@rndmjoker/proton-mcp 0.4.4

package/dist/config.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Configuration from environment variables and from a credentials file.
+ *
+ * The Bridge's ports are configurable in the Bridge itself, so they are never
+ * hard-coded anywhere.
+ *
+ * Why a file at all: an AI client stores the environment it passes to a server
+ * in its own configuration, in plain text, and reads it on every start. Keeping
+ * the Bridge password out of there is worth a little machinery. A file outside
+ * the repository with mode 600 keeps it out of there, and it works the same on
+ * every platform, unlike a wrapper script.
+ *
+ * This is a stopgap. The real answer is signing in through the local web
+ * interface, tracked in #16 and #17, after which this path goes away (#18).
+ */
+export interface Config {
+    /** Address of the Bridge, in practice always 127.0.0.1. */
+    host: string;
+    /**
+     * The Bridge's IMAP port.
+     *
+     * Changeable while the server runs, through the web interface. The one
+     * configuration object is shared with the Connection, which reads it on every
+     * reconnect, so writing here and closing the connection is all it takes. See
+     * settings.ts for why this one setting is worth that.
+     */
+    imapPort: number;
+    smtpPort: number;
+    /** When true, every modifying operation is blocked. */
+    readOnly: boolean;
+    /** Port for the local web interface. Fixed for the life of the process. */
+    webPort: number;
+}
+/** Credentials, whether they come from the environment or from a store. */
+export interface BridgeCredentials {
+    user: string;
+    pass: string;
+}
+/** Thrown when the configuration is unusable. */
+export declare class ConfigError extends Error {
+    name: string;
+}
+/** Where the credentials file is looked for. */
+export declare function credentialsPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Parses a file of `KEY=value` lines.
+ *
+ * Comments and blank lines are ignored. Values are taken literally apart from
+ * one layer of surrounding quotes, because a Bridge password can contain
+ * characters that would otherwise invite guessing games.
+ */
+export declare function parseEnvFile(content: string): Record<string, string>;
+/**
+ * Warns when a credentials file is readable by others.
+ *
+ * A warning rather than a refusal: on Windows the POSIX bits carry no meaning,
+ * and refusing to start over a file mode would be a poor trade for someone who
+ * knows what their setup looks like.
+ */
+export declare function permissionWarning(mode: number): string | undefined;
+export interface LoadOptions {
+    /** Where warnings go. Defaults to stderr, never stdout, which carries the protocol. */
+    onWarning?: (message: string) => void;
+    /** Skips the credentials file. Used by tests. */
+    skipFile?: boolean;
+}
+/**
+ * Reads the configuration.
+ *
+ * Credentials are no longer part of this: they can arrive through the web
+ * interface at any time, so a missing password is not a configuration error and
+ * must not stop the server from starting. See session.ts.
+ */
+export declare function loadConfig(env?: NodeJS.ProcessEnv): Config;
+/**
+ * Which ports the user set themselves.
+ *
+ * Stored settings must not override an explicit environment variable: someone
+ * who set BRIDGE_IMAP_PORT meant it, and having a saved value quietly win would
+ * make their setting a lie that is very hard to spot.
+ */
+export declare function portsSetExplicitly(env?: NodeJS.ProcessEnv): {
+    imapPort: boolean;
+    smtpPort: boolean;
+};
+/**
+ * Credentials from the environment, if they are there.
+ *
+ * Only the environment: the file is read by the plain-file store, which is one
+ * of the four the user can choose from.
+ */
+export declare function credentialsFromEnvironment(env?: NodeJS.ProcessEnv): BridgeCredentials | undefined;

package/dist/config.js

@@ -0,0 +1,142 @@
+/**
+ * Configuration from environment variables and from a credentials file.
+ *
+ * The Bridge's ports are configurable in the Bridge itself, so they are never
+ * hard-coded anywhere.
+ *
+ * Why a file at all: an AI client stores the environment it passes to a server
+ * in its own configuration, in plain text, and reads it on every start. Keeping
+ * the Bridge password out of there is worth a little machinery. A file outside
+ * the repository with mode 600 keeps it out of there, and it works the same on
+ * every platform, unlike a wrapper script.
+ *
+ * This is a stopgap. The real answer is signing in through the local web
+ * interface, tracked in #16 and #17, after which this path goes away (#18).
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+/** Thrown when the configuration is unusable. */
+export class ConfigError extends Error {
+    name = 'ConfigError';
+}
+/** Where the credentials file is looked for. */
+export function credentialsPath(env = process.env) {
+    if (env.PROTON_MCP_ENV_FILE)
+        return env.PROTON_MCP_ENV_FILE;
+    return join(homedir(), '.config', 'proton-mcp', 'env');
+}
+/**
+ * Parses a file of `KEY=value` lines.
+ *
+ * Comments and blank lines are ignored. Values are taken literally apart from
+ * one layer of surrounding quotes, because a Bridge password can contain
+ * characters that would otherwise invite guessing games.
+ */
+export function parseEnvFile(content) {
+    const out = {};
+    for (const line of content.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eq = trimmed.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        let value = trimmed.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"') && value.length > 1) ||
+            (value.startsWith("'") && value.endsWith("'") && value.length > 1)) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Warns when a credentials file is readable by others.
+ *
+ * A warning rather than a refusal: on Windows the POSIX bits carry no meaning,
+ * and refusing to start over a file mode would be a poor trade for someone who
+ * knows what their setup looks like.
+ */
+export function permissionWarning(mode) {
+    // Anything set in the group or other bits.
+    if ((mode & 0o077) === 0)
+        return undefined;
+    return (`the file is readable by other users (mode ${(mode & 0o777).toString(8)}). ` +
+        'Restrict it with: chmod 600 <file>');
+}
+/** Reads the credentials file if there is one. Absence is not an error. */
+function readCredentialsFile(path, onWarning) {
+    let content;
+    try {
+        content = readFileSync(path, 'utf8');
+    }
+    catch {
+        // No file, unreadable, whatever: fall back to the environment.
+        return {};
+    }
+    if (platform() !== 'win32') {
+        try {
+            const warning = permissionWarning(statSync(path).mode);
+            if (warning)
+                onWarning(`${path}: ${warning}`);
+        }
+        catch {
+            // Not being able to stat a file we just read is not worth failing over.
+        }
+    }
+    return parseEnvFile(content);
+}
+function port(value, fallback, field) {
+    if (value === undefined || value === '')
+        return fallback;
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < 1 || n > 65535) {
+        throw new ConfigError(`${field} is "${value}", which is not a valid port number. Expected a whole number between 1 and 65535.`);
+    }
+    return n;
+}
+/**
+ * Reads the configuration.
+ *
+ * Credentials are no longer part of this: they can arrive through the web
+ * interface at any time, so a missing password is not a configuration error and
+ * must not stop the server from starting. See session.ts.
+ */
+export function loadConfig(env = process.env) {
+    return {
+        host: env.BRIDGE_HOST?.trim() || '127.0.0.1',
+        imapPort: port(env.BRIDGE_IMAP_PORT, 1143, 'BRIDGE_IMAP_PORT'),
+        smtpPort: port(env.BRIDGE_SMTP_PORT, 1025, 'BRIDGE_SMTP_PORT'),
+        readOnly: env.PROTON_MCP_READ_ONLY === 'true',
+        webPort: port(env.PROTON_MCP_WEB_PORT, 7345, 'PROTON_MCP_WEB_PORT'),
+    };
+}
+/**
+ * Which ports the user set themselves.
+ *
+ * Stored settings must not override an explicit environment variable: someone
+ * who set BRIDGE_IMAP_PORT meant it, and having a saved value quietly win would
+ * make their setting a lie that is very hard to spot.
+ */
+export function portsSetExplicitly(env = process.env) {
+    return {
+        imapPort: Boolean(env.BRIDGE_IMAP_PORT?.trim()),
+        smtpPort: Boolean(env.BRIDGE_SMTP_PORT?.trim()),
+    };
+}
+/**
+ * Credentials from the environment, if they are there.
+ *
+ * Only the environment: the file is read by the plain-file store, which is one
+ * of the four the user can choose from.
+ */
+export function credentialsFromEnvironment(env = process.env) {
+    const user = env.BRIDGE_USER?.trim();
+    const pass = env.BRIDGE_PASS;
+    if (!user || !pass)
+        return undefined;
+    return { user, pass };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA2BhC,iDAAiD;AACjD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAA;CAC9B;AAED,gDAAgD;AAChD,MAAM,UAAU,eAAe,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAClE,IAAI,GAAG,CAAC,mBAAmB;QAAE,OAAO,GAAG,CAAC,mBAAmB,CAAA;IAC3D,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAQ;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACvC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAClE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAClE,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,2CAA2C;IAC3C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,OAAO,CACL,6CAA6C,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;QAC5E,oCAAoC,CACrC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAC1B,IAAY,EACZ,SAAoC;IAEpC,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;YACtD,IAAI,OAAO;gBAAE,SAAS,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAA;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CACnB,GAAG,KAAK,QAAQ,KAAK,mFAAmF,CACzG,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7D,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,WAAW;QAC5C,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,CAAC;QAC9D,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,CAAC;QAC9D,QAAQ,EAAE,GAAG,CAAC,oBAAoB,KAAK,MAAM;QAC7C,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,qBAAqB,CAAC;KACpE,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;KAChD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACvB,CAAC"}

package/dist/credentials/availability.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Which storage options actually work on this machine.
+ *
+ * A table saying "Linux can do this" would be wrong: the same Linux with and
+ * without a graphical session is a different machine as far as a keyring is
+ * concerned. So the keyring is probed for real, by writing a value and reading
+ * it back.
+ *
+ * The probe runs in a **child process**, and that is the whole point of this
+ * module. A locked keyring opens a dialog, the underlying calls are synchronous,
+ * and a synchronous call cannot be abandoned from the same thread. In-process
+ * the probe could therefore hang forever, taking the server with it. A child
+ * process can be killed.
+ */
+import { type StoreKind, type StoreDescription } from './store.js';
+export interface StoreAvailability extends StoreDescription {
+    available: boolean;
+    /** Why it cannot be used. Only set when available is false. */
+    reason?: string;
+    /** How long the probe took, for diagnostics. Only for the keyring. */
+    probeMs?: number;
+}
+/** How long the keyring probe may take before it counts as unusable. */
+export declare const PROBE_TIMEOUT_MS = 5000;
+export type ProbeResult = {
+    ok: true;
+    writeMs: number;
+    readMs: number;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Probes the keyring in a child process.
+ *
+ * Timing out is a normal result, not an error: it is what a locked keyring looks
+ * like from the outside, and the answer in both cases is the same, namely that
+ * this option cannot be relied on right now.
+ */
+export declare function probeKeyring(timeoutMs?: number): Promise<ProbeResult>;
+/**
+ * Lists every option with whether it works here.
+ *
+ * All four are always listed. An unavailable one keeps its description and gains
+ * a reason, rather than disappearing: a user who wonders why the keyring is not
+ * offered deserves an answer instead of a shorter list.
+ */
+export declare function listStores(options?: {
+    probe?: (timeoutMs?: number) => Promise<ProbeResult>;
+    os?: string;
+}): Promise<StoreAvailability[]>;
+/**
+ * The option to preselect.
+ *
+ * The keyring when it works, because it is the only one that is both convenient
+ * and not a file. Otherwise the encrypted file, which works everywhere. Never
+ * the plain file: that one should be a deliberate choice, not a default someone
+ * ends up with.
+ */
+export declare function recommend(stores: StoreAvailability[]): StoreKind;
+/** Why the recommendation is what it is, for display next to it. */
+export declare function recommendationReason(stores: StoreAvailability[]): string;

package/dist/credentials/availability.js

@@ -0,0 +1,107 @@
+/**
+ * Which storage options actually work on this machine.
+ *
+ * A table saying "Linux can do this" would be wrong: the same Linux with and
+ * without a graphical session is a different machine as far as a keyring is
+ * concerned. So the keyring is probed for real, by writing a value and reading
+ * it back.
+ *
+ * The probe runs in a **child process**, and that is the whole point of this
+ * module. A locked keyring opens a dialog, the underlying calls are synchronous,
+ * and a synchronous call cannot be abandoned from the same thread. In-process
+ * the probe could therefore hang forever, taking the server with it. A child
+ * process can be killed.
+ */
+import { fork } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { platform } from 'node:os';
+import { STORE_DESCRIPTIONS, PRESENTATION_ORDER, } from './store.js';
+/** How long the keyring probe may take before it counts as unusable. */
+export const PROBE_TIMEOUT_MS = 5000;
+/**
+ * Probes the keyring in a child process.
+ *
+ * Timing out is a normal result, not an error: it is what a locked keyring looks
+ * like from the outside, and the answer in both cases is the same, namely that
+ * this option cannot be relied on right now.
+ */
+export function probeKeyring(timeoutMs = PROBE_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const child = fork(join(here, 'probe-keyring.js'), [], {
+            // The child must not inherit stdio: this process speaks the MCP protocol
+            // over stdout, and a stray line from a child would corrupt it.
+            stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+        });
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.kill('SIGKILL');
+            resolve(result);
+        };
+        const timer = setTimeout(() => {
+            finish({
+                ok: false,
+                reason: `the keyring did not answer within ${timeoutMs} ms. It is probably locked and waiting ` +
+                    'for input. Unlock it and try again, or choose a different place to keep the credentials.',
+            });
+        }, timeoutMs);
+        child.on('message', (message) => finish(message));
+        child.on('error', (error) => finish({ ok: false, reason: error.message }));
+        child.on('exit', (code) => {
+            if (settled)
+                return;
+            finish({ ok: false, reason: `the probe exited unexpectedly with code ${code}.` });
+        });
+    });
+}
+/**
+ * Lists every option with whether it works here.
+ *
+ * All four are always listed. An unavailable one keeps its description and gains
+ * a reason, rather than disappearing: a user who wonders why the keyring is not
+ * offered deserves an answer instead of a shorter list.
+ */
+export async function listStores(options = {}) {
+    const probe = options.probe ?? probeKeyring;
+    const started = Date.now();
+    const keyring = await probe();
+    const probeMs = Date.now() - started;
+    return PRESENTATION_ORDER.map((kind) => {
+        const entry = { ...STORE_DESCRIPTIONS[kind], available: true };
+        if (kind === 'keyring') {
+            entry.available = keyring.ok;
+            entry.probeMs = probeMs;
+            if (!keyring.ok)
+                entry.reason = keyring.reason;
+        }
+        return entry;
+    });
+}
+/**
+ * The option to preselect.
+ *
+ * The keyring when it works, because it is the only one that is both convenient
+ * and not a file. Otherwise the encrypted file, which works everywhere. Never
+ * the plain file: that one should be a deliberate choice, not a default someone
+ * ends up with.
+ */
+export function recommend(stores) {
+    return stores.find((s) => s.kind === 'keyring')?.available ? 'keyring' : 'encrypted-file';
+}
+/** Why the recommendation is what it is, for display next to it. */
+export function recommendationReason(stores) {
+    const keyring = stores.find((s) => s.kind === 'keyring');
+    if (keyring?.available) {
+        return ('Suggested because this machine has a working keyring, and it is the only option that is both ' +
+            'convenient and keeps the password out of a file. You can pick any of the others.');
+    }
+    return ('The system keyring is not usable on this machine, so the encrypted file is suggested instead: ' +
+        'it works everywhere and keeps the password unreadable without your master password. ' +
+        `Reason the keyring is out: ${keyring?.reason ?? 'unknown'}`);
+}
+//# sourceMappingURL=availability.js.map

package/dist/credentials/availability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"availability.js","sourceRoot":"","sources":["../../src/credentials/availability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAGnB,MAAM,YAAY,CAAA;AAUnB,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAMpC;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAAS,GAAG,gBAAgB;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAE,EAAE;YACrD,yEAAyE;YACzE,+DAA+D;YAC/D,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;SAC7C,CAAC,CAAA;QAEF,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACrB,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAA;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,qCAAqC,SAAS,yCAAyC;oBACvF,0FAA0F;aAC7F,CAAC,CAAA;QACJ,CAAC,EAAE,SAAS,CAAC,CAAA;QAEb,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAsB,CAAC,CAAC,CAAA;QAChE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC1E,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAM;YACnB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,IAAI,GAAG,EAAE,CAAC,CAAA;QACnF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAO,GAA0E,EAAE;IAEnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAA;IAE3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IAEpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACrC,MAAM,KAAK,GAAsB,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QACjF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;YAC5B,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;YACvB,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAChD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,MAA2B;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AAC3F,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACxD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CACL,+FAA+F;YAC/F,kFAAkF,CACnF,CAAA;IACH,CAAC;IACD,OAAO,CACL,gGAAgG;QAChG,sFAAsF;QACtF,8BAA8B,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,CAC7D,CAAA;AACH,CAAC"}

package/dist/credentials/encrypted-file.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Credentials in a file, encrypted with a master password.
+ *
+ * The option that needs no system service, which makes it the one for
+ * containers, headless machines and anywhere a keyring is out of reach. The
+ * price is honest and unavoidable: the master password has to be entered every
+ * time the server starts, because storing it somewhere would only move the
+ * problem.
+ *
+ * AES-256-GCM with a key derived by scrypt. GCM rather than CBC so a modified
+ * file is detected instead of decrypting into garbage, and scrypt rather than a
+ * plain hash so guessing the master password stays expensive.
+ */
+import type { CredentialStore, Credentials } from './store.js';
+/** What ends up in the file. Everything except the master password. */
+interface Envelope {
+    version: 1;
+    algorithm: 'aes-256-gcm';
+    kdf: 'scrypt';
+    salt: string;
+    iv: string;
+    authTag: string;
+    ciphertext: string;
+}
+export declare function encryptedFilePath(env?: NodeJS.ProcessEnv): string;
+/** Encrypts credentials into the envelope that gets written to disk. */
+export declare function seal(credentials: Credentials, masterPassword: string): Promise<Envelope>;
+/** Decrypts an envelope. A wrong master password and a tampered file look alike. */
+export declare function unseal(envelope: Envelope, masterPassword: string): Promise<Credentials>;
+export declare class EncryptedFileStore implements CredentialStore {
+    /** Supplies the master password. Asked for as late as possible. */
+    private readonly masterPassword;
+    private readonly path;
+    readonly kind: 'encrypted-file';
+    constructor(
+    /** Supplies the master password. Asked for as late as possible. */
+    masterPassword: () => Promise<string>, path?: string);
+    /**
+     * Whether a credentials file is there, without trying to decrypt it.
+     *
+     * Answers the question the sign-in page needs before it can decide what to
+     * ask for: an existing file means the user only has to supply the master
+     * password, not their Bridge password all over again.
+     */
+    exists(): Promise<boolean>;
+    load(): Promise<Credentials | undefined>;
+    save(credentials: Credentials): Promise<void>;
+    clear(): Promise<void>;
+}
+export {};

package/dist/credentials/encrypted-file.js

@@ -0,0 +1,156 @@
+/**
+ * Credentials in a file, encrypted with a master password.
+ *
+ * The option that needs no system service, which makes it the one for
+ * containers, headless machines and anywhere a keyring is out of reach. The
+ * price is honest and unavoidable: the master password has to be entered every
+ * time the server starts, because storing it somewhere would only move the
+ * problem.
+ *
+ * AES-256-GCM with a key derived by scrypt. GCM rather than CBC so a modified
+ * file is detected instead of decrypting into garbage, and scrypt rather than a
+ * plain hash so guessing the master password stays expensive.
+ */
+import { randomBytes, scrypt as scryptCallback, createCipheriv, createDecipheriv } from 'node:crypto';
+import { readFile, writeFile, unlink, mkdir, access, constants } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { BridgeError } from '../bridge/errors.js';
+/**
+ * Own wrapper instead of promisify: scrypt is overloaded, and promisify picks
+ * the signature without the options object, which is exactly the one we need
+ * because the cost parameters live in there.
+ */
+function scrypt(password, salt, keyLength, options) {
+    return new Promise((resolve, reject) => {
+        scryptCallback(password, salt, keyLength, options, (error, derived) => {
+            if (error)
+                reject(error);
+            else
+                resolve(derived);
+        });
+    });
+}
+/** Deliberately costly. These are the defaults Node documents as reasonable. */
+const SCRYPT = { N: 16_384, r: 8, p: 1, keyLength: 32 };
+const SALT_BYTES = 16;
+const IV_BYTES = 12;
+export function encryptedFilePath(env = process.env) {
+    if (env.PROTON_MCP_VAULT_FILE)
+        return env.PROTON_MCP_VAULT_FILE;
+    return join(homedir(), '.config', 'proton-mcp', 'credentials.enc');
+}
+async function deriveKey(masterPassword, salt) {
+    return scrypt(masterPassword, salt, SCRYPT.keyLength, {
+        N: SCRYPT.N,
+        r: SCRYPT.r,
+        p: SCRYPT.p,
+    });
+}
+/** Encrypts credentials into the envelope that gets written to disk. */
+export async function seal(credentials, masterPassword) {
+    if (!masterPassword) {
+        throw new BridgeError('A master password is required to encrypt the credentials.');
+    }
+    const salt = randomBytes(SALT_BYTES);
+    const iv = randomBytes(IV_BYTES);
+    const key = await deriveKey(masterPassword, salt);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const plaintext = JSON.stringify({ user: credentials.user, pass: credentials.pass });
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    return {
+        version: 1,
+        algorithm: 'aes-256-gcm',
+        kdf: 'scrypt',
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        authTag: cipher.getAuthTag().toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+    };
+}
+/** Decrypts an envelope. A wrong master password and a tampered file look alike. */
+export async function unseal(envelope, masterPassword) {
+    if (envelope.version !== 1 || envelope.algorithm !== 'aes-256-gcm') {
+        throw new BridgeError(`The credentials file uses an unknown format (version ${envelope.version}, ${envelope.algorithm}). ` +
+            'It was probably written by a newer version of proton-mcp.');
+    }
+    const key = await deriveKey(masterPassword, Buffer.from(envelope.salt, 'base64'));
+    const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(envelope.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(envelope.authTag, 'base64'));
+    let plaintext;
+    try {
+        plaintext = Buffer.concat([
+            decipher.update(Buffer.from(envelope.ciphertext, 'base64')),
+            decipher.final(),
+        ]).toString('utf8');
+    }
+    catch {
+        // GCM cannot tell a wrong key from a modified file, and neither can we.
+        // Saying so is better than guessing which one it was.
+        throw new BridgeError('The credentials could not be decrypted. Either the master password is wrong, or the file ' +
+            'was modified. Nothing was changed on disk.');
+    }
+    const parsed = JSON.parse(plaintext);
+    if (!parsed.user || !parsed.pass) {
+        throw new BridgeError('The credentials file decrypted but does not contain a user and password.');
+    }
+    return { user: parsed.user, pass: parsed.pass };
+}
+export class EncryptedFileStore {
+    masterPassword;
+    path;
+    kind = 'encrypted-file';
+    constructor(
+    /** Supplies the master password. Asked for as late as possible. */
+    masterPassword, path = encryptedFilePath()) {
+        this.masterPassword = masterPassword;
+        this.path = path;
+    }
+    /**
+     * Whether a credentials file is there, without trying to decrypt it.
+     *
+     * Answers the question the sign-in page needs before it can decide what to
+     * ask for: an existing file means the user only has to supply the master
+     * password, not their Bridge password all over again.
+     */
+    async exists() {
+        try {
+            await access(this.path, constants.R_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async load() {
+        let raw;
+        try {
+            raw = await readFile(this.path, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+        let envelope;
+        try {
+            envelope = JSON.parse(raw);
+        }
+        catch {
+            throw new BridgeError(`${this.path} is not readable as a credentials file. Delete it and sign in again.`);
+        }
+        return unseal(envelope, await this.masterPassword());
+    }
+    async save(credentials) {
+        const envelope = await seal(credentials, await this.masterPassword());
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        await writeFile(this.path, `${JSON.stringify(envelope, null, 2)}\n`, { mode: 0o600 });
+    }
+    async clear() {
+        try {
+            await unlink(this.path);
+        }
+        catch {
+            // Already gone is the outcome we wanted.
+        }
+    }
+}
+//# sourceMappingURL=encrypted-file.js.map

package/dist/credentials/encrypted-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-file.js","sourceRoot":"","sources":["../../src/credentials/encrypted-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACrG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD;;;;GAIG;AACH,SAAS,MAAM,CACb,QAAgB,EAChB,IAAY,EACZ,SAAiB,EACjB,OAA4C;IAE5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACpE,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBACnB,OAAO,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AACvD,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AAanB,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACpE,IAAI,GAAG,CAAC,qBAAqB;QAAE,OAAO,GAAG,CAAC,qBAAqB,CAAA;IAC/D,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,cAAsB,EAAE,IAAY;IAC3D,OAAO,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;QACpD,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;KACZ,CAAC,CAAA;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,WAAwB,EAAE,cAAsB;IACzE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,2DAA2D,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IAEjD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IACpF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAEpF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,aAAa;QACxB,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAkB,EAAE,cAAsB;IACrE,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,WAAW,CACnB,wDAAwD,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,SAAS,KAAK;YAClG,2DAA2D,CAC9D,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;IACzF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAE5D,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC3D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,IAAI,WAAW,CACnB,2FAA2F;YACzF,4CAA4C,CAC/C,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAA;IACnG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACjD,CAAC;AAED,MAAM,OAAO,kBAAkB;IAKV,cAAc;IACd,IAAI;IALd,IAAI,GAAG,gBAAyB,CAAA;IAEzC;IACE,mEAAmE;IAClD,cAAqC,EACrC,IAAI,GAAW,iBAAiB,EAAE;8BADlC,cAAc;oBACd,IAAI;IACpB,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACvC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CACnB,GAAG,IAAI,CAAC,IAAI,sEAAsE,CACnF,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAwB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;QACrE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;CACF"}