@synoikia/core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nir
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/app.d.ts

@@ -0,0 +1,79 @@
+import { ApprovalLinkService } from './approvals/links.js';
+import { ApprovalService } from './approvals/service.js';
+import { McpTokenService } from './auth/mcp-tokens.js';
+import { OAuthService } from './auth/oauth.js';
+import { OidcService } from './auth/oidc.js';
+import { SessionService } from './auth/sessions.js';
+import { LoginThrottle } from './auth/throttle.js';
+import { UserService } from './auth/users.js';
+import type { Config } from './config/env.js';
+import { SecretBox } from './crypto/index.js';
+import type { Db } from './db/index.js';
+import { CoreEvents } from './events.js';
+import { SlidingWindowLimiter } from './gate/rate-limit.js';
+import type { GateDeps } from './gate/pipeline.js';
+import { InstanceManager } from './instances/manager.js';
+import type { ManagerOptions } from './instances/manager.js';
+import { NotifierService } from './notify/service.js';
+import type { FetchLike } from './notify/service.js';
+import { syncPluginRegistry } from './plugins/discovery.js';
+import { PluginRepoService } from './plugins/repos.js';
+import type { FetchBytes } from './plugins/repos.js';
+/**
+ * Wires every core service together once (design §2). Both listeners, the scheduler and tests use
+ * the same context, so there is exactly one database handle, one approval service, one event bus.
+ */
+export interface AppContext {
+    config: Config;
+    db: Db;
+    secrets: SecretBox;
+    events: CoreEvents;
+    users: UserService;
+    sessions: SessionService;
+    throttle: LoginThrottle;
+    oidc: OidcService;
+    tokens: McpTokenService;
+    oauth: OAuthService;
+    instances: InstanceManager;
+    approvals: ApprovalService;
+    limiter: SlidingWindowLimiter;
+    links: ApprovalLinkService;
+    notifier: NotifierService;
+    repos: PluginRepoService;
+    keys: {
+        attestation: Buffer;
+        state: Buffer;
+    };
+    warnings: string[];
+    now: () => Date;
+    gateDeps(): GateDeps;
+    /** Re-scan plugin directories and update the registry (startup, after installs). */
+    discoverPlugins(): ReturnType<typeof syncPluginRegistry>;
+    start(): Promise<void>;
+    /** Registers cleanup to run when draining (e.g. closing open MCP sessions). */
+    onStop(fn: () => unknown): void;
+    /** Aborted when shutdown begins; long-lived responses (SSE) end on it. */
+    shutdownSignal: AbortSignal;
+    /**
+     * First step of shutdown, while the listeners still run: stops timers, cancels open approvals,
+     * runs the stop hooks and ends long-lived streams, so closing the listeners doesn't wait on them.
+     */
+    drain(): Promise<void>;
+    /** Drains (if not yet), stops plugin children and closes the database. */
+    stop(): Promise<void>;
+}
+export interface AppOptions {
+    now?: () => Date;
+    supervisor?: ManagerOptions['supervisor'];
+    /** Allow http:// OIDC issuers (tests, lab IdPs). */
+    oidcAllowInsecure?: boolean;
+    /** Use an in-memory database (tests). */
+    memoryDb?: boolean;
+    /** Outbound HTTP for notifications (tests). */
+    notifyFetch?: FetchLike;
+    notifyRetryDelaysMs?: number[];
+    /** Outbound HTTP for plugin repositories (tests). */
+    repoFetch?: FetchBytes;
+    repoAllowHttp?: boolean;
+}
+export declare function createAppContext(config: Config, opts?: AppOptions): Promise<AppContext>;

package/dist/app.js

@@ -0,0 +1,155 @@
+import path from 'node:path';
+import { ApprovalLinkService } from './approvals/links.js';
+import { ApprovalService } from './approvals/service.js';
+import { McpTokenService } from './auth/mcp-tokens.js';
+import { OAuthService } from './auth/oauth.js';
+import { OidcService } from './auth/oidc.js';
+import { SessionService } from './auth/sessions.js';
+import { LoginThrottle } from './auth/throttle.js';
+import { UserService } from './auth/users.js';
+import { loadMasterKey, SecretBox } from './crypto/index.js';
+import { openDatabase } from './db/index.js';
+import { CoreEvents } from './events.js';
+import { SlidingWindowLimiter } from './gate/rate-limit.js';
+import { InstanceManager } from './instances/manager.js';
+import { runHousekeeping } from './maintenance.js';
+import { NotifierService } from './notify/service.js';
+import { discoverPlugins, syncPluginRegistry } from './plugins/discovery.js';
+import { PluginRepoService } from './plugins/repos.js';
+import { sandboxesRunning } from './runtime/index.js';
+import { normalizeStoredSettings } from './settings.js';
+export async function createAppContext(config, opts = {}) {
+    const now = opts.now ?? (() => new Date());
+    const warnings = [];
+    const master = loadMasterKey({ envKey: config.MASTER_KEY, dataDir: config.DATA_DIR });
+    if (master.warning)
+        warnings.push(master.warning);
+    const secrets = SecretBox.fromKey(master.key);
+    const db = opts.memoryDb ? openDatabase(':memory:') : openDatabase({ dataDir: config.DATA_DIR });
+    const orphans = ApprovalService.denyOrphans(db);
+    if (orphans > 0)
+        warnings.push(`Denied ${orphans} approval(s) left pending by the previous run`);
+    const events = new CoreEvents();
+    const users = new UserService(db, secrets);
+    const boot = await users.bootstrap(config.ADMIN_BOOTSTRAP_USERNAME, config.ADMIN_BOOTSTRAP_PASSWORD);
+    if (boot === 'created')
+        warnings.push(`Created admin user "${config.ADMIN_BOOTSTRAP_USERNAME}" from ADMIN_BOOTSTRAP_*`);
+    if (boot === 'ignored')
+        warnings.push('ADMIN_BOOTSTRAP_* is set but users already exist; it is ignored — remove it');
+    const instances = new InstanceManager({ db, secrets, events, now, supervisor: opts.supervisor });
+    // Stored JSON from an earlier release is brought to the current schemas once, before anything reads it.
+    normalizeStoredSettings(db);
+    instances.normalizeStoredSettings();
+    if (!config.PUBLIC_MCP_URL)
+        warnings.push('PUBLIC_MCP_URL is not set: OAuth is off (bearer tokens still work). Set it to the public address of the MCP port.');
+    const links = new ApprovalLinkService(db, now);
+    const approvals = new ApprovalService(db, links, now);
+    // An approval must not outlive the plugin process and configuration it was asked for.
+    events.on('instance.status', ({ instanceId, status }) => {
+        if (status === 'stopped')
+            approvals.cancelForInstance(instanceId, 'endpoint_stopped');
+    });
+    const keys = {
+        attestation: secrets.deriveKey('attestation'),
+        state: secrets.deriveKey('signed-state'),
+    };
+    const limiter = new SlidingWindowLimiter();
+    const notifier = new NotifierService(db, secrets, {
+        fetch: opts.notifyFetch,
+        retryDelaysMs: opts.notifyRetryDelaysMs,
+        now,
+    });
+    const unsubscribeNotifier = notifier.subscribe(events);
+    const discover = () => syncPluginRegistry(db, discoverPlugins([
+        { dir: config.CORE_PLUGINS_DIR, source: 'core' },
+        { dir: path.join(config.DATA_DIR, 'plugins'), source: 'repo' },
+    ]), { autoEnableCore: config.CORE_PLUGINS_AUTOENABLE });
+    const registered = discover();
+    const repos = new PluginRepoService({
+        db,
+        dataDir: config.DATA_DIR,
+        fetch: opts.repoFetch,
+        allowHttp: opts.repoAllowHttp,
+        now,
+        discover,
+        stopPlugin: (id) => instances.stopPlugin(id),
+        startPlugin: (id) => instances.startPlugin(id),
+    });
+    for (const id of registered.rejected)
+        warnings.push(`Plugin ${id} was ignored: its id is already taken`);
+    const timers = [];
+    const stopHooks = [];
+    const draining = new AbortController();
+    const drain = async () => {
+        if (draining.signal.aborted)
+            return;
+        draining.abort();
+        for (const t of timers)
+            clearInterval(t);
+        // Cancelled approvals end their tool calls first, so closing sessions doesn't cut them off mid-reply.
+        approvals.cancelAll('shutdown');
+        // Give the scripts those calls belonged to a moment to return their result to the client.
+        if (sandboxesRunning() > 0) {
+            for (const until = Date.now() + 2000; sandboxesRunning() > 0 && Date.now() < until;)
+                await new Promise((r) => setTimeout(r, 20));
+            await new Promise((r) => setTimeout(r, 50)); // the reply is written after the script returns
+        }
+        for (const fn of stopHooks.splice(0).reverse())
+            await fn();
+    };
+    const ctx = {
+        config,
+        db,
+        secrets,
+        events,
+        users,
+        sessions: new SessionService(db, secrets.deriveKey('session-pepper'), now),
+        throttle: new LoginThrottle(),
+        oidc: new OidcService(db, secrets, keys.state, opts.oidcAllowInsecure ?? false),
+        tokens: new McpTokenService(db, now),
+        oauth: new OAuthService(db, now),
+        instances,
+        approvals,
+        limiter,
+        links,
+        notifier,
+        repos,
+        keys,
+        warnings,
+        now,
+        gateDeps: () => ({ db, approvals, limiter, attestationKey: keys.attestation, now }),
+        discoverPlugins: discover,
+        async start() {
+            await instances.startAll();
+            // Hourly: daily backstop sync per instance and per plugin repo (design §10), staggered by their
+            // own last-run times, plus housekeeping.
+            const hourly = () => {
+                void instances.syncStale();
+                void repos.refreshStale();
+                try {
+                    runHousekeeping(ctx);
+                }
+                catch (err) {
+                    console.error('housekeeping failed', err);
+                }
+            };
+            hourly();
+            timers.push(setInterval(hourly, 60 * 60_000).unref());
+        },
+        onStop(fn) {
+            stopHooks.push(fn);
+        },
+        shutdownSignal: draining.signal,
+        drain,
+        async stop() {
+            await drain();
+            unsubscribeNotifier();
+            await instances.stopAll();
+            db.$client.close();
+        },
+    };
+    // Grants from before instance binding (design §6.2) get the ids their slugs name today.
+    ctx.oauth.backfillInstanceIds(instances.list());
+    return ctx;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AA2DxD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAmB,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,OAAO,+CAA+C,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACrG,IAAI,IAAI,KAAK,SAAS;QACpB,QAAQ,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,wBAAwB,0BAA0B,CAAC,CAAC;IAClG,IAAI,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAErH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACjG,wGAAwG;IACxG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC5B,SAAS,CAAC,uBAAuB,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,cAAc;QACxB,QAAQ,CAAC,IAAI,CACX,mHAAmH,CACpH,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACtD,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACX,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC;QAC7C,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;KACzC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE;QAChD,KAAK,EAAE,IAAI,CAAC,WAAW;QACvB,aAAa,EAAE,IAAI,CAAC,mBAAmB;QACvC,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,kBAAkB,CAChB,EAAE,EACF,eAAe,CAAC;QACd,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE;QAChD,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;KAC/D,CAAC,EACF,EAAE,cAAc,EAAE,MAAM,CAAC,uBAAuB,EAAE,CACnD,CAAC;IACJ,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC;QAClC,EAAE;QACF,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,KAAK,EAAE,IAAI,CAAC,SAAS;QACrB,SAAS,EAAE,IAAI,CAAC,aAAa;QAC7B,GAAG;QACH,QAAQ;QACR,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC;IAEzG,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACpC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACzC,sGAAsG;QACtG,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChC,0FAA0F;QAC1F,IAAI,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAChF,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gDAAgD;QAC/F,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;YAAE,MAAM,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,GAAG,GAAe;QACtB,MAAM;QACN,EAAE;QACF,OAAO;QACP,MAAM;QACN,KAAK;QACL,QAAQ,EAAE,IAAI,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC;QAC1E,QAAQ,EAAE,IAAI,aAAa,EAAE;QAC7B,IAAI,EAAE,IAAI,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAC/E,MAAM,EAAE,IAAI,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC;QACpC,KAAK,EAAE,IAAI,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC;QAChC,SAAS;QACT,SAAS;QACT,OAAO;QACP,KAAK;QACL,QAAQ;QACR,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,GAAG;QACH,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC;QACnF,eAAe,EAAE,QAAQ;QACzB,KAAK,CAAC,KAAK;YACT,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3B,gGAAgG;YAChG,yCAAyC;YACzC,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC3B,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,eAAe,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC,CAAC;YACF,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,EAAE;YACP,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,cAAc,EAAE,QAAQ,CAAC,MAAM;QAC/B,KAAK;QACL,KAAK,CAAC,IAAI;YACR,MAAM,KAAK,EAAE,CAAC;YACd,mBAAmB,EAAE,CAAC;YACtB,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1B,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;IACF,wFAAwF;IACxF,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/approvals/links.d.ts

@@ -0,0 +1,23 @@
+import type { Db } from '../db/index.js';
+/**
+ * Approval page tokens (design §5.3): single-use, stored hashed, bound to one approval, expiring with
+ * it. The MCP client receives the page URL in a URL-mode elicitation; the token only opens the page,
+ * and deciding still needs a signed-in human with TOTP, so the client holding it gains nothing.
+ */
+export declare class ApprovalLinkService {
+    private readonly db;
+    private readonly now;
+    constructor(db: Db, now?: () => Date);
+    create(approvalId: string, expiresAt: Date): string;
+    /** The live link row for a token, or null if unknown, used, or expired. */
+    resolve(token: string): {
+        tokenHash: string;
+        approvalId: string;
+        action: "approve" | "deny" | "view";
+        expiresAt: Date;
+        usedAt: Date | null;
+    } | null;
+    /** Burns every link of an approval once it has been decided. */
+    consumeAll(approvalId: string): void;
+    purgeExpired(): number;
+}

package/dist/approvals/links.js

@@ -0,0 +1,49 @@
+import { and, eq, gt, isNull, lt } from 'drizzle-orm';
+import { approvalLinks } from '../db/schema.js';
+import { randomToken, sha256 } from '../auth/tokens.js';
+/**
+ * Approval page tokens (design §5.3): single-use, stored hashed, bound to one approval, expiring with
+ * it. The MCP client receives the page URL in a URL-mode elicitation; the token only opens the page,
+ * and deciding still needs a signed-in human with TOTP, so the client holding it gains nothing.
+ */
+export class ApprovalLinkService {
+    db;
+    now;
+    constructor(db, now = () => new Date()) {
+        this.db = db;
+        this.now = now;
+    }
+    create(approvalId, expiresAt) {
+        const token = randomToken(32);
+        this.db
+            .insert(approvalLinks)
+            .values({ tokenHash: sha256(token), approvalId, action: 'view', expiresAt })
+            .run();
+        return token;
+    }
+    /** The live link row for a token, or null if unknown, used, or expired. */
+    resolve(token) {
+        if (!/^[A-Za-z0-9_-]{20,100}$/.test(token))
+            return null;
+        return (this.db
+            .select()
+            .from(approvalLinks)
+            .where(and(eq(approvalLinks.tokenHash, sha256(token)), isNull(approvalLinks.usedAt), gt(approvalLinks.expiresAt, this.now())))
+            .get() ?? null);
+    }
+    /** Burns every link of an approval once it has been decided. */
+    consumeAll(approvalId) {
+        this.db
+            .update(approvalLinks)
+            .set({ usedAt: this.now() })
+            .where(and(eq(approvalLinks.approvalId, approvalId), isNull(approvalLinks.usedAt)))
+            .run();
+    }
+    purgeExpired() {
+        return this.db
+            .delete(approvalLinks)
+            .where(lt(approvalLinks.expiresAt, new Date(this.now().getTime() - 24 * 3600_000)))
+            .run().changes;
+    }
+}
+//# sourceMappingURL=links.js.map

package/dist/approvals/links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/approvals/links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,EAAM,EACN,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,UAAkB,EAAE,SAAe;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aAC3E,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,CACL,IAAI,CAAC,EAAE;aACJ,MAAM,EAAE;aACR,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAC1C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CACxC,CACF;aACA,GAAG,EAAE,IAAI,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,UAAU,CAAC,UAAkB;QAC3B,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;aAC3B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;aAClF,GAAG,EAAE,CAAC;IACX,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,aAAa,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;aAClF,GAAG,EAAE,CAAC,OAAO,CAAC;IACnB,CAAC;CACF"}

package/dist/approvals/service.d.ts

@@ -0,0 +1,110 @@
+import type { Db } from '../db/index.js';
+import type { ApprovalLinkService } from './links.js';
+/**
+ * Human approval (design §5.3). Approvals happen only through the MCP client's own prompts, and an
+ * answer the client relays is never taken as a human's approval of a risky call:
+ *
+ * - **URL mode** (the approval path): the client is asked to open our approval page. A signed-in
+ *   human with TOTP decides there; the client never sees the decision form. Its own reply only says
+ *   whether the user opened the page (`accept`) or refused (`decline`/`cancel` → denied).
+ * - **Form mode**, only where the endpoint opted in (`formElicitationApprovals`) and the operation is
+ *   a plain write (not locked, no typed confirmation): the client's answer decides.
+ * - Anything else is denied at once. Unanswered requests are denied at the timeout; nothing is ever
+ *   approved by default.
+ */
+export type DecisionOutcome = 'approved' | 'denied' | 'timed_out' | 'cancelled';
+export type DecisionChannel = 'elicitation' | 'url';
+export interface Decision {
+    outcome: DecisionOutcome;
+    via?: DecisionChannel;
+    decidedBy?: string;
+    reason?: string;
+}
+export interface UrlPromptRequest {
+    approvalId: string;
+    /** Path of the approval page on the MCP listener; the MCP layer makes it absolute. */
+    path: string;
+    message: string;
+}
+export interface UrlPromptResponse {
+    action: 'accept' | 'decline' | 'cancel';
+}
+export interface FormPromptRequest {
+    approvalId: string;
+    message: string;
+    requestedSchema: {
+        type: 'object';
+        properties: Record<string, {
+            type: 'boolean';
+            title: string;
+            description?: string;
+        }>;
+        required: string[];
+    };
+}
+export interface FormPromptResponse {
+    action: 'accept' | 'decline' | 'cancel';
+    content?: {
+        approve?: unknown;
+    };
+}
+/** What the connected MCP client can show; present only for a live session that advertised it. */
+export interface ClientPrompts {
+    url?: (req: UrlPromptRequest) => Promise<UrlPromptResponse>;
+    /** Tells the client a URL prompt was decided, so it can close it. */
+    urlComplete?: (approvalId: string) => void;
+    form?: (req: FormPromptRequest) => Promise<FormPromptResponse>;
+}
+export interface ApprovalRequestInput {
+    instanceId: string;
+    operationId: string;
+    operationKey: string;
+    classification: string;
+    paramsDisplay: unknown;
+    paramsHash: string;
+    resolvedTargets: unknown;
+    summary: string;
+    confirmLiteral?: string;
+    diff?: unknown;
+    expectedHash?: string;
+    client: {
+        kind: string;
+        id?: string;
+    };
+    mcpSessionId?: string;
+    timeoutMs: number;
+    prompts?: ClientPrompts;
+    /** The endpoint lets form prompts approve, and this is a plain write (not locked, no typed confirmation). */
+    formApprovals: boolean;
+}
+export declare class ApprovalService {
+    private readonly db;
+    private readonly links;
+    private readonly now;
+    private readonly live;
+    constructor(db: Db, links: ApprovalLinkService, now?: () => Date);
+    /**
+     * Called once at startup: pending rows from a previous process can never be approved, because the
+     * exact params they cover only ever lived in memory (design §5.5). They are denied and audited.
+     */
+    static denyOrphans(db: Db, now?: Date): number;
+    request(input: ApprovalRequestInput): {
+        id: string;
+        decision: Promise<Decision>;
+    };
+    private message;
+    private offerUrl;
+    private offerForm;
+    /** The approval page's decision. A wrong typed confirmation is rejected so the approver can retry. */
+    decide(id: string, input: {
+        approve: boolean;
+        confirm?: string;
+        decidedBy: string;
+    }): Decision;
+    /** Cancels one open request (its execution ended). Returns false if it was already decided. */
+    cancel(id: string, reason: string): boolean;
+    /** Cancels the open requests of one endpoint (it was stopped: disabled, deleted or reconfigured). */
+    cancelForInstance(instanceId: string, reason: string): number;
+    /** Cancels every open request (shutdown). Cancelled calls are denied to the sandbox. */
+    cancelAll(reason?: string): void;
+}

package/dist/approvals/service.js

@@ -0,0 +1,182 @@
+import { randomUUID } from 'node:crypto';
+import { and, eq } from 'drizzle-orm';
+import { writeAudit } from '../audit.js';
+import { pendingApprovals } from '../db/schema.js';
+import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+export class ApprovalService {
+    db;
+    links;
+    now;
+    live = new Map();
+    constructor(db, links, now = () => new Date()) {
+        this.db = db;
+        this.links = links;
+        this.now = now;
+    }
+    /**
+     * Called once at startup: pending rows from a previous process can never be approved, because the
+     * exact params they cover only ever lived in memory (design §5.5). They are denied and audited.
+     */
+    static denyOrphans(db, now = new Date()) {
+        return db.transaction((tx) => {
+            const orphans = tx.select().from(pendingApprovals).where(eq(pendingApprovals.status, 'pending')).all();
+            for (const o of orphans) {
+                tx.update(pendingApprovals)
+                    .set({ status: 'denied', decidedAt: now })
+                    .where(eq(pendingApprovals.id, o.id))
+                    .run();
+                writeAudit(tx, {
+                    kind: 'call',
+                    instanceId: o.instanceId,
+                    decision: 'denied',
+                    actorKind: 'system',
+                    detail: { approvalId: o.id, reason: 'server_restart' },
+                }, now);
+            }
+            return orphans.length;
+        });
+    }
+    request(input) {
+        const now = this.now();
+        const id = randomUUID();
+        const row = {
+            id,
+            instanceId: input.instanceId,
+            operationId: input.operationId,
+            paramsDisplay: input.paramsDisplay ?? null,
+            paramsHash: input.paramsHash,
+            resolvedTargets: input.resolvedTargets ?? null,
+            summary: input.summary,
+            confirmLiteral: input.confirmLiteral ?? null,
+            diff: input.diff ?? null,
+            expectedHash: input.expectedHash ?? null,
+            clientKind: input.client.kind,
+            clientId: input.client.id ?? null,
+            mcpSessionId: input.mcpSessionId ?? null,
+            requestedAt: now,
+            expiresAt: new Date(now.getTime() + input.timeoutMs),
+            status: 'pending',
+            decidedBy: null,
+            decidedVia: null,
+            decidedAt: null,
+        };
+        const prompts = input.prompts ?? {};
+        const channel = prompts.url ? 'url' : prompts.form && input.formApprovals ? 'form' : null;
+        if (!channel) {
+            // A form-only client can't carry a human's approval for this call; no prompts at all is worse.
+            const reason = prompts.form ? 'client_cannot_approve' : 'no_approval_path';
+            this.db
+                .insert(pendingApprovals)
+                .values({ ...row, status: 'denied', decidedAt: now })
+                .run();
+            return { id, decision: Promise.resolve({ outcome: 'denied', reason }) };
+        }
+        this.db.insert(pendingApprovals).values(row).run();
+        const decision = new Promise((resolve) => {
+            const timer = setTimeout(() => settle({ outcome: 'timed_out' }), input.timeoutMs);
+            const settle = (d) => {
+                if (!this.live.delete(id))
+                    return; // first decision wins
+                clearTimeout(timer);
+                const status = d.outcome === 'timed_out' ? 'timed_out' : d.outcome;
+                this.db
+                    .update(pendingApprovals)
+                    .set({ status, decidedBy: d.decidedBy ?? null, decidedVia: d.via ?? null, decidedAt: this.now() })
+                    .where(and(eq(pendingApprovals.id, id), eq(pendingApprovals.status, 'pending')))
+                    .run();
+                this.links.consumeAll(id);
+                if (channel === 'url')
+                    prompts.urlComplete?.(id);
+                resolve(d);
+            };
+            this.live.set(id, { row, settle });
+        });
+        if (channel === 'url')
+            this.offerUrl(id, row.expiresAt, input);
+        else
+            this.offerForm(id, input);
+        return { id, decision };
+    }
+    message(input, trailer) {
+        return [input.summary, '', `Operation: ${input.operationKey} (${input.classification})`, '', trailer].join('\n');
+    }
+    offerUrl(id, expiresAt, input) {
+        const token = this.links.create(id, expiresAt);
+        const clientDenied = (reason) => ({
+            outcome: 'denied',
+            via: 'elicitation',
+            decidedBy: input.client.id,
+            reason,
+        });
+        input.prompts.url({
+            approvalId: id,
+            path: `/a/${token}`,
+            message: this.message(input, 'Open the approval page to review the details and approve or deny.'),
+        }).then((res) => {
+            // `accept` only means the page was opened; the decision is made there.
+            if (res.action !== 'accept')
+                this.live.get(id)?.settle(clientDenied('declined'));
+        }, 
+        // The client could not show the prompt: nobody can reach the page, so don't wait for the timeout.
+        () => this.live.get(id)?.settle(clientDenied('prompt_failed')));
+    }
+    offerForm(id, input) {
+        const message = this.message(input, `Parameters: ${JSON.stringify(input.paramsDisplay)}${input.diff ? `\nChanges: ${JSON.stringify(input.diff)}` : ''}`);
+        input.prompts.form({
+            approvalId: id,
+            message,
+            requestedSchema: {
+                type: 'object',
+                properties: { approve: { type: 'boolean', title: 'Approve this call?' } },
+                required: ['approve'],
+            },
+        }).then((res) => {
+            const live = this.live.get(id);
+            if (!live)
+                return;
+            const approved = res.action === 'accept' && res.content?.approve === true;
+            live.settle({ outcome: approved ? 'approved' : 'denied', via: 'elicitation', decidedBy: input.client.id });
+        }, () => this.live.get(id)?.settle({ outcome: 'denied', reason: 'prompt_failed' }));
+    }
+    /** The approval page's decision. A wrong typed confirmation is rejected so the approver can retry. */
+    decide(id, input) {
+        const live = this.live.get(id);
+        if (!live) {
+            const row = this.db.select().from(pendingApprovals).where(eq(pendingApprovals.id, id)).get();
+            if (!row)
+                throw new NotFoundError('approval_not_found', 'No such approval');
+            throw new ConflictError('approval_closed', `This approval is already ${row.status}`);
+        }
+        if (input.approve && live.row.confirmLiteral && input.confirm !== live.row.confirmLiteral) {
+            throw new ValidationError('confirmation_mismatch', `Type "${live.row.confirmLiteral}" exactly to approve`);
+        }
+        const decision = {
+            outcome: input.approve ? 'approved' : 'denied',
+            via: 'url',
+            decidedBy: input.decidedBy,
+        };
+        live.settle(decision);
+        return decision;
+    }
+    /** Cancels one open request (its execution ended). Returns false if it was already decided. */
+    cancel(id, reason) {
+        const live = this.live.get(id);
+        if (!live)
+            return false;
+        live.settle({ outcome: 'cancelled', reason });
+        return true;
+    }
+    /** Cancels the open requests of one endpoint (it was stopped: disabled, deleted or reconfigured). */
+    cancelForInstance(instanceId, reason) {
+        const mine = [...this.live.values()].filter((l) => l.row.instanceId === instanceId);
+        for (const live of mine)
+            live.settle({ outcome: 'cancelled', reason });
+        return mine.length;
+    }
+    /** Cancels every open request (shutdown). Cancelled calls are denied to the sandbox. */
+    cancelAll(reason = 'shutdown') {
+        for (const live of [...this.live.values()])
+            live.settle({ outcome: 'cancelled', reason });
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/approvals/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/approvals/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAqF7E,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEhD,YACmB,EAAM,EACN,KAA0B,EAC1B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,UAAK,GAAL,KAAK,CAAqB;QAC1B,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,EAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACzC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;qBACxB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;qBACzC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;qBACpC,GAAG,EAAE,CAAC;gBACT,UAAU,CACR,EAAE,EACF;oBACE,IAAI,EAAE,MAAM;oBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;iBACvD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,KAA2B;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG;YACV,EAAE;YACF,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC7B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACpD,MAAM,EAAE,SAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+FAA+F;YAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC3E,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,gBAAgB,CAAC;iBACxB,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACpD,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;YACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,CAAC,CAAW,EAAE,EAAE;gBAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,OAAO,CAAC,sBAAsB;gBACzD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBACnE,IAAI,CAAC,EAAE;qBACJ,MAAM,CAAC,gBAAgB,CAAC;qBACxB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;qBACjG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;qBAC/E,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,OAAO,KAAK,KAAK;oBAAE,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;;YAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAEO,OAAO,CAAC,KAA2B,EAAE,OAAe;QAC1D,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,cAAc,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe,EAAE,KAA2B;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,CAAC,MAAc,EAAY,EAAE,CAAC,CAAC;YAClD,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM;SACP,CAAC,CAAC;QACH,KAAK,CAAC,OAAQ,CAAC,GAAI,CAAC;YAClB,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,MAAM,KAAK,EAAE;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mEAAmE,CAAC;SAClG,CAAC,CAAC,IAAI,CACL,CAAC,GAAG,EAAE,EAAE;YACN,uEAAuE;YACvE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,kGAAkG;QAClG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAC/D,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,EAAU,EAAE,KAA2B;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B,KAAK,EACL,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpH,CAAC;QACF,KAAK,CAAC,OAAQ,CAAC,IAAK,CAAC;YACnB,UAAU,EAAE,EAAE;YACd,OAAO;YACP,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE;gBACzE,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB;SACF,CAAC,CAAC,IAAI,CACL,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAChF,CAAC;IACJ,CAAC;IAED,sGAAsG;IACtG,MAAM,CAAC,EAAU,EAAE,KAAgE;QACjF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7F,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;YAC5E,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC1F,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,sBAAsB,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,QAAQ,GAAa;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAC9C,GAAG,EAAE,KAAK;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,EAAU,EAAE,MAAc;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qGAAqG;IACrG,iBAAiB,CAAC,UAAkB,EAAE,MAAc;QAClD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpF,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,wFAAwF;IACxF,SAAS,CAAC,MAAM,GAAG,UAAU;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF"}