@sirrlock/mcp 0.1.0

package/README.md

@@ -0,0 +1,189 @@
+# @sirrlock/mcp — Sirr MCP Server
+
+Gives AI assistants like Claude direct access to your [Sirr](https://sirr.dev) secret vault. Push, read, and manage ephemeral secrets without leaving a conversation.
+
+## Demo
+
+**Session 1 — store the secret**
+
+```
+❯ set the BITBUCKET_TOKEN to 123asdzxc
+
+⏺ sirr-mcp - push_secret (MCP)(key: "BITBUCKET_TOKEN", value: "123asdzxc", max_reads: 1)
+  ⎿  Stored secret 'BITBUCKET_TOKEN'. Burns after 1 read.
+
+⏺ Stored. Burns after first read.
+```
+
+**Session 2 — Claude retrieves and uses it (the vault burns it)**
+
+```
+❯ deploy to staging using sirr:BITBUCKET_TOKEN
+
+⏺ sirr-mcp - get_secret (MCP)(key: "BITBUCKET_TOKEN")
+  ⎿  123asdzxc
+
+⏺ Got it. Deploying to staging with the token. Done.
+```
+
+**Session 3 — secret is already gone**
+
+```
+❯ what is the BITBUCKET_TOKEN?
+
+⏺ sirr-mcp - get_secret (MCP)(key: "BITBUCKET_TOKEN")
+  ⎿  Secret 'BITBUCKET_TOKEN' not found, expired, or already burned.
+
+⏺ The secret no longer exists on the server.
+```
+
+The secret existed just long enough to be used once. The vault enforces it server-side (`max_reads=1`). Claude is instructed by the tool description not to memorize or repeat the value. Even if a different agent, session, or attacker asks — there is nothing left to return.
+
+## Install
+
+```bash
+npm install -g @sirrlock/mcp
+```
+
+Or use `npx` without a global install — see the configuration block below.
+
+## Quick start
+
+1. **Start Sirr** — run the Sirr server and note the `SIRR_MASTER_KEY` you set (or the one it printed on first launch).
+2. **Set your token** — `SIRR_TOKEN` in your MCP config must equal that `SIRR_MASTER_KEY` value exactly.
+3. **Add to `.mcp.json`** — paste the config block below, substituting your server URL and key.
+4. **Verify** — run `sirr-mcp --health` to confirm the connection before starting your AI session.
+
+## Configuration
+
+Add Sirr to your project's `.mcp.json` or `~/.claude/settings.json`:
+
+```json
+{
+  "mcpServers": {
+    "sirr": {
+      "command": "sirr-mcp",
+      "env": {
+        "SIRR_SERVER": "http://localhost:39999",
+        "SIRR_TOKEN": "your-sirr-master-key"
+      }
+    }
+  }
+}
+```
+
+Using `npx` without a global install:
+
+```json
+{
+  "mcpServers": {
+    "sirr": {
+      "command": "npx",
+      "args": ["-y", "@sirrlock/mcp"],
+      "env": {
+        "SIRR_SERVER": "http://localhost:39999",
+        "SIRR_TOKEN": "your-sirr-master-key"
+      }
+    }
+  }
+}
+```
+
+> **What is `SIRR_TOKEN`?** It is the value of `SIRR_MASTER_KEY` that you set (or that was generated) when you started the Sirr server. These two values must match exactly — a mismatch is the most common cause of 401 errors. See [sirr.dev/errors#401](https://sirr.dev/errors#401).
+
+### Environment variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `SIRR_SERVER` | `http://localhost:39999` | Sirr server URL |
+| `SIRR_TOKEN` | — | Bearer token — must equal `SIRR_MASTER_KEY` on the server |
+
+## CLI flags
+
+```bash
+# Print the installed version and exit
+sirr-mcp --version
+
+# Check that the MCP server can reach Sirr and exit
+SIRR_SERVER=http://localhost:39999 SIRR_TOKEN=mykey sirr-mcp --health
+```
+
+`--health` exits with code `0` on success and `1` on failure, making it safe to use in scripts and CI.
+
+## Available tools
+
+### Secrets
+
+| Tool | Description |
+|---|---|
+| `get_secret(key)` | Retrieve a secret value (increments read counter; burns if max_reads reached) |
+| `push_secret(key, value, ttl_seconds?, max_reads?)` | Store a secret with optional expiry and read limit |
+| `list_secrets()` | List all active secrets — metadata only, values never returned |
+| `delete_secret(key)` | Burn a secret immediately, regardless of TTL or read count |
+| `prune_secrets()` | Delete all expired secrets in one sweep |
+| `health_check()` | Verify the Sirr server is reachable and healthy |
+
+### Audit
+
+| Tool | Description |
+|---|---|
+| `sirr_audit(since?, action?, limit?)` | Query the audit log — secret creates, reads, deletes, and key events |
+
+### Webhooks
+
+| Tool | Description |
+|---|---|
+| `sirr_webhook_create(url, events?)` | Register a webhook URL; returns ID and signing secret (shown once) |
+| `sirr_webhook_list()` | List all registered webhooks (signing secrets redacted) |
+| `sirr_webhook_delete(id)` | Remove a webhook by ID |
+
+### API keys
+
+| Tool | Description |
+|---|---|
+| `sirr_key_create(label, permissions, prefix?)` | Create a scoped API key; raw key returned once — save it |
+| `sirr_key_list()` | List all scoped API keys (key hashes never returned) |
+| `sirr_key_delete(id)` | Delete an API key by ID |
+
+## Inline secret references
+
+You can reference secrets inline in any prompt:
+
+```
+"Use sirr:DATABASE_URL to run a migration"
+"Deploy with sirr:DEPLOY_TOKEN"
+```
+
+The `sirr:KEYNAME` prefix tells Claude to fetch from the vault automatically.
+
+## Security notes
+
+- Claude only sees secret **values** when you explicitly ask it to fetch via `get_secret`
+- `list_secrets` returns metadata only — values are never included
+- Set `max_reads=1` on any secret shared for a single AI session
+- The MCP server never logs secret values
+- `SIRR_TOKEN` lives in your MCP config's `env` block — it is never passed as a tool argument or in prompts
+- Use HTTPS (`https://`) when `SIRR_SERVER` points to a remote host — plain HTTP transmits secrets unencrypted
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| `Error: Sirr 401` | `SIRR_TOKEN` doesn't match `SIRR_MASTER_KEY` | Verify both values match exactly — no extra spaces or newlines. [sirr.dev/errors#401](https://sirr.dev/errors#401) |
+| `Error: Sirr 402` | Free-tier limit of 100 secrets reached | Delete unused secrets or add a `SIRR_LICENSE_KEY`. [sirr.dev/errors#402](https://sirr.dev/errors#402) |
+| `Error: Sirr 403` | Scoped API key lacks the required permission | Re-create the key with the needed permissions. [sirr.dev/errors#403](https://sirr.dev/errors#403) |
+| `Secret '…' not found` | Secret expired, was burned, or key was mistyped | Re-push the secret if you still need it. [sirr.dev/errors#404](https://sirr.dev/errors#404) |
+| `did not respond within 10s` | Sirr server is unreachable | Check `SIRR_SERVER` URL and confirm Sirr is running (`sirr-mcp --health`). |
+| `[sirr-mcp] Warning: SIRR_TOKEN is not set` | Token missing from MCP config | Add `SIRR_TOKEN` to the `env` block in `.mcp.json`. |
+| MCP server not found by Claude | `sirr-mcp` not on PATH | Install globally (`npm install -g @sirrlock/mcp`) or use the `npx` config variant. |
+
+## Related
+
+| Package | Description |
+|---------|-------------|
+| [sirr](https://github.com/sirrlock/sirr) | Rust monorepo: `sirrd` server + `sirr` CLI |
+| [@sirrlock/node](https://github.com/sirrlock/node) | Node.js / TypeScript SDK |
+| [sirr (PyPI)](https://github.com/sirrlock/python) | Python SDK |
+| [Sirr.Client (NuGet)](https://github.com/sirrlock/dotnet) | .NET SDK |
+| [sirr.dev](https://sirr.dev) | Documentation |
+| [secretdrop.app](https://secretdrop.app) | Hosted service + license keys |

package/dist/helpers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Pure helper functions extracted for testability.
+ */
+/**
+ * Parse a secret key reference from natural language.
+ *   "sirr:KEYNAME"   → "KEYNAME"
+ *   "KEYNAME#server" → "KEYNAME"
+ *   "KEYNAME"        → "KEYNAME"
+ */
+export declare function parseKeyRef(ref: string): string;
+/**
+ * Format a Unix timestamp (seconds) as a human-readable TTL string
+ * relative to now. Returns "no expiry" for null, "expired" for past timestamps.
+ */
+export declare function formatTtl(expiresAt: number | null): string;

package/dist/helpers.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Pure helper functions extracted for testability.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeyRef = parseKeyRef;
+exports.formatTtl = formatTtl;
+/**
+ * Parse a secret key reference from natural language.
+ *   "sirr:KEYNAME"   → "KEYNAME"
+ *   "KEYNAME#server" → "KEYNAME"
+ *   "KEYNAME"        → "KEYNAME"
+ */
+function parseKeyRef(ref) {
+    if (ref.startsWith("sirr:"))
+        return ref.slice(5);
+    if (ref.includes("#"))
+        return ref.split("#")[0];
+    return ref.trim();
+}
+/**
+ * Format a Unix timestamp (seconds) as a human-readable TTL string
+ * relative to now. Returns "no expiry" for null, "expired" for past timestamps.
+ */
+function formatTtl(expiresAt) {
+    if (expiresAt === null)
+        return "no expiry";
+    const now = Math.floor(Date.now() / 1000);
+    const secs = expiresAt - now;
+    if (secs <= 0)
+        return "expired";
+    if (secs < 60)
+        return `${secs}s`;
+    if (secs < 3600)
+        return `${Math.floor(secs / 60)}m`;
+    if (secs < 86400)
+        return `${Math.floor(secs / 3600)}h`;
+    return `${Math.floor(secs / 86400)}d`;
+}
+//# sourceMappingURL=helpers.js.map

package/dist/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAQH,kCAIC;AAMD,8BASC;AAzBD;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACjD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,SAAwB;IAChD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC;IAC7B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC;IACpD,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IACvD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;AACxC,CAAC"}

package/dist/helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers.test.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const helpers_1 = require("./helpers");
+(0, globals_1.describe)("parseKeyRef", () => {
+    (0, globals_1.it)("strips sirr: prefix", () => {
+        (0, globals_1.expect)((0, helpers_1.parseKeyRef)("sirr:MY_KEY")).toBe("MY_KEY");
+    });
+    (0, globals_1.it)("extracts key from hash format", () => {
+        (0, globals_1.expect)((0, helpers_1.parseKeyRef)("MY_KEY#some-server")).toBe("MY_KEY");
+    });
+    (0, globals_1.it)("returns bare key as-is", () => {
+        (0, globals_1.expect)((0, helpers_1.parseKeyRef)("MY_KEY")).toBe("MY_KEY");
+    });
+    (0, globals_1.it)("trims whitespace from bare keys", () => {
+        (0, globals_1.expect)((0, helpers_1.parseKeyRef)("  MY_KEY  ")).toBe("MY_KEY");
+    });
+    (0, globals_1.it)("handles sirr: with no key (edge case)", () => {
+        (0, globals_1.expect)((0, helpers_1.parseKeyRef)("sirr:")).toBe("");
+    });
+    (0, globals_1.it)("takes only the part before the first # in hash format", () => {
+        (0, globals_1.expect)((0, helpers_1.parseKeyRef)("KEY#a#b")).toBe("KEY");
+    });
+});
+(0, globals_1.describe)("formatTtl", () => {
+    const realDateNow = Date.now;
+    (0, globals_1.beforeEach)(() => {
+        // Pin now to a fixed Unix timestamp (seconds = 1_000_000)
+        globals_1.jest.spyOn(Date, "now").mockReturnValue(1000000 * 1000);
+    });
+    (0, globals_1.afterEach)(() => {
+        globals_1.jest.restoreAllMocks();
+    });
+    (0, globals_1.it)("returns 'no expiry' for null", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(null)).toBe("no expiry");
+    });
+    (0, globals_1.it)("returns 'expired' for past timestamp", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(999999)).toBe("expired");
+    });
+    (0, globals_1.it)("returns 'expired' for exactly now", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000)).toBe("expired");
+    });
+    (0, globals_1.it)("formats seconds (< 60s)", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 45)).toBe("45s");
+    });
+    (0, globals_1.it)("formats minutes (60s – 3599s)", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 120)).toBe("2m");
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 3599)).toBe("59m");
+    });
+    (0, globals_1.it)("formats hours (3600s – 86399s)", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 3600)).toBe("1h");
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 7200)).toBe("2h");
+    });
+    (0, globals_1.it)("formats days (≥ 86400s)", () => {
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 86400)).toBe("1d");
+        (0, globals_1.expect)((0, helpers_1.formatTtl)(1000000 + 86400 * 7)).toBe("7d");
+    });
+});
+//# sourceMappingURL=helpers.test.js.map

package/dist/helpers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.test.js","sourceRoot":"","sources":["../src/helpers.test.ts"],"names":[],"mappings":";;AAAA,2CAAkF;AAClF,uCAAmD;AAEnD,IAAA,kBAAQ,EAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAA,YAAE,EAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,IAAA,gBAAM,EAAC,IAAA,qBAAW,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,IAAA,gBAAM,EAAC,IAAA,qBAAW,EAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,IAAA,gBAAM,EAAC,IAAA,qBAAW,EAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,IAAA,gBAAM,EAAC,IAAA,qBAAW,EAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,IAAA,gBAAM,EAAC,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,IAAA,gBAAM,EAAC,IAAA,qBAAW,EAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAQ,EAAC,WAAW,EAAE,GAAG,EAAE;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;IAE7B,IAAA,oBAAU,EAAC,GAAG,EAAE;QACd,0DAA0D;QAC1D,cAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,OAAS,GAAG,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAA,mBAAS,EAAC,GAAG,EAAE;QACb,cAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,MAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAA,gBAAM,EAAC,IAAA,mBAAS,EAAC,OAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * @sirrlock/mcp — MCP server for Sirr secret vault
+ *
+ * Exposes Sirr as MCP tools so Claude Code can read/write ephemeral secrets.
+ *
+ * Configuration (env vars):
+ *   SIRR_SERVER  — Sirr server URL (default: http://localhost:39999)
+ *   SIRR_TOKEN   — Bearer token (SIRR_MASTER_KEY on the server)
+ *
+ * Install:  npm install -g @sirrlock/mcp
+ * Configure in .mcp.json:
+ *   {
+ *     "mcpServers": {
+ *       "sirr": {
+ *         "command": "sirr-mcp",
+ *         "env": { "SIRR_SERVER": "...", "SIRR_TOKEN": "..." }
+ *       }
+ *     }
+ *   }
+ */
+export {};

package/dist/index.js

@@ -0,0 +1,601 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * @sirrlock/mcp — MCP server for Sirr secret vault
+ *
+ * Exposes Sirr as MCP tools so Claude Code can read/write ephemeral secrets.
+ *
+ * Configuration (env vars):
+ *   SIRR_SERVER  — Sirr server URL (default: http://localhost:39999)
+ *   SIRR_TOKEN   — Bearer token (SIRR_MASTER_KEY on the server)
+ *
+ * Install:  npm install -g @sirrlock/mcp
+ * Configure in .mcp.json:
+ *   {
+ *     "mcpServers": {
+ *       "sirr": {
+ *         "command": "sirr-mcp",
+ *         "env": { "SIRR_SERVER": "...", "SIRR_TOKEN": "..." }
+ *       }
+ *     }
+ *   }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const package_json_1 = require("../package.json");
+// ── Config ────────────────────────────────────────────────────────────────────
+const SIRR_SERVER = (process.env["SIRR_SERVER"] ?? "http://localhost:39999").replace(/\/$/, "");
+const SIRR_TOKEN = process.env["SIRR_TOKEN"] ?? "";
+// ── Fetch with timeout ────────────────────────────────────────────────────────
+async function fetchWithTimeout(url, options = {}, ms = 10000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), ms);
+    try {
+        return await fetch(url, { ...options, signal: controller.signal });
+    }
+    catch (err) {
+        if (err instanceof Error) {
+            if (err.name === "AbortError") {
+                throw new Error(`Sirr server at ${SIRR_SERVER} did not respond within ${ms / 1000}s. Is it running?`);
+            }
+            // Node fetch throws "fetch failed" for ECONNREFUSED and other network errors
+            if (err.message === "fetch failed") {
+                throw new Error(`Cannot reach Sirr server at ${SIRR_SERVER}. Is it running?`);
+            }
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const STATUS_HINTS = {
+    401: "Check that SIRR_TOKEN matches SIRR_MASTER_KEY on the server. See sirr.dev/errors#401",
+    402: "Free tier limit reached. See sirr.dev/errors#402",
+    403: "This API key does not have permission for this operation. See sirr.dev/errors#403",
+    404: "Secret not found, expired, or burned. See sirr.dev/errors#404",
+    500: "Server-side error. See sirr.dev/errors#500",
+};
+function throwSirrError(status, json) {
+    const msg = json["error"] ?? "unknown";
+    const hint = STATUS_HINTS[status];
+    throw new Error(`Sirr ${status}: ${msg}${hint ? `\n  → ${hint}` : ""}`);
+}
+async function sirrRequest(method, path, body) {
+    const res = await fetchWithTimeout(`${SIRR_SERVER}${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${SIRR_TOKEN}`,
+            "Content-Type": "application/json",
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    const json = (await res.json());
+    if (!res.ok) {
+        throwSirrError(res.status, json);
+    }
+    return json;
+}
+const helpers_1 = require("./helpers");
+// ── Tool definitions ──────────────────────────────────────────────────────────
+const TOOLS = [
+    {
+        name: "get_secret",
+        description: "Retrieve a secret from the Sirr vault by key name. " +
+            "The secret's read counter is incremented — if it was set with max_reads=1 it will be deleted after this call. " +
+            "Returns null if the secret does not exist, has expired, or has been burned. " +
+            "Accepts bare key names, 'sirr:KEYNAME' references, or 'KEYNAME#id' format. " +
+            "IMPORTANT: Do not store, log, memorize, or repeat the returned secret value beyond its immediate use. " +
+            "Treat it as ephemeral — use it once for its intended purpose and discard it.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                key: {
+                    type: "string",
+                    description: "Secret key name. Accepts 'sirr:KEYNAME', 'KEYNAME#id', or bare key name.",
+                },
+            },
+            required: ["key"],
+        },
+    },
+    {
+        name: "push_secret",
+        description: "Store a secret in the Sirr vault. Optionally set a TTL (seconds) and/or a max read limit. " +
+            "Use max_reads=1 for one-time credentials that burn after first access. " +
+            "Use ttl_seconds for time-expiring secrets.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                key: {
+                    type: "string",
+                    description: "Key name to store the secret under.",
+                },
+                value: {
+                    type: "string",
+                    description: "Secret value.",
+                },
+                ttl_seconds: {
+                    type: "number",
+                    description: "Optional TTL in seconds. Examples: 3600 (1h), 86400 (1d), 604800 (7d).",
+                },
+                max_reads: {
+                    type: "number",
+                    description: "Optional maximum read count. Set to 1 for a one-time secret.",
+                },
+            },
+            required: ["key", "value"],
+        },
+    },
+    {
+        name: "list_secrets",
+        description: "List all active secrets in the Sirr vault. Returns metadata only — values are never included. " +
+            "Shows key name, expiry time, and read count for each secret.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "delete_secret",
+        description: "Immediately delete (burn) a secret from the Sirr vault, regardless of TTL or read count.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                key: {
+                    type: "string",
+                    description: "Key name to delete.",
+                },
+            },
+            required: ["key"],
+        },
+    },
+    {
+        name: "prune_secrets",
+        description: "Trigger an immediate sweep of all expired secrets on the server. " +
+            "Returns the count of secrets that were deleted.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "health_check",
+        description: "Check if the Sirr server is reachable and healthy.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "sirr_audit",
+        description: "Query the Sirr audit log. Returns recent events like secret creates, reads, deletes. " +
+            "Useful for security monitoring and debugging access patterns.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                since: {
+                    type: "number",
+                    description: "Only return events after this Unix timestamp.",
+                },
+                action: {
+                    type: "string",
+                    description: "Filter by action type (e.g. secret.create, secret.read, key.create).",
+                },
+                limit: {
+                    type: "number",
+                    description: "Maximum events to return (default: 50).",
+                },
+            },
+        },
+    },
+    {
+        name: "sirr_webhook_create",
+        description: "Register a webhook URL to receive Sirr event notifications. " +
+            "Returns the webhook ID and signing secret (shown once — save it).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                url: {
+                    type: "string",
+                    description: "Webhook endpoint URL (must start with http:// or https://).",
+                },
+                events: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Event types to subscribe to (default: all). Examples: secret.created, secret.burned.",
+                },
+            },
+            required: ["url"],
+        },
+    },
+    {
+        name: "sirr_webhook_list",
+        description: "List all registered webhooks on the Sirr server. Signing secrets are redacted.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "sirr_webhook_delete",
+        description: "Remove a webhook registration by its ID.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                id: {
+                    type: "string",
+                    description: "Webhook ID to delete.",
+                },
+            },
+            required: ["id"],
+        },
+    },
+    {
+        name: "sirr_key_create",
+        description: "Create a scoped API key with specific permissions. " +
+            "The raw key is returned once — save it immediately. " +
+            "Permissions: read, write, delete, admin. Optional prefix scoping limits access to secrets matching the prefix.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                label: {
+                    type: "string",
+                    description: "Human-readable label for the key.",
+                },
+                permissions: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Permissions to grant: read, write, delete, admin.",
+                },
+                prefix: {
+                    type: "string",
+                    description: "Optional prefix scope — key can only access secrets starting with this prefix.",
+                },
+            },
+            required: ["label", "permissions"],
+        },
+    },
+    {
+        name: "sirr_key_list",
+        description: "List all scoped API keys. Key hashes are never returned.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "sirr_key_delete",
+        description: "Delete a scoped API key by its ID.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                id: {
+                    type: "string",
+                    description: "API key ID to delete.",
+                },
+            },
+            required: ["id"],
+        },
+    },
+];
+// ── MCP Server ────────────────────────────────────────────────────────────────
+const server = new index_js_1.Server({ name: "sirr", version: package_json_1.version }, { capabilities: { tools: {} } });
+server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
+    tools: TOOLS,
+}));
+server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+        switch (name) {
+            case "get_secret": {
+                const rawKey = args.key;
+                const key = (0, helpers_1.parseKeyRef)(rawKey);
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/secrets/${encodeURIComponent(key)}`, { headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Secret '${key}' not found, expired, or already burned.`,
+                            },
+                        ],
+                    };
+                }
+                if (!res.ok) {
+                    const json = (await res.json());
+                    throwSirrError(res.status, json);
+                }
+                const data = (await res.json());
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: data.value,
+                        },
+                        {
+                            type: "text",
+                            text: "[Use immediately — do not store, log, or memorize this value.]",
+                        },
+                    ],
+                };
+            }
+            case "push_secret": {
+                const { key, value: val, ttl_seconds, max_reads } = args;
+                await sirrRequest("POST", "/secrets", {
+                    key,
+                    value: val,
+                    ttl_seconds: ttl_seconds ?? null,
+                    max_reads: max_reads ?? null,
+                });
+                const parts = [`Stored secret '${key}'.`];
+                if (ttl_seconds)
+                    parts.push(`Expires in ${(0, helpers_1.formatTtl)(Math.floor(Date.now() / 1000) + ttl_seconds)}.`);
+                if (max_reads)
+                    parts.push(`Burns after ${max_reads} read(s).`);
+                return {
+                    content: [{ type: "text", text: parts.join(" ") }],
+                };
+            }
+            case "list_secrets": {
+                const data = await sirrRequest("GET", "/secrets");
+                if (data.secrets.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No active secrets." }],
+                    };
+                }
+                const lines = data.secrets.map((m) => {
+                    const expiry = (0, helpers_1.formatTtl)(m.expires_at);
+                    const reads = m.max_reads != null
+                        ? `${m.read_count}/${m.max_reads} reads`
+                        : `${m.read_count} reads`;
+                    return `• ${m.key} — ${expiry} — ${reads}`;
+                });
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `${data.secrets.length} active secret(s):\n${lines.join("\n")}`,
+                        },
+                    ],
+                };
+            }
+            case "delete_secret": {
+                const { key } = args;
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/secrets/${encodeURIComponent(key)}`, {
+                    method: "DELETE",
+                    headers: { Authorization: `Bearer ${SIRR_TOKEN}` },
+                });
+                if (res.status === 404) {
+                    return {
+                        content: [
+                            { type: "text", text: `Secret '${key}' not found.` },
+                        ],
+                    };
+                }
+                if (!res.ok) {
+                    const json = (await res.json());
+                    throwSirrError(res.status, json);
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Secret '${key}' deleted.`,
+                        },
+                    ],
+                };
+            }
+            case "prune_secrets": {
+                const data = await sirrRequest("POST", "/prune");
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Pruned ${data.pruned} expired secret(s).`,
+                        },
+                    ],
+                };
+            }
+            case "health_check": {
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/health`);
+                if (!res.ok) {
+                    const json = (await res.json());
+                    throwSirrError(res.status, json);
+                }
+                const data = (await res.json());
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Sirr server status: ${data.status} (${SIRR_SERVER})`,
+                        },
+                    ],
+                };
+            }
+            case "sirr_audit": {
+                const { since, action, limit } = args;
+                const params = new URLSearchParams();
+                if (since != null)
+                    params.set("since", String(since));
+                if (action != null)
+                    params.set("action", action);
+                if (limit != null)
+                    params.set("limit", String(limit));
+                const qs = params.toString();
+                const data = await sirrRequest("GET", `/audit${qs ? `?${qs}` : ""}`);
+                if (data.events.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No audit events found." }],
+                    };
+                }
+                const lines = data.events.map((e) => `[${e.timestamp}] ${e.action} key=${e.key ?? "-"} ip=${e.source_ip} ${e.success ? "ok" : "FAIL"}`);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `${data.events.length} audit event(s):\n${lines.join("\n")}`,
+                        },
+                    ],
+                };
+            }
+            case "sirr_webhook_create": {
+                const { url, events } = args;
+                const body = { url };
+                if (events)
+                    body.events = events;
+                const data = await sirrRequest("POST", "/webhooks", body);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Webhook registered.\n  ID: ${data.id}\n  Secret: ${data.secret}\n  (Save the secret — it won't be shown again)`,
+                        },
+                    ],
+                };
+            }
+            case "sirr_webhook_list": {
+                const data = await sirrRequest("GET", "/webhooks");
+                if (data.webhooks.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No webhooks registered." }],
+                    };
+                }
+                const lines = data.webhooks.map((w) => `• ${w.id} — ${w.url} [${w.events.join(",")}]`);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `${data.webhooks.length} webhook(s):\n${lines.join("\n")}`,
+                        },
+                    ],
+                };
+            }
+            case "sirr_webhook_delete": {
+                const { id } = args;
+                await sirrRequest("DELETE", `/webhooks/${encodeURIComponent(id)}`);
+                return {
+                    content: [
+                        { type: "text", text: `Webhook '${id}' deleted.` },
+                    ],
+                };
+            }
+            case "sirr_key_create": {
+                const { label, permissions, prefix } = args;
+                const body = { label, permissions };
+                if (prefix)
+                    body.prefix = prefix;
+                const data = await sirrRequest("POST", "/keys", body);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `API key created.\n  ID: ${data.id}\n  Key: ${data.key}\n  Permissions: ${data.permissions.join(", ")}\n  Prefix: ${data.prefix ?? "(none)"}\n  (Save the key — it won't be shown again)`,
+                        },
+                    ],
+                };
+            }
+            case "sirr_key_list": {
+                const data = await sirrRequest("GET", "/keys");
+                if (data.keys.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No API keys." }],
+                    };
+                }
+                const lines = data.keys.map((k) => `• ${k.id} — ${k.label} [${k.permissions.join(",")}] prefix=${k.prefix ?? "*"}`);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `${data.keys.length} API key(s):\n${lines.join("\n")}`,
+                        },
+                    ],
+                };
+            }
+            case "sirr_key_delete": {
+                const { id } = args;
+                await sirrRequest("DELETE", `/keys/${encodeURIComponent(id)}`);
+                return {
+                    content: [
+                        { type: "text", text: `API key '${id}' deleted.` },
+                    ],
+                };
+            }
+            default:
+                return {
+                    content: [{ type: "text", text: `Unknown tool: ${name}` }],
+                    isError: true,
+                };
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+// ── Startup warnings ──────────────────────────────────────────────────────────
+function runStartupWarnings() {
+    if (!SIRR_TOKEN) {
+        process.stderr.write(`[sirr-mcp] Warning: SIRR_TOKEN is not set. See sirr.dev/errors#401\n`);
+    }
+    try {
+        const url = new URL(SIRR_SERVER);
+        const isLocal = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+        if (url.protocol === "http:" && !isLocal) {
+            process.stderr.write(`[sirr-mcp] Warning: SIRR_SERVER is using plain HTTP on a non-local host. Secrets will be transmitted unencrypted.\n`);
+        }
+    }
+    catch {
+        // invalid URL — sirrRequest will fail with a clearer message
+    }
+}
+// ── Health check (--health flag) ──────────────────────────────────────────────
+async function runHealthCheck() {
+    process.stdout.write(`Checking Sirr server at ${SIRR_SERVER}...\n`);
+    if (!SIRR_TOKEN) {
+        process.stdout.write(`Warning: SIRR_TOKEN is not set — authenticated endpoints will fail.\n`);
+    }
+    try {
+        const res = await fetchWithTimeout(`${SIRR_SERVER}/health`);
+        const data = (await res.json());
+        process.stdout.write(`Status: ${data.status}\nsirr-mcp is configured correctly.\n`);
+        return true;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stdout.write(`Error: ${msg}\n`);
+        return false;
+    }
+}
+// ── Main ──────────────────────────────────────────────────────────────────────
+async function main() {
+    const transport = new stdio_js_1.StdioServerTransport();
+    await server.connect(transport);
+    // MCP servers communicate via stdio — no console output here
+}
+// ── Entry point ───────────────────────────────────────────────────────────────
+const cliArgs = process.argv.slice(2);
+if (cliArgs.includes("--version")) {
+    process.stdout.write(`sirr-mcp ${package_json_1.version}\n`);
+    process.exit(0);
+}
+else if (cliArgs.includes("--health")) {
+    runHealthCheck()
+        .then((ok) => process.exit(ok ? 0 : 1))
+        .catch((e) => {
+        process.stderr.write(`sirr-mcp fatal: ${e}\n`);
+        process.exit(1);
+    });
+}
+else {
+    runStartupWarnings();
+    main().catch((e) => {
+        process.stderr.write(`sirr-mcp fatal: ${e}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;;;;GAmBG;;AAEH,wEAAmE;AACnE,wEAAiF;AACjF,iEAI4C;AAC5C,kDAA0C;AAE1C,iFAAiF;AAEjF,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,wBAAwB,CACvD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;AAEnD,iFAAiF;AAEjF,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,UAAuB,EAAE,EACzB,EAAE,GAAG,KAAM;IAEX,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,kBAAkB,WAAW,2BAA2B,EAAE,GAAG,IAAI,mBAAmB,CACrF,CAAC;YACJ,CAAC;YACD,6EAA6E;YAC7E,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,kBAAkB,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAYD,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,sFAAsF;IAC3F,GAAG,EAAE,kDAAkD;IACvD,GAAG,EAAE,mFAAmF;IACxF,GAAG,EAAE,+DAA+D;IACpE,GAAG,EAAE,4CAA4C;CAClD,CAAC;AAEF,SAAS,cAAc,CAAC,MAAc,EAAE,IAA6B;IACnE,MAAM,GAAG,GAAI,IAAI,CAAC,OAAO,CAAY,IAAI,SAAS,CAAC;IACnD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,IAAY,EACZ,IAAc;IAEd,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE;QAC1D,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,UAAU,EAAE;YACrC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,IAAS,CAAC;AACnB,CAAC;AAED,uCAAmD;AAEnD,iFAAiF;AAEjF,MAAM,KAAK,GAAW;IACpB;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,qDAAqD;YACrD,gHAAgH;YAChH,8EAA8E;YAC9E,6EAA6E;YAC7E,wGAAwG;YACxG,8EAA8E;QAChF,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,0EAA0E;iBAC7E;aACF;YACD,QAAQ,EAAE,CAAC,KAAK,CAAC;SAClB;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,4FAA4F;YAC5F,yEAAyE;YACzE,4CAA4C;QAC9C,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qCAAqC;iBACnD;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,eAAe;iBAC7B;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,wEAAwE;iBAC3E;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,8DAA8D;iBACjE;aACF;YACD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;SAC3B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,gGAAgG;YAChG,8DAA8D;QAChE,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,0FAA0F;QAC5F,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qBAAqB;iBACnC;aACF;YACD,QAAQ,EAAE,CAAC,KAAK,CAAC;SAClB;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,mEAAmE;YACnE,iDAAiD;QACnD,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,uFAAuF;YACvF,+DAA+D;QACjE,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC7D;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sEAAsE;iBACpF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yCAAyC;iBACvD;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,8DAA8D;YAC9D,mEAAmE;QACrE,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6DAA6D;iBAC3E;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,sFAAsF;iBACpG;aACF;YACD,QAAQ,EAAE,CAAC,KAAK,CAAC;SAClB;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gFAAgF;QAC7F,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,EAAE,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uBAAuB;iBACrC;aACF;YACD,QAAQ,EAAE,CAAC,IAAI,CAAC;SACjB;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,qDAAqD;YACrD,sDAAsD;YACtD,gHAAgH;QAClH,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,mCAAmC;iBACjD;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,mDAAmD;iBACjE;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gFAAgF;iBAC9F;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SACnC;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,0DAA0D;QACvE,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,oCAAoC;QACjD,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,EAAE,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uBAAuB;iBACrC;aACF;YACD,QAAQ,EAAE,CAAC,IAAI,CAAC;SACjB;KACF;CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAP,sBAAO,EAAE,EACzB,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,EAAE,KAAK;CACb,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAEjD,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAI,IAAwB,CAAC,GAAG,CAAC;gBAC7C,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,MAAM,CAAC,CAAC;gBAEhC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,WAAW,YAAY,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACnD,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,EAAE,CACvD,CAAC;gBAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,WAAW,GAAG,0CAA0C;6BAC/D;yBACF;qBACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;oBAC3D,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACnC,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;gBAErD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,IAAI,CAAC,KAAK;yBACjB;wBACD;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,gEAAgE;yBACvE;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,IAKnD,CAAC;gBAEF,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE;oBACpC,GAAG;oBACH,KAAK,EAAE,GAAG;oBACV,WAAW,EAAE,WAAW,IAAI,IAAI;oBAChC,SAAS,EAAE,SAAS,IAAI,IAAI;iBAC7B,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAa,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;gBACpD,IAAI,WAAW;oBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,IAAA,mBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrG,IAAI,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,SAAS,WAAW,CAAC,CAAC;gBAE/D,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBAC5D,CAAC;YACJ,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,KAAK,EACL,UAAU,CACX,CAAC;gBAEF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;qBACjE,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACnC,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBACvC,MAAM,KAAK,GACT,CAAC,CAAC,SAAS,IAAI,IAAI;wBACjB,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,QAAQ;wBACxC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,QAAQ,CAAC;oBAC9B,OAAO,KAAK,CAAC,CAAC,GAAG,MAAM,MAAM,MAAM,KAAK,EAAE,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBACtE;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAuB,CAAC;gBAExC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,WAAW,YAAY,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACnD;oBACE,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;iBACnD,CACF,CAAC;gBAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,OAAO;wBACL,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,GAAG,cAAc,EAAE;yBAC9D;qBACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;oBAC3D,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACnC,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,WAAW,GAAG,YAAY;yBACjC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAqB,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,qBAAqB;yBACjD;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;gBAE5D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;oBAC3D,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACnC,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;gBACtD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,uBAAuB,IAAI,CAAC,MAAM,KAAK,WAAW,GAAG;yBAC5D;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAIhC,CAAC;gBACF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBACrC,IAAI,KAAK,IAAI,IAAI;oBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,IAAI,MAAM,IAAI,IAAI;oBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACjD,IAAI,KAAK,IAAI,IAAI;oBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,KAAK,EACL,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC;gBAEF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;qBACrE,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAC3B,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CACpG,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBACnE;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAA0C,CAAC;gBACnE,MAAM,IAAI,GAA4B,EAAE,GAAG,EAAE,CAAC;gBAC9C,IAAI,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,MAAM,EACN,WAAW,EACX,IAAI,CACL,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,8BAA8B,IAAI,CAAC,EAAE,eAAe,IAAI,CAAC,MAAM,iDAAiD;yBACvH;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,WAAW,CAE3B,KAAK,EAAE,WAAW,CAAC,CAAC;gBAEvB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;qBACtE,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACtD,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBACjE;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,MAAM,EAAE,EAAE,EAAE,GAAG,IAAsB,CAAC;gBACtC,MAAM,WAAW,CAAC,QAAQ,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnE,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAItC,CAAC;gBACF,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;gBAC7D,IAAI,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAM3B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBAE1B,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,2BAA2B,IAAI,CAAC,EAAE,YAAY,IAAI,CAAC,GAAG,oBAAoB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,IAAI,QAAQ,8CAA8C;yBAChM;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,WAAW,CAQ3B,KAAK,EAAE,OAAO,CAAC,CAAC;gBAEnB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;qBAC3D,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAClF,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC7D;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,EAAE,EAAE,EAAE,GAAG,IAAsB,CAAC;gBACtC,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/D,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED;gBACE,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;oBACnE,OAAO,EAAE,IAAI;iBACd,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,SAAS,kBAAkB;IACzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,OAAO,GACX,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;QAC/D,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qHAAqH,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,cAAc;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,WAAW,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,IAAI,CAAC,MAAM,uCAAuC,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,6DAA6D;AAC/D,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEtC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,sBAAO,IAAI,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;KAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;IACxC,cAAc,EAAE;SACb,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACtC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;KAAM,CAAC;IACN,kBAAkB,EAAE,CAAC;IACrB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/integration.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Integration tests — sirrd + sirr-mcp (stdio)
+ *
+ * Three modes (pick one via env vars):
+ *
+ *   SIRR_SERVER=http://localhost:39999 SIRR_TOKEN=mykey npm run test:integration
+ *     → Connect to an already-running sirrd. No server is started.
+ *
+ *   SIRRD_BINARY=/path/to/sirrd npm run test:integration
+ *     → Spawn a local binary. No Docker required.
+ *
+ *   SIRRD_IMAGE=sirrd:test npm run test:integration  (default)
+ *     → Build and run via Docker.
+ *
+ * Run:  npm run test:integration
+ */
+export {};

package/dist/integration.test.js

@@ -0,0 +1,253 @@
+"use strict";
+/**
+ * Integration tests — sirrd + sirr-mcp (stdio)
+ *
+ * Three modes (pick one via env vars):
+ *
+ *   SIRR_SERVER=http://localhost:39999 SIRR_TOKEN=mykey npm run test:integration
+ *     → Connect to an already-running sirrd. No server is started.
+ *
+ *   SIRRD_BINARY=/path/to/sirrd npm run test:integration
+ *     → Spawn a local binary. No Docker required.
+ *
+ *   SIRRD_IMAGE=sirrd:test npm run test:integration  (default)
+ *     → Build and run via Docker.
+ *
+ * Run:  npm run test:integration
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const child_process_1 = require("child_process");
+const readline_1 = require("readline");
+// ── Config ────────────────────────────────────────────────────────────────────
+// Spawn a local binary instead of Docker.
+const SIRRD_BINARY = process.env["SIRRD_BINARY"];
+const SIRRD_IMAGE = process.env["SIRRD_IMAGE"] ?? "sirrd:test";
+const SIRR_PORT = 19080;
+// When SIRR_SERVER is set, connect to that existing server — no server is spawned.
+// SIRR_TOKEN must match SIRR_MASTER_KEY on that server.
+const SIRR_TOKEN = process.env["SIRR_TOKEN"] ?? "integration-test-key";
+const SIRR_SERVER = process.env["SIRR_SERVER"] ?? `http://localhost:${SIRR_PORT}`;
+const USE_EXISTING = !!process.env["SIRR_SERVER"];
+const MCP_BIN = `${__dirname}/../dist/index.js`;
+class McpClient {
+    constructor(proc) {
+        this.proc = proc;
+        this.pending = new Map();
+        this.nextId = 1;
+        this.rl = (0, readline_1.createInterface)({ input: proc.stdout });
+        this.rl.on("line", (line) => {
+            if (!line.trim())
+                return;
+            const msg = JSON.parse(line);
+            if (msg.id != null) {
+                const resolve = this.pending.get(msg.id);
+                if (resolve) {
+                    this.pending.delete(msg.id);
+                    resolve(msg);
+                }
+            }
+        });
+    }
+    close() {
+        this.rl.close();
+        this.proc.kill();
+    }
+    rpc(method, params) {
+        const id = this.nextId++;
+        return new Promise((resolve) => {
+            this.pending.set(id, resolve);
+            this.proc.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
+        });
+    }
+    async initialize() {
+        await this.rpc("initialize", {
+            protocolVersion: "2024-11-05",
+            capabilities: {},
+            clientInfo: { name: "integration-test", version: "1" },
+        });
+    }
+    async call(tool, args = {}) {
+        const resp = await this.rpc("tools/call", { name: tool, arguments: args });
+        if (resp.error)
+            throw new Error(`MCP error: ${resp.error.message}`);
+        return resp.result?.content?.[0]?.text ?? "";
+    }
+}
+// ── Helpers ───────────────────────────────────────────────────────────────────
+async function waitForHealth(url, maxMs = 15000) {
+    const deadline = Date.now() + maxMs;
+    while (Date.now() < deadline) {
+        try {
+            const res = await fetch(`${url}/health`);
+            if (res.ok)
+                return;
+        }
+        catch { /* not up yet */ }
+        await new Promise((r) => setTimeout(r, 250));
+    }
+    throw new Error(`sirrd at ${url} did not become healthy within ${maxMs}ms`);
+}
+function dockerRun() {
+    const result = (0, child_process_1.spawnSync)("docker", [
+        "run", "-d", "--rm",
+        "-p", `${SIRR_PORT}:39999`,
+        "-e", `SIRR_MASTER_KEY=${SIRR_TOKEN}`,
+        "-e", "SIRR_DATA_DIR=/tmp",
+        "-e", "NO_BANNER=1",
+        SIRRD_IMAGE,
+        "serve",
+    ]);
+    if (result.status !== 0) {
+        throw new Error(`docker run failed: ${result.stderr.toString()}`);
+    }
+    return result.stdout.toString().trim();
+}
+function dockerStop(id) {
+    (0, child_process_1.spawnSync)("docker", ["stop", id]);
+}
+// ── Fixtures ──────────────────────────────────────────────────────────────────
+let containerId;
+let sirrdProc;
+let client;
+(0, globals_1.beforeAll)(async () => {
+    if (USE_EXISTING) {
+        // Mode 1: connect to an already-running server — nothing to spawn.
+        process.stderr.write(`[integration] connecting to existing server at ${SIRR_SERVER}\n`);
+    }
+    else if (SIRRD_BINARY) {
+        // Mode 2: spawn local binary — no Docker required.
+        // Unique data dir per run avoids redb lock conflicts.
+        const dataDir = `/tmp/sirrd-test-${Date.now()}`;
+        sirrdProc = (0, child_process_1.spawn)(SIRRD_BINARY, ["serve"], {
+            env: {
+                ...process.env,
+                SIRR_MASTER_KEY: SIRR_TOKEN,
+                SIRR_DATA_DIR: dataDir,
+                SIRR_PORT: String(SIRR_PORT),
+                SIRR_HOST: "127.0.0.1",
+                NO_BANNER: "1",
+            },
+            stdio: ["ignore", "ignore", "pipe"],
+        });
+        sirrdProc.stderr.on("data", (d) => process.stderr.write(`[sirrd] ${d.toString()}`));
+    }
+    else {
+        // Mode 3: Docker.
+        containerId = dockerRun();
+    }
+    await waitForHealth(SIRR_SERVER);
+    const mcpProc = (0, child_process_1.spawn)("node", [MCP_BIN], {
+        env: { ...process.env, SIRR_SERVER, SIRR_TOKEN },
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    mcpProc.stderr.on("data", (d) => {
+        const msg = d.toString();
+        // Suppress expected startup warnings in test output
+        if (!msg.includes("[sirr-mcp] Warning"))
+            process.stderr.write(msg);
+    });
+    client = new McpClient(mcpProc);
+    await client.initialize();
+}, 30000);
+(0, globals_1.afterAll)(() => {
+    client?.close();
+    // Only tear down servers we started — leave SIRR_SERVER (USE_EXISTING) server running.
+    sirrdProc?.kill();
+    if (containerId)
+        dockerStop(containerId);
+});
+// ── Tests ─────────────────────────────────────────────────────────────────────
+(0, globals_1.describe)("health_check", () => {
+    (0, globals_1.it)("reports server ok", async () => {
+        const text = await client.call("health_check");
+        (0, globals_1.expect)(text).toContain("ok");
+        (0, globals_1.expect)(text).toContain(SIRR_SERVER);
+    });
+});
+(0, globals_1.describe)("push_secret / get_secret", () => {
+    (0, globals_1.it)("stores and retrieves a bare key", async () => {
+        await client.call("push_secret", { key: "INT_BARE", value: "bare-value" });
+        const text = await client.call("get_secret", { key: "INT_BARE" });
+        (0, globals_1.expect)(text).toBe("bare-value");
+    });
+    (0, globals_1.it)("retrieves via sirr: prefix", async () => {
+        await client.call("push_secret", { key: "INT_PREFIX", value: "prefix-value" });
+        const text = await client.call("get_secret", { key: "sirr:INT_PREFIX" });
+        (0, globals_1.expect)(text).toBe("prefix-value");
+    });
+    (0, globals_1.it)("stores with ttl_seconds and reports expiry", async () => {
+        const text = await client.call("push_secret", {
+            key: "INT_TTL",
+            value: "ttl-value",
+            ttl_seconds: 3600,
+        });
+        (0, globals_1.expect)(text).toContain("INT_TTL");
+        (0, globals_1.expect)(text).toContain("1h");
+    });
+    (0, globals_1.it)("stores with max_reads and reports burn limit", async () => {
+        const text = await client.call("push_secret", {
+            key: "INT_READS",
+            value: "reads-value",
+            max_reads: 1,
+        });
+        (0, globals_1.expect)(text).toContain("1 read(s)");
+    });
+    (0, globals_1.it)("returns not-found message for missing key", async () => {
+        const text = await client.call("get_secret", { key: "DOES_NOT_EXIST" });
+        (0, globals_1.expect)(text).toContain("not found");
+    });
+    (0, globals_1.it)("burns a max_reads=1 secret after first read", async () => {
+        await client.call("push_secret", { key: "INT_BURN", value: "burn-me", max_reads: 1 });
+        await client.call("get_secret", { key: "INT_BURN" }); // consumes it
+        const text = await client.call("get_secret", { key: "INT_BURN" });
+        (0, globals_1.expect)(text).toContain("not found");
+    });
+});
+(0, globals_1.describe)("list_secrets", () => {
+    (0, globals_1.it)("lists active secrets", async () => {
+        await client.call("push_secret", { key: "INT_LIST", value: "listed" });
+        const text = await client.call("list_secrets");
+        (0, globals_1.expect)(text).toContain("INT_LIST");
+    });
+    (0, globals_1.it)("never includes secret values", async () => {
+        await client.call("push_secret", { key: "INT_NOVALUE", value: "should-not-appear" });
+        const text = await client.call("list_secrets");
+        (0, globals_1.expect)(text).not.toContain("should-not-appear");
+    });
+});
+(0, globals_1.describe)("delete_secret", () => {
+    (0, globals_1.it)("deletes an existing secret", async () => {
+        await client.call("push_secret", { key: "INT_DEL", value: "to-delete" });
+        const del = await client.call("delete_secret", { key: "INT_DEL" });
+        (0, globals_1.expect)(del).toContain("deleted");
+        const get = await client.call("get_secret", { key: "INT_DEL" });
+        (0, globals_1.expect)(get).toContain("not found");
+    });
+    (0, globals_1.it)("returns not-found for unknown key", async () => {
+        const text = await client.call("delete_secret", { key: "NEVER_EXISTED" });
+        (0, globals_1.expect)(text).toContain("not found");
+    });
+});
+(0, globals_1.describe)("prune_secrets", () => {
+    (0, globals_1.it)("returns a pruned count", async () => {
+        const text = await client.call("prune_secrets");
+        (0, globals_1.expect)(text).toMatch(/Pruned \d+ expired secret/);
+    });
+});
+(0, globals_1.describe)("error handling", () => {
+    (0, globals_1.it)("surfaces timeout message when server is unreachable", async () => {
+        // Spawn a separate MCP process pointing at a port nothing is listening on
+        const badProc = (0, child_process_1.spawn)("node", [MCP_BIN], {
+            env: { ...process.env, SIRR_SERVER: "http://127.0.0.1:19099", SIRR_TOKEN },
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const badClient = new McpClient(badProc);
+        await badClient.initialize();
+        const text = await badClient.call("health_check");
+        badClient.close();
+        // Either a timeout ("did not respond within") or connection refused ("Cannot reach")
+        (0, globals_1.expect)(text).toMatch(/did not respond within|Cannot reach/i);
+    });
+});
+//# sourceMappingURL=integration.test.js.map

package/dist/integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.js","sourceRoot":"","sources":["../src/integration.test.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAEH,2CAMuB;AACvB,iDAA+D;AAC/D,uCAAsD;AAEtD,iFAAiF;AAEjF,0CAA0C;AAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACjD,MAAM,WAAW,GAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC;AAChE,MAAM,SAAS,GAAM,KAAK,CAAC;AAC3B,mFAAmF;AACnF,wDAAwD;AACxD,MAAM,UAAU,GAAK,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,sBAAsB,CAAC;AACzE,MAAM,WAAW,GAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,oBAAoB,SAAS,EAAE,CAAC;AACnF,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAClD,MAAM,OAAO,GAAQ,GAAG,SAAS,mBAAmB,CAAC;AAWrD,MAAM,SAAS;IAKb,YAAoB,IAAkB;QAAlB,SAAI,GAAJ,IAAI,CAAc;QAJ9B,YAAO,GAAG,IAAI,GAAG,EAAwC,CAAC;QAC1D,WAAM,GAAG,CAAC,CAAC;QAIjB,IAAI,CAAC,EAAE,GAAG,IAAA,0BAAe,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAO,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;YAChD,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzC,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,MAAe;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAM,CAAC,KAAK,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE;YAC3B,eAAe,EAAE,YAAY;YAC7B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAgC,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC/C,CAAC;CACF;AAED,iFAAiF;AAEjF,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAK,GAAG,KAAM;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO;QACrB,CAAC;QAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC5B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,kCAAkC,KAAK,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,QAAQ,EAAE;QACjC,KAAK,EAAE,IAAI,EAAE,MAAM;QACnB,IAAI,EAAE,GAAG,SAAS,QAAQ;QAC1B,IAAI,EAAE,mBAAmB,UAAU,EAAE;QACrC,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,aAAa;QACnB,WAAW;QACX,OAAO;KACR,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAA,yBAAS,EAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,iFAAiF;AAEjF,IAAI,WAA+B,CAAC;AACpC,IAAI,SAAmC,CAAC;AACxC,IAAI,MAAiB,CAAC;AAEtB,IAAA,mBAAS,EAAC,KAAK,IAAI,EAAE;IACnB,IAAI,YAAY,EAAE,CAAC;QACjB,mEAAmE;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,WAAW,IAAI,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,mDAAmD;QACnD,sDAAsD;QACtD,MAAM,OAAO,GAAG,mBAAmB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChD,SAAS,GAAG,IAAA,qBAAK,EAAC,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE;YACzC,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,eAAe,EAAE,UAAU;gBAC3B,aAAa,EAAE,OAAO;gBACtB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;gBAC5B,SAAS,EAAE,WAAW;gBACtB,SAAS,EAAE,GAAG;aACf;YACD,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,SAAS,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAChD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,kBAAkB;QAClB,WAAW,GAAG,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,IAAA,qBAAK,EAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;QACvC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE;QAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,oDAAoD;QACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC,EAAE,KAAM,CAAC,CAAC;AAEX,IAAA,kBAAQ,EAAC,GAAG,EAAE;IACZ,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,uFAAuF;IACvF,SAAS,EAAE,IAAI,EAAE,CAAC;IAClB,IAAI,WAAW;QAAE,UAAU,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,IAAA,kBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAA,YAAE,EAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAQ,EAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAA,YAAE,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAClE,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;YAC5C,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;YAC5C,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QACH,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,cAAc;QACpE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAClE,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAA,YAAE,EAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAA,YAAE,EAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,IAAA,gBAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,IAAA,gBAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAA,YAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAA,YAAE,EAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChD,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAQ,EAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAA,YAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAA,qBAAK,EAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;YACvC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,UAAU,EAAE;YAC1E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,qFAAqF;QACrF,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@sirrlock/mcp",
+  "version": "0.1.0",
+  "description": "Sirr MCP server — lets Claude Code read and write ephemeral secrets",
+  "license": "BSL-1.1",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sirrlock/mcp"
+  },
+  "main": "dist/index.js",
+  "bin": {
+    "sirr-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "test": "jest --testPathIgnorePatterns=integration",
+    "test:integration": "jest --testPathPatterns=integration --forceExit",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "^30.0.0",
+    "@types/node": "^20.0.0",
+    "jest": "^30.0.0",
+    "ts-jest": "^29.0.0",
+    "typescript": "^5.4.0"
+  },
+  "jest": {
+    "preset": "ts-jest",
+    "testEnvironment": "node"
+  },
+  "overrides": {
+    "minimatch": "^10.2.1",
+    "glob": "^11.0.0"
+  }
+}