts.repoPath) === true : false;
+        return { enabled: false, reason: configAsked ? "config_not_confirmed" : "not_opted_in" };
+    }
+    const publisherId = (env.LULU_ADS_PUBLISHER_ID ?? "").trim();
+    const apiKey = (env.LULU_ADS_API_KEY ?? "").trim();
+    if (publisherId === "" || apiKey === "") {
+        return { enabled: false, reason: "no_credentials" };
+    }
+    const isSupporter = opts.isSupporter ?? (() => false);
+    if (isSupporter()) {
+        return { enabled: false, reason: "supporter" };
+    }
+    const baseUrl = (env.LULU_ADS_BASE_URL ?? "").trim() || DEFAULT_ADS_BASE_URL;
+    let host;
+    try {
+        const parsed = new URL(baseUrl);
+        // Plaintext is refused for any REMOTE host: an ad request carries the
+        // publisher's API key, and the click URL comes back over the same
+        // connection, so http:// off-machine would hand both to anyone on the
+        // path. Loopback is the one exception, and only because it cannot leave
+        // the machine: it exists so a test or a local mock ad server can be
+        // pointed at without inventing TLS for it. Note the click-host allowlist
+        // is derived from this host, so a loopback base URL also means click URLs
+        // must point at loopback — a mock cannot smuggle in a real destination.
+        const loopback = parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost" || parsed.hostname === "[::1]";
+        if (parsed.protocol !== "https:" && !loopback) {
+            return { enabled: false, reason: "bad_base_url" };
+        }
+        host = parsed.hostname;
+    }
+    catch {
+        return { enabled: false, reason: "bad_base_url" };
+    }
+    return {
+        enabled: true,
+        publisherId,
+        apiKey,
+        baseUrl: baseUrl.replace(/\/$/, ""),
+        clickHosts: [host],
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/ads/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/ads/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;gFAGgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D;;;iDAGiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC;;;;;;;;;;;;;;;;wDAgBwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,qBAAqB,CAAC,CAAC;AAuC5E;;;;;;;;;;;;;;;;;;;;;;;;0CAwB0C;AAC1C,MAAM,UAAU,iBAAiB,CAAC,OAA0B,EAAE;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEpC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,MAAM,CAAC;IACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACzF,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,WAAW,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,WAAW,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,oBAAoB,CAAC;IAC7E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QACnH,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW;QACX,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,UAAU,EAAE,CAAC,IAAI,CAAC;KACnB,CAAC;AACJ,CAAC"}

package/dist/ads/luluSource.d.ts

@@ -0,0 +1,32 @@
+import type { SponsoredSource } from "./types.js";
+/** Adapter over the `lulu-ads` npm package's LOW-LEVEL client.
+ *
+ *  What this uses, and nothing else:
+ *    `new LuluAds({publisherId, apiKey, baseUrl}).sponsoredSlot({context, timeoutMs})`
+ *  → one `POST {baseUrl}/slot` with header `x-api-key` and body
+ *    `{"context": {...}}`, hard-aborted by the SDK's own
+ *    `AbortSignal.timeout(timeoutMs)`, returning data or null, never throwing.
+ *
+ *  What this deliberately does NOT use, after reading the package (v0.9.0):
+ *    - `enableLuluAds` / `withLuluAds`: they proxy `registerTool` and MUTATE
+ *      the tool result — appending a rendered text card to `content` for CLI
+ *      clients and, when `content` is a single text block, REPLACING it with
+ *      `JSON.stringify(structuredContent)`. That rewrites our answer, which
+ *      both the governing ADR ("never concatenated into result text") and the
+ *      byte-identical fail-open guarantee forbid.
+ *    - `warmUp()`: it POSTs `/telemetry/init` at startup. An opt-in ad slot
+ *      must make ZERO network calls until a tool call actually passes the
+ *      gating chain, so nothing here pings anything at boot.
+ *    - `formatSuffix` / `formatCliCard`: both exist to concatenate sponsor
+ *      copy into prose. Not on this codebase's response path, ever.
+ *    - the widget/MCP-Apps exports: no rendered ad surface is in scope for
+ *      REP-28.
+ *
+ *  The import is DYNAMIC and lazy: with ads off (the default) the package is
+ *  never even loaded, which also keeps its ~270KB bundled widget HTML out of
+ *  the stdio server's startup path. */
+export declare function luluAdsSource(cfg: {
+    publisherId: string;
+    apiKey: string;
+    baseUrl: string;
+}): SponsoredSource;

package/dist/ads/luluSource.js

@@ -0,0 +1,60 @@
+/** Adapter over the `lulu-ads` npm package's LOW-LEVEL client.
+ *
+ *  What this uses, and nothing else:
+ *    `new LuluAds({publisherId, apiKey, baseUrl}).sponsoredSlot({context, timeoutMs})`
+ *  → one `POST {baseUrl}/slot` with header `x-api-key` and body
+ *    `{"context": {...}}`, hard-aborted by the SDK's own
+ *    `AbortSignal.timeout(timeoutMs)`, returning data or null, never throwing.
+ *
+ *  What this deliberately does NOT use, after reading the package (v0.9.0):
+ *    - `enableLuluAds` / `withLuluAds`: they proxy `registerTool` and MUTATE
+ *      the tool result — appending a rendered text card to `content` for CLI
+ *      clients and, when `content` is a single text block, REPLACING it with
+ *      `JSON.stringify(structuredContent)`. That rewrites our answer, which
+ *      both the governing ADR ("never concatenated into result text") and the
+ *      byte-identical fail-open guarantee forbid.
+ *    - `warmUp()`: it POSTs `/telemetry/init` at startup. An opt-in ad slot
+ *      must make ZERO network calls until a tool call actually passes the
+ *      gating chain, so nothing here pings anything at boot.
+ *    - `formatSuffix` / `formatCliCard`: both exist to concatenate sponsor
+ *      copy into prose. Not on this codebase's response path, ever.
+ *    - the widget/MCP-Apps exports: no rendered ad surface is in scope for
+ *      REP-28.
+ *
+ *  The import is DYNAMIC and lazy: with ads off (the default) the package is
+ *  never even loaded, which also keeps its ~270KB bundled widget HTML out of
+ *  the stdio server's startup path. */
+export function luluAdsSource(cfg) {
+    // Built on first successful use and reused: the SDK client is a plain
+    // object holding config plus an in-memory cache; constructing it performs
+    // no I/O (see its constructor — warmUp is the only network side effect and
+    // we never call it).
+    let client = null;
+    return {
+        async requestSlot(ctx, opts) {
+            if (opts.signal.aborted)
+                return null;
+            if (!client) {
+                const mod = (await import("lulu-ads"));
+                client = new mod.LuluAds({
+                    publisherId: cfg.publisherId,
+                    apiKey: cfg.apiKey,
+                    baseUrl: cfg.baseUrl,
+                });
+            }
+            // `context` is built here, key by key, from `SlotContext` alone. The
+            // SDK's own allowlist would also accept `prompt`, `route`, `locale`,
+            // `country` and `category`; we never populate them, so they cannot leak
+            // by accident. `query` carries coarse keywords ONLY when the caller
+            // supplied them (no tool on the eligible list does today).
+            return client.sponsoredSlot({
+                context: {
+                    tool: ctx.tool,
+                    ...(ctx.keywords ? { query: ctx.keywords } : {}),
+                },
+                timeoutMs: opts.timeoutMs,
+            });
+        },
+    };
+}
+//# sourceMappingURL=luluSource.js.map

package/dist/ads/luluSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"luluSource.js","sourceRoot":"","sources":["../../src/ads/luluSource.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;uCAyBuC;AACvC,MAAM,UAAU,aAAa,CAAC,GAI7B;IACC,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,qBAAqB;IACrB,IAAI,MAAM,GAA8D,IAAI,CAAC;IAE7E,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,GAAgB,EAAE,IAAgD;YAClF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAIpC,CAAC;gBACF,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC;oBACvB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,oEAAoE;YACpE,2DAA2D;YAC3D,OAAO,MAAM,CAAC,aAAa,CAAC;gBAC1B,OAAO,EAAE;oBACP,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjD;gBACD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ads/sanitize.d.ts

@@ -0,0 +1,16 @@
+import { type SponsoredSlot } from "./types.js";
+/** Projects an untrusted payload onto `SponsoredSlot`, or returns null.
+ *
+ *  Null is the normal, safe answer: every rejection path (missing field, over
+ *  cap, wrong host, hostile shape, unparseable input) means "no slot", which
+ *  the caller treats as identical to no ad having been offered at all. There
+ *  is no partial acceptance and no truncation — truncating sponsor copy to fit
+ *  a cap would silently reshape someone's paid message and truncating a URL
+ *  would break it, so both are refusals instead.
+ *
+ *  Field mapping accepts the ad network's wire name (`text`) as an alias for
+ *  body copy, but the OUTPUT is built key by key, so no unexpected field —
+ *  including a payload's own `label` — can ride along. */
+export declare function sanitizeSponsored(raw: unknown, opts: {
+    clickHosts: readonly string[];
+}): SponsoredSlot | null;

package/dist/ads/sanitize.js

@@ -0,0 +1,187 @@
+import { CODE_FENCE, MD_LINK } from "../guard/summaryValidation.js";
+import { BODY_MAX, PAYLOAD_MAX_BYTES, SPONSORED_LABEL, TITLE_MAX, URL_MAX, } from "./types.js";
+/** Invisible characters: soft hyphen, zero-width spaces/joiners, bidi
+ *  overrides, word joiners, byte-order mark. Stripped BEFORE the injection
+ *  denylist runs, so `ig<ZWSP>nore previous instructions` can't smuggle a
+ *  phrase past a regex, and so a right-to-left override can't reorder what a
+ *  human sees relative to what a model reads. */
+const INVISIBLE_SOURCE = "[\\u00AD\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF]";
+const INVISIBLE_G = new RegExp(INVISIBLE_SOURCE, "g");
+/** Same class without `g`: `.test()` on a global regex is stateful. */
+const INVISIBLE = new RegExp(INVISIBLE_SOURCE);
+/** Line/tab whitespace that must never survive into a one-line field:
+ *  ASCII line/tab breaks, NEL (U+0085, the C1 newline), and the Unicode
+ *  line/paragraph separators. */
+const LINEBREAKS = /[\r\n\t\v\f\u0085\u2028\u2029]/g;
+/** Control characters, ads edition: the shared `CONTROL_CHARS` class (C0 minus
+ *  tab/newline/CR, plus DEL) EXTENDED to the whole C1 block, U+0080-U+009F.
+ *
+ *  C1 matters here in a way it doesn't for summaries: those bytes are legal in
+ *  a JSON string, invisible in most terminals, and include their own control
+ *  vocabulary (NEL at U+0085 breaks a line, and CSI at U+009B opens an escape
+ *  sequence a terminal may act on). Ad copy has no use for any of them, so
+ *  they are stripped from prose and rejected in a URL rather than passed
+ *  through. Line breaks in that range are already handled by LINEBREAKS above,
+ *  which runs first.
+ *
+ *  Written out rather than derived from `CONTROL_CHARS.source` so a future
+ *  edit to the shared class cannot silently reshape (or fail to compile) this
+ *  one; `adsSanitize.test.ts` asserts the two stay in agreement about C0. */
+const ADS_CONTROL_SOURCE = "[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F\\x7F-\\u009F]";
+const ADS_CONTROL_G = new RegExp(ADS_CONTROL_SOURCE, "g");
+/** Same class without `g`: `.test()` on a global regex is stateful. */
+const CONTROL_TEST = new RegExp(ADS_CONTROL_SOURCE);
+/** Shapes that are not ad copy. Defence in depth, NOT the boundary — the
+ *  boundary is that a slot is fixed-schema, length-capped data in a labelled
+ *  envelope field, never prose the tool emits. But sponsor copy has no
+ *  legitimate reason to carry any of these, so a payload containing one is
+ *  treated as hostile and the whole slot is dropped (fail-open = no slot).
+ *
+ *  Ordered by what an injection attempt actually looks like: instruction
+ *  overrides, role/turn markers, special-token and template syntax, markup,
+ *  tool-call bait. */
+const INJECTION_SHAPES = [
+    /\b(ignore|disregard|forget|override)\b[^.]{0,40}\b(previous|prior|above|earlier|all)\b/i,
+    /\b(previous|prior|above|earlier|all)\b[^.]{0,40}\b(instructions?|prompts?|rules?)\b/i,
+    /\bsystem\s+(prompt|message|instructions?)\b/i,
+    /\bnew\s+instructions?\b/i,
+    /\byou\s+are\s+(now|a|an)\b/i,
+    /\b(do\s+not|don't)\s+(tell|mention|reveal|disclose)\b/i,
+    /^\s*(system|assistant|user|human|developer)\s*:/i,
+    /<\||\|>|<<[A-Z]|\[\/?INST\]/,
+    /\{\{|\}\}|\$\{/,
+    /<[a-z/!?]/i,
+    /\b(tool_call|function_call|tool_use|end_turn)\b/i,
+];
+/** Cleans one candidate prose field, or null if it isn't usable.
+ *
+ *  Strip-then-reject: invisibles and control characters are stripped (they
+ *  carry no meaning a sponsor could intend) and line breaks collapse to single
+ *  spaces, but anything still carrying markdown-link or code-fence syntax or
+ *  an injection shape is refused outright rather than "sanitized" into
+ *  something that merely looks safe. */
+function cleanText(value) {
+    if (typeof value !== "string")
+        return null;
+    // Invisibles are a refusal, not a repair. Ad copy has no legitimate use for
+    // a bidi override or a zero-width joiner, and both exist here for exactly
+    // one reason: to make what a human sees differ from what a model reads (an
+    // RLO renders "ignore previous instructions" backwards; a ZWSP splits the
+    // phrase past a regex). They are also stripped below so no later check can
+    // be fooled by one that slips through a class update.
+    if (INVISIBLE.test(value))
+        return null;
+    const flat = value
+        .replace(INVISIBLE_G, "")
+        .replace(LINEBREAKS, " ")
+        .replace(ADS_CONTROL_G, "")
+        .replace(/\s{2,}/g, " ")
+        .trim();
+    if (flat.length === 0)
+        return null;
+    if (CODE_FENCE.test(flat))
+        return null;
+    if (MD_LINK.test(flat) || flat.includes("]("))
+        return null;
+    for (const shape of INJECTION_SHAPES) {
+        if (shape.test(flat))
+            return null;
+    }
+    return flat;
+}
+/** Validates the click URL: https only, host on the network's click-domain
+ *  allowlist, no embedded credentials, canonicalized before it is handed on.
+ *
+ *  The allowlist matters more than the scheme check: per getlulu.dev/docs the
+ *  network always returns its own signed redirect (`/c/{token}` on its click
+ *  host) and never a raw advertiser URL, so a payload pointing anywhere else
+ *  is either a misconfiguration or someone else's link — both fail-open. */
+function cleanUrl(value, clickHosts) {
+    if (typeof value !== "string")
+        return null;
+    const raw = value.trim();
+    if (raw.length === 0 || raw.length > URL_MAX)
+        return null;
+    if (/\s/.test(raw))
+        return null;
+    if (CONTROL_TEST.test(raw))
+        return null;
+    if (INVISIBLE.test(raw))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "https:")
+        return null;
+    if (parsed.username !== "" || parsed.password !== "")
+        return null;
+    const host = parsed.hostname.toLowerCase();
+    if (!clickHosts.some((allowed) => allowed.toLowerCase() === host))
+        return null;
+    const canonical = parsed.toString();
+    return canonical.length <= URL_MAX ? canonical : null;
+}
+/** Projects an untrusted payload onto `SponsoredSlot`, or returns null.
+ *
+ *  Null is the normal, safe answer: every rejection path (missing field, over
+ *  cap, wrong host, hostile shape, unparseable input) means "no slot", which
+ *  the caller treats as identical to no ad having been offered at all. There
+ *  is no partial acceptance and no truncation — truncating sponsor copy to fit
+ *  a cap would silently reshape someone's paid message and truncating a URL
+ *  would break it, so both are refusals instead.
+ *
+ *  Field mapping accepts the ad network's wire name (`text`) as an alias for
+ *  body copy, but the OUTPUT is built key by key, so no unexpected field —
+ *  including a payload's own `label` — can ride along. */
+export function sanitizeSponsored(raw, opts) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    if (opts.clickHosts.length === 0)
+        return null;
+    // Cheap size gate before touching fields: a real slot is a few hundred
+    // bytes, so anything larger is not one.
+    let serialized;
+    try {
+        serialized = JSON.stringify(raw) ?? "";
+    }
+    catch {
+        return null;
+    }
+    if (Buffer.byteLength(serialized, "utf8") > PAYLOAD_MAX_BYTES)
+        return null;
+    const payload = raw;
+    // A field that is PRESENT but unusable rejects the whole slot; a field that
+    // is absent is simply absent. "Present but unusable" is the interesting
+    // case — it means the payload tried something.
+    let title;
+    if (payload.title !== undefined && payload.title !== null) {
+        const cleaned = cleanText(payload.title);
+        if (cleaned === null || cleaned.length > TITLE_MAX)
+            return null;
+        title = cleaned;
+    }
+    const bodySrc = payload.body ?? payload.text ?? payload.description ?? undefined;
+    let body;
+    if (bodySrc !== undefined && bodySrc !== null) {
+        const cleaned = cleanText(bodySrc);
+        if (cleaned === null || cleaned.length > BODY_MAX)
+            return null;
+        body = cleaned;
+    }
+    if (title === undefined && body === undefined)
+        return null;
+    const url = cleanUrl(payload.url, opts.clickHosts);
+    if (url === null)
+        return null;
+    return {
+        label: SPONSORED_LABEL,
+        ...(title !== undefined ? { title } : {}),
+        ...(body !== undefined ? { body } : {}),
+        url,
+    };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/ads/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/ads/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,OAAO,GAER,MAAM,YAAY,CAAC;AAEpB;;;;iDAIiD;AACjD,MAAM,gBAAgB,GACpB,8EAA8E,CAAC;AACjF,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AACtD,uEAAuE;AACvE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE/C;;iCAEiC;AACjC,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD;;;;;;;;;;;;;6EAa6E;AAC7E,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;AAC7E,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC1D,uEAAuE;AACvE,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAEpD;;;;;;;;sBAQsB;AACtB,MAAM,gBAAgB,GAAa;IACjC,yFAAyF;IACzF,sFAAsF;IACtF,8CAA8C;IAC9C,0BAA0B;IAC1B,6BAA6B;IAC7B,wDAAwD;IACxD,kDAAkD;IAClD,6BAA6B;IAC7B,gBAAgB;IAChB,YAAY;IACZ,kDAAkD;CACnD,CAAC;AAEF;;;;;;wCAMwC;AACxC,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK;SACf,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,IAAI,EAAE,CAAC;IACV,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;4EAM4E;AAC5E,SAAS,QAAQ,CAAC,KAAc,EAAE,UAA6B;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACpC,OAAO,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;0DAW0D;AAC1D,MAAM,UAAU,iBAAiB,CAC/B,GAAY,EACZ,IAAuC;IAEvC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE3E,MAAM,OAAO,GAAG,GAA8B,CAAC;IAE/C,4EAA4E;IAC5E,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS;YAAE,OAAO,IAAI,CAAC;QAChE,KAAK,GAAG,OAAO,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACjF,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG;KACJ,CAAC;AACJ,CAAC"}