npm - @tinycloud/mcp - Versions diffs - 0.3.4-beta.4 → 0.3.4-beta.5 - Mend

@tinycloud/mcp 0.3.4-beta.4 → 0.3.4-beta.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/dist/http-cli.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/http-cli.ts","../src/http.ts","../src/oauth.ts","../src/remote-store.ts","../src/server.ts","../src/tools.ts","../src/results.ts","../package.json","../src/version.ts"],"sourcesContent":["import { createServer } from \"node:http\";\nimport { isAbsolute, resolve } from \"node:path\";\n\nimport { toNodeHandler } from \"@modelcontextprotocol/node\";\n\nimport { createHostedMcpApp } from \"./http.js\";\nimport { loadOAuthMetadata } from \"./oauth.js\";\n\nexport async function main(): Promise<void> {\n process.umask(0o077);\n const publicUrl = requiredUrl(\"TC_MCP_PUBLIC_URL\");\n const stateDir = requiredAbsolutePath(\"TC_MCP_STATE_DIR\");\n const stateSecret = requiredString(\"TC_MCP_STATE_SECRET\");\n if (Buffer.byteLength(stateSecret) < 32) throw new Error(\"TC_MCP_STATE_SECRET must contain at least 32 bytes.\");\n const openkeyHost = process.env.TC_OPENKEY_HOST ?? \"https://openkey.so\";\n const oauthMetadataUrl = new URL(\n process.env.TC_MCP_OAUTH_METADATA_URL ??\n \"https://api.openkey.so/.well-known/oauth-authorization-server/api/auth\",\n );\n const oauthMetadata = await loadOAuthMetadata(oauthMetadataUrl);\n const app = createHostedMcpApp({\n publicUrl,\n stateDir,\n stateSecret,\n nodeHost: process.env.TC_HOST ?? \"https://tee.node.tinycloud.xyz\",\n openkeyHost,\n approvalTtlSeconds: positiveInteger(process.env.TC_MCP_APPROVAL_TTL_SECONDS, 300),\n delegationExpiry: process.env.TC_MCP_DELEGATION_EXPIRY ?? \"1h\",\n allowedOrigins: commaList(process.env.TC_MCP_ALLOWED_ORIGINS),\n oauthMetadata,\n });\n const nodeHandler = toNodeHandler(app);\n const server = createServer(nodeHandler);\n const host = process.env.HOST ?? \"0.0.0.0\";\n const port = positiveInteger(process.env.PORT, 3000);\n server.listen(port, host, () => {\n process.stderr.write(`[tinycloud-mcp-http] listening on ${host}:${port}\\n`);\n });\n const shutdown = () => {\n server.close(() => void app.close());\n };\n process.once(\"SIGINT\", shutdown);\n process.once(\"SIGTERM\", shutdown);\n}\n\nfunction requiredString(name: string): string {\n const value = process.env[name]?.trim();\n if (!value) throw new Error(`${name} is required.`);\n return value;\n}\n\nfunction requiredUrl(name: string): URL {\n const url = new URL(requiredString(name));\n if (url.protocol !== \"https:\" && url.hostname !== \"localhost\" && url.hostname !== \"127.0.0.1\") {\n throw new Error(`${name} must use HTTPS outside localhost.`);\n }\n return url;\n}\n\nfunction requiredAbsolutePath(name: string): string {\n const value = requiredString(name);\n if (!isAbsolute(value)) throw new Error(`${name} must be an absolute path.`);\n return resolve(value);\n}\n\nfunction positiveInteger(value: string \| undefined, fallback: number): number {\n if (value === undefined) return fallback;\n const parsed = Number(value);\n if (!Number.isInteger(parsed) \|\| parsed <= 0) throw new Error(\"Expected a positive integer environment value.\");\n return parsed;\n}\n\nfunction commaList(value: string \| undefined): string[] \| undefined {\n if (value === undefined) return undefined;\n return value.split(\",\").map((entry) => entry.trim()).filter(Boolean);\n}\n\nvoid main().catch(() => {\n process.stderr.write(\"[tinycloud-mcp-http] Startup failed.\\n\");\n process.exitCode = 1;\n});\n","import {\n McpServer,\n createMcpHandler,\n fromJsonSchema,\n getOAuthProtectedResourceMetadataUrl,\n hostHeaderValidationResponse,\n oauthMetadataResponse,\n requireBearerAuth,\n type AuthInfo,\n type OAuthMetadata,\n} from \"@modelcontextprotocol/server\";\n\nimport { createOpenKeyTokenVerifier } from \"./oauth.js\";\nimport { ApprovalOwnerMismatchError, RemoteTenantStore, type RemoteStoreConfig } from \"./remote-store.js\";\nimport { MCP_SERVER_NAME } from \"./server.js\";\nimport { createJsonSchemaValidator, registerTinyCloudTools } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nconst REQUIRED_SCOPE = \"tinycloud:mcp\";\n\nexport interface HostedMcpConfig extends RemoteStoreConfig {\n readonly oauthMetadata: OAuthMetadata;\n readonly allowedOrigins?: readonly string[];\n}\n\nexport interface HostedMcpApp {\n readonly fetch: (request: Request) => Promise<Response>;\n readonly close: () => Promise<void>;\n}\n\nexport function createHostedMcpApp(config: HostedMcpConfig): HostedMcpApp {\n const resourceUrl = canonicalResourceUrl(config.publicUrl);\n const issuer = String(config.oauthMetadata.issuer);\n const jwksUri = String(config.oauthMetadata.jwks_uri);\n const verifier = createOpenKeyTokenVerifier({\n issuer,\n audience: resourceUrl.toString(),\n jwksUri,\n requiredScope: REQUIRED_SCOPE,\n });\n const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(resourceUrl);\n const authenticate = requireBearerAuth({\n verifier,\n requiredScopes: [REQUIRED_SCOPE],\n resourceMetadataUrl,\n });\n const store = new RemoteTenantStore({ ...config, publicUrl: resourceUrl });\n const handler = createMcpHandler(async ({ authInfo }) => {\n const identity = oauthIdentity(authInfo);\n const { subject, ownerDids } = identity;\n const stateRoot = store.tenantStateRoot(subject);\n const validator = createJsonSchemaValidator();\n const server = new McpServer(\n { name: MCP_SERVER_NAME, version: MCP_VERSION },\n {\n jsonSchemaValidator: validator,\n instructions: \"Call tinycloud_connect first. If an operation returns authority_required, open approval.url, then retry that operation unchanged.\",\n },\n );\n registerTinyCloudTools(server, {\n profile: \"agent\",\n explicitProfile: true,\n allowOwnerProfile: false,\n stateRoot,\n transformOperationResult: (result) => store.decorateAuthorityResult(subject, ownerDids, result),\n }, validator);\n registerConnectTool(server, validator, store, identity);\n return server;\n }, {\n legacy: \"stateless\",\n onerror: () => writeDiagnostic(\"MCP request failed\"),\n });\n\n const metadataOptions = {\n oauthMetadata: config.oauthMetadata,\n resourceServerUrl: resourceUrl,\n serviceDocumentationUrl: new URL(\"https://docs.tinycloud.xyz/cli/mcp\"),\n scopesSupported: [REQUIRED_SCOPE],\n resourceName: \"TinyCloud hosted MCP\",\n };\n const allowedHosts = [resourceUrl.hostname];\n\n return {\n async fetch(request: Request): Promise<Response> {\n const metadata = oauthMetadataResponse(request, metadataOptions);\n if (metadata !== undefined) return metadata;\n const url = new URL(request.url);\n if (url.pathname === \"/healthz\") {\n return request.method === \"GET\"\n ? json({ ok: true })\n : methodNotAllowed(\"GET\");\n }\n const hostFailure = hostHeaderValidationResponse(request, allowedHosts);\n if (hostFailure !== undefined) return hostFailure;\n\n if (url.pathname === \"/connect\") {\n if (request.method !== \"GET\") return methodNotAllowed(\"GET\");\n try {\n const destination = await store.approvalRedirect(requiredState(url));\n return Response.redirect(destination, 302);\n } catch {\n return json({ error: \"The approval link is invalid or expired.\" }, 400);\n }\n }\n if (url.pathname === \"/connect/callback\") {\n if (request.method === \"OPTIONS\") return callbackCors(new Response(null, { status: 204 }), config.openkeyHost);\n if (request.method !== \"POST\") return methodNotAllowed(\"POST\");\n const originFailure = validateCallbackOrigin(request, config.openkeyHost);\n if (originFailure !== undefined) return callbackCors(originFailure, config.openkeyHost);\n try {\n await store.completeApproval(requiredState(url), request);\n return callbackCors(json({ success: true }), config.openkeyHost);\n } catch (error) {\n // Only fixed server-authored text reaches OpenKey; callback input is never echoed.\n return callbackCors(\n error instanceof ApprovalOwnerMismatchError\n ? json({ error: error.message, code: \"approval_owner_mismatch\" }, 403)\n : json({ error: \"TinyCloud could not accept this delegation.\" }, 400),\n config.openkeyHost,\n );\n }\n }\n if (url.pathname !== resourceUrl.pathname) return json({ error: \"Not found\" }, 404);\n const originFailure = validateOrigin(request, config.allowedOrigins);\n if (originFailure !== undefined) return originFailure;\n const auth = await authenticate(request);\n if (auth instanceof Response) return auth;\n return handler.fetch(request, { authInfo: auth });\n },\n close: () => handler.close(),\n };\n}\n\nfunction registerConnectTool(\n server: McpServer,\n validator: ReturnType<typeof createJsonSchemaValidator>,\n store: RemoteTenantStore,\n identity: OAuthIdentity,\n): void {\n const inputSchema = fromJsonSchema({ type: \"object\", properties: {}, additionalProperties: false }, validator);\n const outputSchema = fromJsonSchema({\n type: \"object\",\n properties: {\n connected: { type: \"boolean\" },\n sessionDid: { type: \"string\" },\n approvalUrl: { type: \"string\", format: \"uri\" },\n expiresAt: { type: \"string\", format: \"date-time\" },\n },\n required: [\"connected\", \"sessionDid\"],\n additionalProperties: false,\n }, validator);\n server.registerTool(\n \"tinycloud_connect\",\n {\n title: \"Connect TinyCloud\",\n description: \"Check the hosted delegate connection and return a one-time OpenKey approval URL when setup is required.\",\n inputSchema,\n outputSchema,\n annotations: {\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n },\n async () => {\n const status = await store.connectStatus(identity.subject, identity.ownerDids);\n return {\n content: [{\n type: \"text\" as const,\n text: status.connected\n ? \"TinyCloud is connected.\"\n : \"TinyCloud approval is required; open approvalUrl, then call this tool again.\",\n }],\n structuredContent: status,\n };\n },\n );\n}\n\ninterface OAuthIdentity {\n readonly subject: string;\n readonly ownerDids: string[];\n}\n\nfunction oauthIdentity(authInfo: AuthInfo \| undefined): OAuthIdentity {\n const subject = authInfo?.extra?.subject;\n if (typeof subject !== \"string\" \|\| subject.length === 0) {\n throw new Error(\"The authenticated MCP request has no OpenKey subject.\");\n }\n const ownerDids = authInfo?.extra?.ownerDids;\n if (!Array.isArray(ownerDids) \|\| ownerDids.length === 0 \|\|\n !ownerDids.every((did) => typeof did === \"string\")) {\n throw new Error(\"The authenticated MCP request has no OpenKey owner identity.\");\n }\n return { subject, ownerDids };\n}\n\nfunction canonicalResourceUrl(url: URL): URL {\n const resource = new URL(url);\n resource.hash = \"\";\n resource.search = \"\";\n resource.pathname = resource.pathname.replace(/\\/+$/, \"\") \|\| \"/mcp\";\n if (resource.pathname === \"/\") resource.pathname = \"/mcp\";\n return resource;\n}\n\nfunction requiredState(url: URL): string {\n const state = url.searchParams.get(\"state\");\n if (state === null \|\| state.length > 512) throw new Error(\"Missing approval state.\");\n return state;\n}\n\nfunction validateOrigin(request: Request, allowed: readonly string[] \| undefined): Response \| undefined {\n const origin = request.headers.get(\"origin\");\n if (origin === null) return undefined;\n const allowlist = allowed ?? [];\n return allowlist.includes(origin) ? undefined : json({ error: \"Origin is not allowed.\" }, 403);\n}\n\nfunction validateCallbackOrigin(request: Request, openkeyHost: string): Response \| undefined {\n const origin = request.headers.get(\"origin\");\n return origin === null \|\| origin === new URL(openkeyHost).origin\n ? undefined\n : json({ error: \"Origin is not allowed.\" }, 403);\n}\n\nfunction callbackCors(response: Response, openkeyHost: string): Response {\n const headers = new Headers(response.headers);\n headers.set(\"access-control-allow-origin\", new URL(openkeyHost).origin);\n headers.set(\"access-control-allow-methods\", \"POST, OPTIONS\");\n headers.set(\"access-control-allow-headers\", \"content-type\");\n headers.set(\"vary\", \"Origin\");\n return new Response(response.body, { status: response.status, headers });\n}\n\nfunction json(value: unknown, status = 200): Response {\n return Response.json(value, { status, headers: { \"cache-control\": \"no-store\" } });\n}\n\nfunction methodNotAllowed(allow: string): Response {\n return new Response(\"Method not allowed\", { status: 405, headers: { allow } });\n}\n\nfunction writeDiagnostic(message: string): void {\n process.stderr.write(`[tinycloud-mcp-http] ${message}\\n`);\n}\n","import {\n OAuthError,\n OAuthErrorCode,\n type AuthInfo,\n type OAuthMetadata,\n type OAuthTokenVerifier,\n} from \"@modelcontextprotocol/server\";\nimport { createRemoteJWKSet, errors, jwtVerify, type JWTPayload } from \"jose\";\n\nconst OWNER_DIDS_CLAIM = \"https://tinycloud.xyz/owner_dids\";\n\nexport interface OpenKeyOAuthConfig {\n readonly issuer: string;\n readonly audience: string;\n readonly jwksUri: string;\n readonly requiredScope?: string;\n}\n\nexport function createOpenKeyTokenVerifier(config: OpenKeyOAuthConfig): OAuthTokenVerifier {\n const jwks = createRemoteJWKSet(new URL(config.jwksUri));\n return {\n async verifyAccessToken(token: string): Promise<AuthInfo> {\n try {\n const { payload } = await jwtVerify(token, jwks, {\n issuer: config.issuer,\n audience: config.audience,\n });\n return authInfo(token, payload, config);\n } catch (error) {\n if (error instanceof errors.JOSEError) {\n throw new OAuthError(OAuthErrorCode.InvalidToken, \"The OpenKey access token is invalid.\");\n }\n throw error;\n }\n },\n };\n}\n\nexport async function loadOAuthMetadata(metadataUrl: URL): Promise<OAuthMetadata> {\n const response = await fetch(metadataUrl, {\n headers: { accept: \"application/json\" },\n signal: AbortSignal.timeout(10_000),\n });\n if (!response.ok) throw new Error(\"OpenKey OAuth discovery failed.\");\n const metadata = await response.json() as OAuthMetadata;\n if (typeof metadata.issuer !== \"string\" \|\| typeof metadata.jwks_uri !== \"string\") {\n throw new Error(\"OpenKey OAuth metadata is incomplete.\");\n }\n return metadata;\n}\n\nfunction authInfo(\n token: string,\n payload: JWTPayload,\n config: OpenKeyOAuthConfig,\n): AuthInfo {\n if (typeof payload.sub !== \"string\" \|\| payload.sub.length === 0) {\n throw new OAuthError(OAuthErrorCode.InvalidToken, \"The OpenKey access token does not identify a subject.\");\n }\n if (typeof payload.exp !== \"number\") {\n throw new OAuthError(OAuthErrorCode.InvalidToken, \"The OpenKey access token has no expiry.\");\n }\n const scopes = typeof payload.scope === \"string\"\n ? payload.scope.split(/\\s+/).filter(Boolean)\n : [];\n if (config.requiredScope !== undefined && !scopes.includes(config.requiredScope)) {\n throw new OAuthError(\n OAuthErrorCode.InsufficientScope,\n \"The OpenKey access token is missing the TinyCloud MCP scope.\",\n );\n }\n const clientId = firstString(payload.azp, payload.client_id) ?? \"unknown\";\n const ownerDids = Array.isArray(payload[OWNER_DIDS_CLAIM])\n ? payload[OWNER_DIDS_CLAIM].filter((value): value is string => typeof value === \"string\")\n : [];\n if (ownerDids.length === 0) {\n throw new OAuthError(\n OAuthErrorCode.InvalidToken,\n \"The OpenKey access token has no TinyCloud owner identity.\",\n );\n }\n return {\n token,\n clientId,\n scopes,\n expiresAt: payload.exp,\n resource: new URL(config.audience),\n extra: {\n subject: payload.sub,\n ownerDids,\n },\n };\n}\n\nfunction firstString(...values: unknown[]): string \| undefined {\n return values.find((value): value is string => typeof value === \"string\" && value.length > 0);\n}\n","import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport {\n TinyCloudNode,\n principalDidEquals,\n type PermissionEntry,\n type PortableDelegation,\n type TinyCloudSession,\n} from \"@tinycloud/node-sdk\";\nimport { TCWSessionManager, importKey, initPanicHook } from \"@tinycloud/node-sdk-wasm\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nconst PROFILE = \"agent\";\nconst MAX_CALLBACK_BYTES = 256 * 1024;\nconst BOOTSTRAP_PERMISSIONS: PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: \"account\",\n path: \"spaces/\",\n actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n },\n {\n service: \"tinycloud.kv\",\n space: \"account\",\n path: \"applications/\",\n actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n },\n];\n\nexport interface RemoteStoreConfig {\n readonly stateDir: string;\n readonly stateSecret: string;\n readonly publicUrl: URL;\n readonly nodeHost: string;\n readonly openkeyHost: string;\n readonly approvalTtlSeconds: number;\n readonly delegationExpiry: string;\n}\n\ninterface TenantProfile {\n readonly stateRoot: string;\n readonly sessionDid: string;\n readonly jwk: Record<string, unknown>;\n}\n\ninterface PendingApproval {\n readonly version: 1;\n readonly nonce: string;\n readonly tenantId: string;\n readonly kind: \"bootstrap\" \| \"delegation\";\n readonly requestId?: string;\n readonly permissions: PermissionEntry[];\n readonly ownerDids: string[];\n readonly createdAt: string;\n readonly expiresAt: string;\n}\n\nexport interface ConnectStatus {\n readonly connected: boolean;\n readonly sessionDid: string;\n readonly approvalUrl?: string;\n readonly expiresAt?: string;\n}\n\ninterface CallbackSession {\n readonly delegationHeader: { Authorization: string };\n readonly delegationCid: string;\n readonly spaceId: string;\n readonly jwk: Record<string, unknown>;\n readonly verificationMethod: string;\n readonly address?: string;\n readonly chainId?: number;\n readonly siwe?: string;\n readonly signature?: string;\n}\n\n/*\n The approving wallet is not the OpenKey principal whose MCP request created\n * the approval link. The message is static so callers may show it verbatim.\n /\nexport class ApprovalOwnerMismatchError extends Error {\n constructor() {\n super(\"This approval link was requested by a different TinyCloud account, so the delegation was not stored.\");\n this.name = \"ApprovalOwnerMismatchError\";\n }\n}\n\nexport class RemoteTenantStore {\n readonly #config: RemoteStoreConfig;\n readonly #initializing = new Map<string, Promise<TenantProfile>>();\n\n constructor(config: RemoteStoreConfig) {\n this.#config = config;\n }\n\n tenantStateRoot(subject: string): string {\n return join(this.#config.stateDir, \"tenants\", this.#tenantId(subject));\n }\n\n async connectStatus(subject: string, ownerDids: readonly string[] = []): Promise<ConnectStatus> {\n const tenant = await this.#ensureTenant(subject);\n if (await this.#hasValidSession(tenant, ownerDids)) {\n return { connected: true, sessionDid: tenant.sessionDid };\n }\n const pending = await this.#createPending(subject, ownerDids, \"bootstrap\", BOOTSTRAP_PERMISSIONS);\n return {\n connected: false,\n sessionDid: tenant.sessionDid,\n approvalUrl: this.#connectUrl(pending),\n expiresAt: pending.expiresAt,\n };\n }\n\n async decorateAuthorityResult(\n subject: string,\n ownerDids: readonly string[],\n result: unknown,\n ): Promise<unknown> {\n if (!isRecord(result) \|\| result.status !== \"authority_required\") return result;\n const request = isRecord(result.request) ? result.request : undefined;\n const requestId = typeof request?.requestId === \"string\" ? request.requestId : undefined;\n const requested = Array.isArray(request?.requested)\n ? request.requested.filter(isPermissionEntry)\n : [];\n if (requestId === undefined \|\| requested.length === 0) return result;\n const pending = await this.#createPending(subject, ownerDids, \"delegation\", requested, requestId);\n return {\n ...result,\n approval: {\n ...(isRecord(result.approval) ? result.approval : {}),\n kind: \"openkey\",\n requestId,\n url: this.#connectUrl(pending),\n fallback: \"Open the approval URL, then retry the same MCP tool.\",\n },\n };\n }\n\n async approvalRedirect(state: string): Promise<string> {\n const pending = await this.#readPending(state, false);\n const tenant = await this.#readTenant(pending.tenantId);\n const callback = new URL(\"/connect/callback\", this.#config.publicUrl);\n callback.searchParams.set(\"state\", state);\n const params = new URLSearchParams({\n did: tenant.sessionDid,\n callback: callback.toString(),\n host: this.#config.nodeHost,\n jwk: Buffer.from(JSON.stringify(publicJwk(tenant.jwk))).toString(\"base64url\"),\n permissions: Buffer.from(JSON.stringify({\n permissions: pending.permissions,\n reason: [\n pending.kind === \"bootstrap\"\n ? \"Connect this TinyCloud account to the hosted MCP delegate.\"\n : \"Approve the exact capabilities requested by the TinyCloud MCP operation.\",\n // Owner DIDs come from the verified OpenKey access token of the MCP\n // client that created this link, never from the link itself.\n ...(pending.ownerDids.length === 0\n ? []\n : [`Requested by TinyCloud account ${pending.ownerDids.join(\", \")}; approve only if that is you.`]),\n ].join(\" \"),\n })).toString(\"base64url\"),\n expiry: this.#config.delegationExpiry,\n });\n return `${this.#config.openkeyHost.replace(/\\/+$/, \"\")}/delegate?${params.toString()}`;\n }\n\n async completeApproval(state: string, request: Request): Promise<void> {\n const length = Number(request.headers.get(\"content-length\") ?? \"0\");\n if (Number.isFinite(length) && length > MAX_CALLBACK_BYTES) throw new Error(\"Callback body is too large.\");\n const text = await request.text();\n if (Buffer.byteLength(text) > MAX_CALLBACK_BYTES) throw new Error(\"Callback body is too large.\");\n const data = JSON.parse(text) as unknown;\n if (!isRecord(data)) throw new Error(\"Callback body is invalid.\");\n\n const pending = await this.#readPending(state, true);\n try {\n const tenant = await this.#readTenant(pending.tenantId);\n if (pending.kind === \"bootstrap\") {\n await this.#storeBootstrap(tenant, pending, data);\n } else {\n await this.#storeDelegation(tenant, pending, data);\n }\n await rm(this.#pendingPath(tenant.stateRoot, pending.nonce) + \".processing\", { force: true });\n } catch (error) {\n await this.#restorePending(pending).catch(() => undefined);\n throw error;\n }\n }\n\n async #storeBootstrap(\n tenant: TenantProfile,\n pending: PendingApproval,\n data: Record<string, unknown>,\n ): Promise<void> {\n const { node, session } = await this.#restoreApproval(tenant, data);\n if (pending.ownerDids.length > 0 && !pending.ownerDids.some((did) => samePrincipal(node.did, did))) {\n throw new ApprovalOwnerMismatchError();\n }\n const granted = [...node.getVerifiedSessionCapabilities()];\n if (!permissionsCover(pending.permissions, granted)) {\n throw new Error(\"The approved delegation does not cover the requested account access.\");\n }\n const profile = await readJson<Record<string, unknown>>(this.#profilePath(tenant.stateRoot));\n await secureWrite(this.#profilePath(tenant.stateRoot), {\n ...profile,\n ownerDid: normalizeDid(node.did),\n spaceId: session.spaceId,\n });\n await secureWrite(this.#sessionPath(tenant.stateRoot), {\n authMethod: \"openkey\",\n ...session,\n });\n }\n\n async #storeDelegation(\n tenant: TenantProfile,\n pending: PendingApproval,\n data: Record<string, unknown>,\n ): Promise<void> {\n if (pending.requestId === undefined) throw new Error(\"Authority request is missing.\");\n // Unlike bootstrap there is no empty-list exemption: a delegation is only\n // imported when its verified signer is the OAuth principal that asked.\n const { node } = await this.#restoreApproval(tenant, data);\n if (!pending.ownerDids.some((did) => samePrincipal(node.did, did))) throw new ApprovalOwnerMismatchError();\n const delegation = portableFromCallback(data, pending.permissions, this.#config.nodeHost);\n const result = await invokeOperation(\n \"tinycloud.auth.import\",\n 1,\n { profile: PROFILE, stateRoot: tenant.stateRoot },\n {\n requestId: pending.requestId,\n delegationCid: delegation.cid,\n delegation,\n },\n );\n if (result.status !== \"ok\") throw new Error(\"TinyCloud rejected the approved delegation.\");\n }\n\n /\n Verify the OpenKey callback as a SIWE session for this tenant's key. The\n * WASM verifier binds the authorization bytes and CID to the signed SIWE, so\n * `node.did` is the wallet that signed exactly the delegation being stored.\n /\n async #restoreApproval(\n tenant: TenantProfile,\n data: Record<string, unknown>,\n ): Promise<{ node: TinyCloudNode; session: CallbackSession }> {\n const session = sessionFromCallback(data, tenant.jwk);\n const node = new TinyCloudNode({ host: this.#config.nodeHost });\n await node.restoreSession(session);\n if (!samePrincipal(node.sessionDid, tenant.sessionDid)) {\n throw new Error(\"The approved delegation targets a different session.\");\n }\n return { node, session };\n }\n\n async #ensureTenant(subject: string): Promise<TenantProfile> {\n const tenantId = this.#tenantId(subject);\n const current = this.#initializing.get(tenantId);\n if (current !== undefined) return current;\n const initializing = this.#initializeTenant(tenantId).finally(() => {\n this.#initializing.delete(tenantId);\n });\n this.#initializing.set(tenantId, initializing);\n return initializing;\n }\n\n async #hasValidSession(tenant: TenantProfile, ownerDids: readonly string[]): Promise<boolean> {\n const raw = await readJson<Record<string, unknown>>(this.#sessionPath(tenant.stateRoot));\n if (raw === null) return false;\n try {\n const node = new TinyCloudNode({ host: this.#config.nodeHost });\n await node.restoreSession(raw as unknown as TinyCloudSession);\n return samePrincipal(node.sessionDid, tenant.sessionDid) &&\n ownerDids.some((did) => samePrincipal(node.did, did));\n } catch {\n await rm(this.#sessionPath(tenant.stateRoot), { force: true });\n return false;\n }\n }\n\n async #initializeTenant(tenantId: string): Promise<TenantProfile> {\n const stateRoot = join(this.#config.stateDir, \"tenants\", tenantId);\n const keyPath = this.#keyPath(stateRoot);\n await secureDirectory(join(stateRoot, \".tinycloud\", \"profiles\", PROFILE));\n let jwk = await readJson<Record<string, unknown>>(keyPath);\n let sessionDid: string;\n if (jwk === null) {\n const generated = generateSessionKey();\n jwk = generated.jwk;\n sessionDid = generated.did;\n await secureWrite(keyPath, jwk);\n } else {\n sessionDid = didFromJwk(jwk);\n }\n const profilePath = this.#profilePath(stateRoot);\n if (!(await fileExists(profilePath))) {\n await secureWrite(profilePath, {\n name: PROFILE,\n host: this.#config.nodeHost,\n chainId: 1,\n spaceName: \"default\",\n did: sessionDid,\n sessionDid,\n createdAt: new Date().toISOString(),\n posture: \"delegate-session\",\n operatorType: \"agent\",\n authMethod: \"openkey\",\n openkeyHost: this.#config.openkeyHost,\n });\n }\n return { stateRoot, sessionDid, jwk };\n }\n\n async #readTenant(tenantId: string): Promise<TenantProfile> {\n if (!/^[a-f0-9]{64}$/.test(tenantId)) throw new Error(\"Approval state is invalid.\");\n const stateRoot = join(this.#config.stateDir, \"tenants\", tenantId);\n const jwk = await readJson<Record<string, unknown>>(this.#keyPath(stateRoot));\n if (jwk === null) throw new Error(\"The TinyCloud delegate no longer exists.\");\n return { stateRoot, jwk, sessionDid: didFromJwk(jwk) };\n }\n\n async #createPending(\n subject: string,\n ownerDids: readonly string[],\n kind: PendingApproval[\"kind\"],\n permissions: PermissionEntry[],\n requestId?: string,\n ): Promise<PendingApproval> {\n const tenant = await this.#ensureTenant(subject);\n const tenantId = this.#tenantId(subject);\n const reusable = await reusablePending(\n this.#pendingDirectory(tenant.stateRoot),\n { tenantId, kind, requestId, permissions, ownerDids: ownerDids.map(normalizeDid) },\n );\n if (reusable !== undefined) return reusable;\n const nonce = randomBytes(24).toString(\"base64url\");\n const created = Date.now();\n const pending: PendingApproval = {\n version: 1,\n nonce,\n tenantId,\n kind,\n ...(requestId === undefined ? {} : { requestId }),\n permissions,\n ownerDids: ownerDids.map(normalizeDid),\n createdAt: new Date(created).toISOString(),\n expiresAt: new Date(created + this.#config.approvalTtlSeconds 1000).toISOString(),\n };\n await secureWrite(this.#pendingPath(tenant.stateRoot, nonce), pending);\n return pending;\n }\n\n async #readPending(state: string, consume: boolean): Promise<PendingApproval> {\n const [tenantId, nonce, signature] = state.split(\".\");\n if (tenantId === undefined \|\| nonce === undefined \|\| signature === undefined) {\n throw new Error(\"Approval state is invalid.\");\n }\n const expected = this.#signState(tenantId, nonce);\n const supplied = Buffer.from(signature, \"base64url\");\n const expectedBytes = Buffer.from(expected, \"base64url\");\n if (supplied.length !== expectedBytes.length \|\| !timingSafeEqual(supplied, expectedBytes)) {\n throw new Error(\"Approval state is invalid.\");\n }\n const stateRoot = join(this.#config.stateDir, \"tenants\", tenantId);\n const path = this.#pendingPath(stateRoot, nonce);\n const claimed = `${path}.processing`;\n if (consume) await rename(path, claimed);\n try {\n const pending = await readJson<PendingApproval>(consume ? claimed : path);\n if (pending === null \|\| pending.version !== 1 \|\| pending.tenantId !== tenantId \|\| pending.nonce !== nonce) {\n throw new Error(\"Approval state is invalid or already used.\");\n }\n if (new Date(pending.expiresAt).getTime() <= Date.now()) {\n await rm(consume ? claimed : path, { force: true });\n throw new Error(\"Approval state has expired.\");\n }\n return pending;\n } catch (error) {\n if (consume) await rename(claimed, path).catch(() => undefined);\n throw error;\n }\n }\n\n async #restorePending(pending: PendingApproval): Promise<void> {\n const stateRoot = join(this.#config.stateDir, \"tenants\", pending.tenantId);\n const path = this.#pendingPath(stateRoot, pending.nonce);\n await rename(`${path}.processing`, path);\n }\n\n #connectUrl(pending: PendingApproval): string {\n const url = new URL(\"/connect\", this.#config.publicUrl);\n url.searchParams.set(\"state\", `${pending.tenantId}.${pending.nonce}.${this.#signState(pending.tenantId, pending.nonce)}`);\n return url.toString();\n }\n\n #tenantId(subject: string): string {\n return createHmac(\"sha256\", this.#config.stateSecret).update(`tenant:${subject}`).digest(\"hex\");\n }\n\n #signState(tenantId: string, nonce: string): string {\n return createHmac(\"sha256\", this.#config.stateSecret)\n .update(`approval:${tenantId}:${nonce}`)\n .digest(\"base64url\");\n }\n\n #profilePath(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"profile.json\");\n }\n\n #keyPath(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"key.json\");\n }\n\n #sessionPath(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"session.json\");\n }\n\n #pendingPath(stateRoot: string, nonce: string): string {\n return join(this.#pendingDirectory(stateRoot), `${nonce}.json`);\n }\n\n #pendingDirectory(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"pending\");\n }\n}\n\nlet wasmInitialized = false;\n\nfunction generateSessionKey(): { jwk: Record<string, unknown>; did: string } {\n ensureWasm();\n const manager = new TCWSessionManager();\n const keyId = manager.createSessionKey(\"hosted-mcp\");\n const serialized = manager.jwk(keyId);\n if (!serialized) throw new Error(\"Could not generate the hosted delegate key.\");\n return { jwk: JSON.parse(serialized) as Record<string, unknown>, did: manager.getDID(keyId) };\n}\n\nfunction didFromJwk(jwk: Record<string, unknown>): string {\n ensureWasm();\n const manager = new TCWSessionManager();\n const keyId = importKey(manager, JSON.stringify(jwk), \"hosted-mcp\");\n return manager.getDID(keyId);\n}\n\nfunction ensureWasm(): void {\n if (wasmInitialized) return;\n initPanicHook();\n wasmInitialized = true;\n}\n\nfunction sessionFromCallback(data: Record<string, unknown>, privateJwk: Record<string, unknown>): CallbackSession {\n const delegationHeader = data.delegationHeader;\n if (!isRecord(delegationHeader) \|\| typeof delegationHeader.Authorization !== \"string\" \|\|\n typeof data.delegationCid !== \"string\" \|\| typeof data.spaceId !== \"string\" \|\|\n typeof data.verificationMethod !== \"string\") {\n throw new Error(\"OpenKey returned an incomplete delegation.\");\n }\n return {\n delegationHeader: { Authorization: delegationHeader.Authorization },\n delegationCid: data.delegationCid,\n spaceId: data.spaceId,\n jwk: privateJwk,\n verificationMethod: data.verificationMethod,\n ...(typeof data.address === \"string\" ? { address: data.address } : {}),\n ...(typeof data.chainId === \"number\" ? { chainId: data.chainId } : {}),\n ...(typeof data.siwe === \"string\" ? { siwe: data.siwe } : {}),\n ...(typeof data.signature === \"string\" ? { signature: data.signature } : {}),\n };\n}\n\nfunction portableFromCallback(\n data: Record<string, unknown>,\n permissions: PermissionEntry[],\n host: string,\n): PortableDelegation {\n const primary = permissions.find((permission) => permission.service !== \"tinycloud.encryption\") ?? permissions[0];\n if (primary === undefined) throw new Error(\"The authority request has no permissions.\");\n const session = sessionFromCallback(data, {});\n const expiry = delegationExpiry(data);\n return {\n cid: session.delegationCid,\n delegationHeader: session.delegationHeader,\n spaceId: session.spaceId,\n path: primary.path,\n actions: [...primary.actions],\n resources: permissions.map((permission) => ({\n service: permission.service.startsWith(\"tinycloud.\")\n ? permission.service.slice(\"tinycloud.\".length)\n : permission.service,\n space: permission.service === \"tinycloud.encryption\"\n ? requiredPermissionSpace(permission)\n : session.spaceId,\n path: permission.path,\n actions: [...permission.actions],\n })),\n expiry,\n delegateDID: session.verificationMethod,\n ownerAddress: typeof data.address === \"string\" ? data.address : \"\",\n chainId: typeof data.chainId === \"number\" ? data.chainId : 1,\n host,\n };\n}\n\nfunction delegationExpiry(data: Record<string, unknown>): Date {\n for (const key of [\"expiry\", \"expiresAt\", \"expirationTime\"]) {\n const parsed = parseDate(data[key]);\n if (parsed !== undefined) return parsed;\n }\n if (typeof data.siwe === \"string\") {\n const match = data.siwe.match(/^Expiration Time:\\s(.+)$/im);\n const parsed = parseDate(match?.[1]?.trim());\n if (parsed !== undefined) return parsed;\n }\n throw new Error(\"OpenKey did not return a delegation expiry.\");\n}\n\nfunction permissionsCover(requested: PermissionEntry[], granted: PermissionEntry[]): boolean {\n return requested.every((request) => granted.some((grant) =>\n normalizeService(grant.service) === normalizeService(request.service) &&\n typeof grant.space === \"string\" && typeof request.space === \"string\" &&\n sameSpace(grant.space, request.space) &&\n grant.path === request.path &&\n request.actions.every((action) => grant.actions.includes(action))\n ));\n}\n\nfunction sameSpace(granted: string, requested: string): boolean {\n return granted === requested \|\| granted.endsWith(`:${requested}`);\n}\n\nfunction normalizeService(service: string): string {\n return service.startsWith(\"tinycloud.\") ? service : `tinycloud.${service}`;\n}\n\nfunction requiredPermissionSpace(permission: PermissionEntry): string {\n if (typeof permission.space !== \"string\") throw new Error(\"The authority request has no space.\");\n return permission.space;\n}\n\nfunction publicJwk(jwk: Record<string, unknown>): Record<string, unknown> {\n const copy = { ...jwk };\n for (const field of [\"d\", \"p\", \"q\", \"dp\", \"dq\", \"qi\", \"oth\", \"k\"]) delete copy[field];\n return copy;\n}\n\nfunction samePrincipal(left: string \| undefined, right: string): boolean {\n if (typeof left !== \"string\") return false;\n try {\n return principalDidEquals(left, right);\n } catch {\n return false;\n }\n}\n\nfunction normalizeDid(value: string): string {\n return value.split(\"#\", 1)[0]!;\n}\n\nfunction isPermissionEntry(value: unknown): value is PermissionEntry {\n return isRecord(value) && typeof value.service === \"string\" && typeof value.space === \"string\" &&\n typeof value.path === \"string\" && Array.isArray(value.actions) &&\n value.actions.every((action) => typeof action === \"string\");\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseDate(value: unknown): Date \| undefined {\n if (typeof value !== \"string\" && typeof value !== \"number\") return undefined;\n const date = new Date(typeof value === \"number\" && value < 10_000_000_000 ? value 1000 : value);\n return Number.isNaN(date.getTime()) ? undefined : date;\n}\n\nasync function secureDirectory(path: string): Promise<void> {\n await mkdir(path, { recursive: true, mode: 0o700 });\n await chmod(path, 0o700);\n}\n\nasync function secureWrite(path: string, value: unknown): Promise<void> {\n const directory = dirname(path);\n await secureDirectory(directory);\n const temporary = `${path}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`;\n await writeFile(temporary, `${JSON.stringify(value, jsonReplacer, 2)}\\n`, { mode: 0o600 });\n await rename(temporary, path);\n await chmod(path, 0o600);\n}\n\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n return value instanceof Date ? value.toISOString() : value;\n}\n\nasync function readJson<T>(path: string): Promise<T \| null> {\n try {\n return JSON.parse(await readFile(path, \"utf8\")) as T;\n } catch (error) {\n if (isRecord(error) && error.code === \"ENOENT\") return null;\n throw error;\n }\n}\n\nasync function fileExists(path: string): Promise<boolean> {\n return (await readJson<unknown>(path)) !== null;\n}\n\nasync function reusablePending(\n directory: string,\n expected: Pick<PendingApproval, \"tenantId\" \| \"kind\" \| \"requestId\" \| \"permissions\" \| \"ownerDids\">,\n): Promise<PendingApproval \| undefined> {\n let names: string[];\n try {\n names = await readdir(directory);\n } catch (error) {\n if (isRecord(error) && error.code === \"ENOENT\") return undefined;\n throw error;\n }\n const active: PendingApproval[] = [];\n for (const name of names) {\n if (!name.endsWith(\".json\")) continue;\n const path = join(directory, name);\n const pending = await readJson<PendingApproval>(path).catch(() => null);\n if (pending === null \|\| new Date(pending.expiresAt).getTime() <= Date.now()) {\n await rm(path, { force: true });\n continue;\n }\n active.push(pending);\n if (samePendingRequest(pending, expected)) return pending;\n }\n if (active.length >= 64) {\n active.sort((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt));\n await rm(join(directory, `${active[0]!.nonce}.json`), { force: true });\n }\n return undefined;\n}\n\nfunction samePendingRequest(\n pending: PendingApproval,\n expected: Pick<PendingApproval, \"tenantId\" \| \"kind\" \| \"requestId\" \| \"permissions\" \| \"ownerDids\">,\n): boolean {\n return pending.version === 1 && pending.tenantId === expected.tenantId &&\n pending.kind === expected.kind && pending.requestId === expected.requestId &&\n JSON.stringify(pending.permissions) === JSON.stringify(expected.permissions) &&\n JSON.stringify(pending.ownerDids) === JSON.stringify(expected.ownerDids);\n}\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\nexport function createTinyCloudMcpServer(selection: McpStartupSelection): McpServer {\n const validator = createJsonSchemaValidator();\n const server = new McpServer(\n { name: MCP_SERVER_NAME, version: MCP_VERSION },\n { jsonSchemaValidator: validator },\n );\n registerTinyCloudTools(server, selection, validator);\n return server;\n}\n\n/** Start the only supported MCP transport: local stdio. /\nexport function serveTinyCloudMcp(selection: McpStartupSelection): StdioServerHandle {\n return serveStdio(\n () => createTinyCloudMcpServer(selection),\n { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\n\nexport const TOOL_NAMES = [\n \"tinycloud_status\",\n \"tinycloud_auth_status\",\n \"tinycloud_auth_capabilities\",\n \"tinycloud_auth_request\",\n \"tinycloud_auth_import\",\n \"tinycloud_account_spaces_list\",\n \"tinycloud_account_applications_list\",\n \"tinycloud_kv_list\",\n \"tinycloud_kv_get\",\n \"tinycloud_kv_head\",\n \"tinycloud_kv_put\",\n \"tinycloud_kv_delete\",\n \"tinycloud_sql_schema_inspect\",\n \"tinycloud_sql_query\",\n \"tinycloud_sql_execute\",\n \"tinycloud_secrets_get\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\nexport interface McpStartupSelection {\n readonly profile: string;\n readonly explicitProfile: boolean;\n readonly allowOwnerProfile: boolean;\n /* Absolute TinyCloud home used to isolate one hosted OAuth principal. /\n readonly stateRoot?: string;\n /* Hosted transports may attach a browser approval URL to canonical results. /\n readonly transformOperationResult?: (result: unknown) => Promise<unknown>;\n}\n\nexport interface McpInvocationTarget {\n readonly profile: string;\n readonly allowOwnerProfile?: true;\n readonly stateRoot?: string;\n}\n\n/* Project one startup selection into the only owner-sensitive target shape. /\nexport function invocationTargetForMcp(\n selection: McpStartupSelection,\n): McpInvocationTarget {\n return {\n profile: selection.profile,\n ...(selection.explicitProfile && selection.allowOwnerProfile\n ? { allowOwnerProfile: true }\n : {}),\n ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n };\n}\n\ninterface CatalogOperation {\n readonly id: string;\n readonly version: number;\n readonly title: string;\n readonly description: string;\n readonly input: Record<string, unknown>;\n readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\n\ninterface ToolBinding {\n readonly name: ToolName;\n readonly operationId: string;\n readonly operationVersion: number;\n readonly readOnlyHint: boolean;\n readonly idempotentHint: boolean;\n readonly destructiveHint: boolean;\n readonly openWorldHint: boolean;\n}\n\nconst TOOL_BINDINGS: readonly ToolBinding[] = [\n {\n name: \"tinycloud_status\",\n operationId: \"tinycloud.status.get\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_status\",\n operationId: \"tinycloud.auth.status\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_capabilities\",\n operationId: \"tinycloud.auth.capabilities\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_request\",\n operationId: \"tinycloud.auth.request\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_import\",\n operationId: \"tinycloud.auth.import\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_account_spaces_list\",\n operationId: \"tinycloud.account.spaces.list\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_account_applications_list\",\n operationId: \"tinycloud.account.applications.list\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_list\",\n operationId: \"tinycloud.kv.list\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_get\",\n operationId: \"tinycloud.kv.get\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_head\",\n operationId: \"tinycloud.kv.head\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_put\",\n operationId: \"tinycloud.kv.put\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: true,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_delete\",\n operationId: \"tinycloud.kv.delete\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: true,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_sql_schema_inspect\",\n operationId: \"tinycloud.sql.schema.inspect\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_sql_query\",\n operationId: \"tinycloud.sql.query\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_sql_execute\",\n operationId: \"tinycloud.sql.execute\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: false,\n destructiveHint: true,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_secrets_get\",\n operationId: \"tinycloud.secrets.get\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n const ajv = new Ajv({ strict: false });\n addFormats(ajv);\n return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n server: McpServer,\n selection: McpStartupSelection,\n validator: AjvJsonSchemaValidator,\n): void {\n const definitions = new Map(\n generatedCatalog.operations.map((operation) => [\n `${operation.id}@${operation.version}`,\n operation,\n ]),\n );\n\n for (const binding of TOOL_BINDINGS) {\n const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n if (operation === undefined) {\n throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n }\n\n const inputSchema = fromJsonSchema(\n operation.input as Parameters<typeof fromJsonSchema>[0],\n validator,\n );\n const outputSchema = fromJsonSchema(\n operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n validator,\n );\n const annotations: ToolAnnotations = {\n readOnlyHint: binding.readOnlyHint,\n idempotentHint: binding.idempotentHint,\n destructiveHint: binding.destructiveHint,\n openWorldHint: binding.openWorldHint,\n };\n\n server.registerTool(\n binding.name,\n {\n title: operation.title,\n description: operation.description,\n inputSchema,\n outputSchema,\n annotations,\n },\n async (input: unknown): Promise<McpToolResult> => {\n const result = await invokeOperation(\n binding.operationId,\n binding.operationVersion,\n invocationTargetForMcp(selection),\n input,\n );\n const projected = selection.transformOperationResult === undefined\n ? result\n : await selection.transformOperationResult(result);\n return toMcpToolResult(projected);\n },\n );\n }\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n return TOOL_BINDINGS;\n}\n","/\n MCP has one structured result channel for a TinyCloud operation. Text is a\n * fixed, non-sensitive status line; it never serializes the operation result.\n /\nexport interface CanonicalOperationResult {\n readonly status: \"ok\" \| \"authority_required\" \| \"setup_required\" \| \"error\";\n readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n readonly content: [{ readonly type: \"text\"; readonly text: string }];\n readonly structuredContent: CanonicalOperationResult;\n}\n\nexport function toMcpToolResult(result: unknown): McpToolResult {\n const canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n ? result\n : {\n status: \"error\",\n operation: {},\n context: {},\n error: { code: \"INTERNAL_ERROR\" },\n };\n\n return {\n content: [{ type: \"text\", text: resultSummary(canonical.status) }],\n structuredContent: canonical,\n };\n}\n\n/* The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n if (value === null \|\| typeof value !== \"object\" \|\| Array.isArray(value)) return false;\n const status = (value as { status?: unknown }).status;\n return status === \"ok\" \|\|\n status === \"authority_required\" \|\|\n status === \"setup_required\" \|\|\n status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n switch (status) {\n case \"ok\":\n return \"TinyCloud operation completed; use the structured result.\";\n case \"authority_required\":\n return \"TinyCloud authority is required; use the structured request and approval action.\";\n case \"setup_required\":\n return \"TinyCloud setup is required; use the structured setup action.\";\n case \"error\":\n return \"TinyCloud operation failed; use the structured error.\";\n }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","{\n \"name\": \"@tinycloud/mcp\",\n \"version\": \"0.3.4-beta.4\",\n \"description\": \"TinyCloud delegated operations MCP server\",\n \"keywords\": [\n \"tinycloud\",\n \"mcp\",\n \"model-context-protocol\",\n \"agents\",\n \"delegation\",\n \"ucan\",\n \"kv\",\n \"sqlite\"\n ],\n \"author\": \"TinyCloud, Inc.\",\n \"license\": \"EGPL\",\n \"type\": \"module\",\n \"main\": \"dist/index.cjs\",\n \"module\": \"dist/index.js\",\n \"types\": \"dist/index.d.ts\",\n \"bin\": {\n \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n },\n \"exports\": {\n \".\": {\n \"types\": \"./dist/index.d.ts\",\n \"import\": \"./dist/index.js\",\n \"require\": \"./dist/index.cjs\"\n },\n \"./server\": {\n \"types\": \"./dist/server.d.ts\",\n \"import\": \"./dist/server.js\",\n \"require\": \"./dist/server.cjs\"\n },\n \"./tools\": {\n \"types\": \"./dist/tools.d.ts\",\n \"import\": \"./dist/tools.js\",\n \"require\": \"./dist/tools.cjs\"\n },\n \"./results\": {\n \"types\": \"./dist/results.d.ts\",\n \"import\": \"./dist/results.js\",\n \"require\": \"./dist/results.cjs\"\n },\n \"./http\": {\n \"types\": \"./dist/http.d.ts\",\n \"import\": \"./dist/http.js\",\n \"require\": \"./dist/http.cjs\"\n }\n },\n \"files\": [\n \"dist\",\n \"bin\",\n \"generated\",\n \"skills\"\n ],\n \"engines\": {\n \"node\": \">=20\"\n },\n \"scripts\": {\n \"build\": \"tsup\",\n \"clean\": \"rm -rf dist\",\n \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n \"typecheck\": \"tsc -p tsconfig.json\",\n \"start:http\": \"node dist/http-cli.js\",\n \"generate\": \"bun scripts/generate.ts\",\n \"check:generated\": \"bun scripts/generate.ts --check\"\n },\n \"dependencies\": {\n \"@modelcontextprotocol/node\": \"2.0.0-beta.4\",\n \"@modelcontextprotocol/server\": \"2.0.0-beta.4\",\n \"@tinycloud/node-sdk\": \"3.1.0-beta.2\",\n \"@tinycloud/node-sdk-wasm\": \"1.7.6\",\n \"@tinycloud/operations\": \"0.3.4-beta.4\",\n \"jose\": \"6.1.3\"\n },\n \"devDependencies\": {\n \"@modelcontextprotocol/client\": \"2.0.0-beta.4\",\n \"@types/node\": \"^20\",\n \"tsup\": \"^8.0.0\",\n \"typescript\": \"^5.9.3\"\n },\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n },\n \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,YAAY,eAAe;AAEpC,SAAS,qBAAqB;;;ACH9B;AAAA,EACE,aAAAA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACVP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,oBAAoB,QAAQ,iBAAkC;AAEvE,IAAM,mBAAmB;AASlB,SAAS,2BAA2B,QAAgD;AACzF,QAAM,OAAO,mBAAmB,IAAI,IAAI,OAAO,OAAO,CAAC;AACvD,SAAO;AAAA,IACL,MAAM,kBAAkB,OAAkC;AACxD,UAAI;AACF,cAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,UAC/C,QAAQ,OAAO;AAAA,UACf,UAAU,OAAO;AAAA,QACnB,CAAC;AACD,eAAO,SAAS,OAAO,SAAS,MAAM;AAAA,MACxC,SAAS,OAAO;AACd,YAAI,iBAAiB,OAAO,WAAW;AACrC,gBAAM,IAAI,WAAW,eAAe,cAAc,sCAAsC;AAAA,QAC1F;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,kBAAkB,aAA0C;AAChF,QAAM,WAAW,MAAM,MAAM,aAAa;AAAA,IACxC,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACtC,QAAQ,YAAY,QAAQ,GAAM;AAAA,EACpC,CAAC;AACD,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,iCAAiC;AACnE,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,MAAI,OAAO,SAAS,WAAW,YAAY,OAAO,SAAS,aAAa,UAAU;AAChF,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,SACP,OACA,SACA,QACU;AACV,MAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,WAAW,GAAG;AAC/D,UAAM,IAAI,WAAW,eAAe,cAAc,uDAAuD;AAAA,EAC3G;AACA,MAAI,OAAO,QAAQ,QAAQ,UAAU;AACnC,UAAM,IAAI,WAAW,eAAe,cAAc,yCAAyC;AAAA,EAC7F;AACA,QAAM,SAAS,OAAO,QAAQ,UAAU,WACpC,QAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,IACzC,CAAC;AACL,MAAI,OAAO,kBAAkB,UAAa,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG;AAChF,UAAM,IAAI;AAAA,MACR,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,YAAY,QAAQ,KAAK,QAAQ,SAAS,KAAK;AAChE,QAAM,YAAY,MAAM,QAAQ,QAAQ,gBAAgB,CAAC,IACrD,QAAQ,gBAAgB,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACtF,CAAC;AACL,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,UAAU,IAAI,IAAI,OAAO,QAAQ;AAAA,IACjC,OAAO;AAAA,MACL,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAuC;AAC7D,SAAO,OAAO,KAAK,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAC9F;;;AChGA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,OAAO,OAAO,UAAU,SAAS,QAAQ,IAAI,iBAAiB;AACvE,SAAS,SAAS,YAAY;AAE9B;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,mBAAmB,WAAW,qBAAqB;AAC5D,SAAS,uBAAuB;AAEhC,IAAM,UAAU;AAChB,IAAM,qBAAqB,MAAM;AACjC,IAAM,wBAA2C;AAAA,EAC/C;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,oBAAoB,mBAAmB;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,oBAAoB,mBAAmB;AAAA,EACnD;AACF;AAqDO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,cAAc;AACZ,UAAM,sGAAsG;AAC5G,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,MAAwB;AAAA,EACpB;AAAA,EACA,gBAAgB,oBAAI,IAAoC;AAAA,EAEjE,YAAY,QAA2B;AACrC,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,gBAAgB,SAAyB;AACvC,WAAO,KAAK,KAAK,QAAQ,UAAU,WAAW,KAAK,UAAU,OAAO,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,cAAc,SAAiB,YAA+B,CAAC,GAA2B;AAC9F,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,QAAI,MAAM,KAAK,iBAAiB,QAAQ,SAAS,GAAG;AAClD,aAAO,EAAE,WAAW,MAAM,YAAY,OAAO,WAAW;AAAA,IAC1D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,SAAS,WAAW,aAAa,qBAAqB;AAChG,WAAO;AAAA,MACL,WAAW;AAAA,MACX,YAAY,OAAO;AAAA,MACnB,aAAa,KAAK,YAAY,OAAO;AAAA,MACrC,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,wBACJ,SACA,WACA,QACkB;AAClB,QAAI,CAAC,SAAS,MAAM,KAAK,OAAO,WAAW,qBAAsB,QAAO;AACxE,UAAM,UAAU,SAAS,OAAO,OAAO,IAAI,OAAO,UAAU;AAC5D,UAAM,YAAY,OAAO,SAAS,cAAc,WAAW,QAAQ,YAAY;AAC/E,UAAM,YAAY,MAAM,QAAQ,SAAS,SAAS,IAC9C,QAAQ,UAAU,OAAO,iBAAiB,IAC1C,CAAC;AACL,QAAI,cAAc,UAAa,UAAU,WAAW,EAAG,QAAO;AAC9D,UAAM,UAAU,MAAM,KAAK,eAAe,SAAS,WAAW,cAAc,WAAW,SAAS;AAChG,WAAO;AAAA,MACL,GAAG;AAAA,MACH,UAAU;AAAA,QACR,GAAI,SAAS,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AAAA,QACnD,MAAM;AAAA,QACN;AAAA,QACA,KAAK,KAAK,YAAY,OAAO;AAAA,QAC7B,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,OAAgC;AACrD,UAAM,UAAU,MAAM,KAAK,aAAa,OAAO,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ;AACtD,UAAM,WAAW,IAAI,IAAI,qBAAqB,KAAK,QAAQ,SAAS;AACpE,aAAS,aAAa,IAAI,SAAS,KAAK;AACxC,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,KAAK,OAAO;AAAA,MACZ,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,KAAK,QAAQ;AAAA,MACnB,KAAK,OAAO,KAAK,KAAK,UAAU,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,SAAS,WAAW;AAAA,MAC5E,aAAa,OAAO,KAAK,KAAK,UAAU;AAAA,QACtC,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,UACN,QAAQ,SAAS,cACb,+DACA;AAAA;AAAA;AAAA,UAGJ,GAAI,QAAQ,UAAU,WAAW,IAC7B,CAAC,IACD,CAAC,kCAAkC,QAAQ,UAAU,KAAK,IAAI,CAAC,gCAAgC;AAAA,QACrG,EAAE,KAAK,GAAG;AAAA,MACZ,CAAC,CAAC,EAAE,SAAS,WAAW;AAAA,MACxB,QAAQ,KAAK,QAAQ;AAAA,IACvB,CAAC;AACD,WAAO,GAAG,KAAK,QAAQ,YAAY,QAAQ,QAAQ,EAAE,CAAC,aAAa,OAAO,SAAS,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,iBAAiB,OAAe,SAAiC;AACrE,UAAM,SAAS,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AAClE,QAAI,OAAO,SAAS,MAAM,KAAK,SAAS,mBAAoB,OAAM,IAAI,MAAM,6BAA6B;AACzG,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAI,OAAO,WAAW,IAAI,IAAI,mBAAoB,OAAM,IAAI,MAAM,6BAA6B;AAC/F,UAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,QAAI,CAAC,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,2BAA2B;AAEhE,UAAM,UAAU,MAAM,KAAK,aAAa,OAAO,IAAI;AACnD,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ;AACtD,UAAI,QAAQ,SAAS,aAAa;AAChC,cAAM,KAAK,gBAAgB,QAAQ,SAAS,IAAI;AAAA,MAClD,OAAO;AACL,cAAM,KAAK,iBAAiB,QAAQ,SAAS,IAAI;AAAA,MACnD;AACA,YAAM,GAAG,KAAK,aAAa,OAAO,WAAW,QAAQ,KAAK,IAAI,eAAe,EAAE,OAAO,KAAK,CAAC;AAAA,IAC9F,SAAS,OAAO;AACd,YAAM,KAAK,gBAAgB,OAAO,EAAE,MAAM,MAAM,MAAS;AACzD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QACA,SACA,MACe;AACf,UAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,KAAK,iBAAiB,QAAQ,IAAI;AAClE,QAAI,QAAQ,UAAU,SAAS,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,cAAc,KAAK,KAAK,GAAG,CAAC,GAAG;AAClG,YAAM,IAAI,2BAA2B;AAAA,IACvC;AACA,UAAM,UAAU,CAAC,GAAG,KAAK,+BAA+B,CAAC;AACzD,QAAI,CAAC,iBAAiB,QAAQ,aAAa,OAAO,GAAG;AACnD,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,UAAM,UAAU,MAAM,SAAkC,KAAK,aAAa,OAAO,SAAS,CAAC;AAC3F,UAAM,YAAY,KAAK,aAAa,OAAO,SAAS,GAAG;AAAA,MACrD,GAAG;AAAA,MACH,UAAU,aAAa,KAAK,GAAG;AAAA,MAC/B,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,YAAY,KAAK,aAAa,OAAO,SAAS,GAAG;AAAA,MACrD,YAAY;AAAA,MACZ,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,iBACJ,QACA,SACA,MACe;AACf,QAAI,QAAQ,cAAc,OAAW,OAAM,IAAI,MAAM,+BAA+B;AAGpF,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,iBAAiB,QAAQ,IAAI;AACzD,QAAI,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,cAAc,KAAK,KAAK,GAAG,CAAC,EAAG,OAAM,IAAI,2BAA2B;AACzG,UAAM,aAAa,qBAAqB,MAAM,QAAQ,aAAa,KAAK,QAAQ,QAAQ;AACxF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,SAAS,SAAS,WAAW,OAAO,UAAU;AAAA,MAChD;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,eAAe,WAAW;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,WAAW,KAAM,OAAM,IAAI,MAAM,6CAA6C;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBACJ,QACA,MAC4D;AAC5D,UAAM,UAAU,oBAAoB,MAAM,OAAO,GAAG;AACpD,UAAM,OAAO,IAAI,cAAc,EAAE,MAAM,KAAK,QAAQ,SAAS,CAAC;AAC9D,UAAM,KAAK,eAAe,OAAO;AACjC,QAAI,CAAC,cAAc,KAAK,YAAY,OAAO,UAAU,GAAG;AACtD,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,cAAc,SAAyC;AAC3D,UAAM,WAAW,KAAK,UAAU,OAAO;AACvC,UAAM,UAAU,KAAK,cAAc,IAAI,QAAQ;AAC/C,QAAI,YAAY,OAAW,QAAO;AAClC,UAAM,eAAe,KAAK,kBAAkB,QAAQ,EAAE,QAAQ,MAAM;AAClE,WAAK,cAAc,OAAO,QAAQ;AAAA,IACpC,CAAC;AACD,SAAK,cAAc,IAAI,UAAU,YAAY;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAiB,QAAuB,WAAgD;AAC5F,UAAM,MAAM,MAAM,SAAkC,KAAK,aAAa,OAAO,SAAS,CAAC;AACvF,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI;AACF,YAAM,OAAO,IAAI,cAAc,EAAE,MAAM,KAAK,QAAQ,SAAS,CAAC;AAC9D,YAAM,KAAK,eAAe,GAAkC;AAC5D,aAAO,cAAc,KAAK,YAAY,OAAO,UAAU,KACrD,UAAU,KAAK,CAAC,QAAQ,cAAc,KAAK,KAAK,GAAG,CAAC;AAAA,IACxD,QAAQ;AACN,YAAM,GAAG,KAAK,aAAa,OAAO,SAAS,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,UAA0C;AAChE,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ;AACjE,UAAM,UAAU,KAAK,SAAS,SAAS;AACvC,UAAM,gBAAgB,KAAK,WAAW,cAAc,YAAY,OAAO,CAAC;AACxE,QAAI,MAAM,MAAM,SAAkC,OAAO;AACzD,QAAI;AACJ,QAAI,QAAQ,MAAM;AAChB,YAAM,YAAY,mBAAmB;AACrC,YAAM,UAAU;AAChB,mBAAa,UAAU;AACvB,YAAM,YAAY,SAAS,GAAG;AAAA,IAChC,OAAO;AACL,mBAAa,WAAW,GAAG;AAAA,IAC7B;AACA,UAAM,cAAc,KAAK,aAAa,SAAS;AAC/C,QAAI,CAAE,MAAM,WAAW,WAAW,GAAI;AACpC,YAAM,YAAY,aAAa;AAAA,QAC7B,MAAM;AAAA,QACN,MAAM,KAAK,QAAQ;AAAA,QACnB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,KAAK;AAAA,QACL;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,SAAS;AAAA,QACT,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa,KAAK,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AACA,WAAO,EAAE,WAAW,YAAY,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,YAAY,UAA0C;AAC1D,QAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,4BAA4B;AAClF,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ;AACjE,UAAM,MAAM,MAAM,SAAkC,KAAK,SAAS,SAAS,CAAC;AAC5E,QAAI,QAAQ,KAAM,OAAM,IAAI,MAAM,0CAA0C;AAC5E,WAAO,EAAE,WAAW,KAAK,YAAY,WAAW,GAAG,EAAE;AAAA,EACvD;AAAA,EAEA,MAAM,eACJ,SACA,WACA,MACA,aACA,WAC0B;AAC1B,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,UAAM,WAAW,KAAK,UAAU,OAAO;AACvC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK,kBAAkB,OAAO,SAAS;AAAA,MACvC,EAAE,UAAU,MAAM,WAAW,aAAa,WAAW,UAAU,IAAI,YAAY,EAAE;AAAA,IACnF;AACA,QAAI,aAAa,OAAW,QAAO;AACnC,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAClD,UAAM,UAAU,KAAK,IAAI;AACzB,UAAM,UAA2B;AAAA,MAC/B,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C;AAAA,MACA,WAAW,UAAU,IAAI,YAAY;AAAA,MACrC,WAAW,IAAI,KAAK,OAAO,EAAE,YAAY;AAAA,MACzC,WAAW,IAAI,KAAK,UAAU,KAAK,QAAQ,qBAAqB,GAAI,EAAE,YAAY;AAAA,IACpF;AACA,UAAM,YAAY,KAAK,aAAa,OAAO,WAAW,KAAK,GAAG,OAAO;AACrE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,OAAe,SAA4C;AAC5E,UAAM,CAAC,UAAU,OAAO,SAAS,IAAI,MAAM,MAAM,GAAG;AACpD,QAAI,aAAa,UAAa,UAAU,UAAa,cAAc,QAAW;AAC5E,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,UAAM,WAAW,KAAK,WAAW,UAAU,KAAK;AAChD,UAAM,WAAW,OAAO,KAAK,WAAW,WAAW;AACnD,UAAM,gBAAgB,OAAO,KAAK,UAAU,WAAW;AACvD,QAAI,SAAS,WAAW,cAAc,UAAU,CAAC,gBAAgB,UAAU,aAAa,GAAG;AACzF,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ;AACjE,UAAM,OAAO,KAAK,aAAa,WAAW,KAAK;AAC/C,UAAM,UAAU,GAAG,IAAI;AACvB,QAAI,QAAS,OAAM,OAAO,MAAM,OAAO;AACvC,QAAI;AACF,YAAM,UAAU,MAAM,SAA0B,UAAU,UAAU,IAAI;AACxE,UAAI,YAAY,QAAQ,QAAQ,YAAY,KAAK,QAAQ,aAAa,YAAY,QAAQ,UAAU,OAAO;AACzG,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAC9D;AACA,UAAI,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,GAAG;AACvD,cAAM,GAAG,UAAU,UAAU,MAAM,EAAE,OAAO,KAAK,CAAC;AAClD,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,QAAS,OAAM,OAAO,SAAS,IAAI,EAAE,MAAM,MAAM,MAAS;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAyC;AAC7D,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AACzE,UAAM,OAAO,KAAK,aAAa,WAAW,QAAQ,KAAK;AACvD,UAAM,OAAO,GAAG,IAAI,eAAe,IAAI;AAAA,EACzC;AAAA,EAEA,YAAY,SAAkC;AAC5C,UAAM,MAAM,IAAI,IAAI,YAAY,KAAK,QAAQ,SAAS;AACtD,QAAI,aAAa,IAAI,SAAS,GAAG,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,KAAK,WAAW,QAAQ,UAAU,QAAQ,KAAK,CAAC,EAAE;AACxH,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA,EAEA,UAAU,SAAyB;AACjC,WAAO,WAAW,UAAU,KAAK,QAAQ,WAAW,EAAE,OAAO,UAAU,OAAO,EAAE,EAAE,OAAO,KAAK;AAAA,EAChG;AAAA,EAEA,WAAW,UAAkB,OAAuB;AAClD,WAAO,WAAW,UAAU,KAAK,QAAQ,WAAW,EACjD,OAAO,YAAY,QAAQ,IAAI,KAAK,EAAE,EACtC,OAAO,WAAW;AAAA,EACvB;AAAA,EAEA,aAAa,WAA2B;AACtC,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,cAAc;AAAA,EAC1E;AAAA,EAEA,SAAS,WAA2B;AAClC,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,UAAU;AAAA,EACtE;AAAA,EAEA,aAAa,WAA2B;AACtC,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,cAAc;AAAA,EAC1E;AAAA,EAEA,aAAa,WAAmB,OAAuB;AACrD,WAAO,KAAK,KAAK,kBAAkB,SAAS,GAAG,GAAG,KAAK,OAAO;AAAA,EAChE;AAAA,EAEA,kBAAkB,WAA2B;AAC3C,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,SAAS;AAAA,EACrE;AACF;AAEA,IAAI,kBAAkB;AAEtB,SAAS,qBAAoE;AAC3E,aAAW;AACX,QAAM,UAAU,IAAI,kBAAkB;AACtC,QAAM,QAAQ,QAAQ,iBAAiB,YAAY;AACnD,QAAM,aAAa,QAAQ,IAAI,KAAK;AACpC,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,6CAA6C;AAC9E,SAAO,EAAE,KAAK,KAAK,MAAM,UAAU,GAA8B,KAAK,QAAQ,OAAO,KAAK,EAAE;AAC9F;AAEA,SAAS,WAAW,KAAsC;AACxD,aAAW;AACX,QAAM,UAAU,IAAI,kBAAkB;AACtC,QAAM,QAAQ,UAAU,SAAS,KAAK,UAAU,GAAG,GAAG,YAAY;AAClE,SAAO,QAAQ,OAAO,KAAK;AAC7B;AAEA,SAAS,aAAmB;AAC1B,MAAI,gBAAiB;AACrB,gBAAc;AACd,oBAAkB;AACpB;AAEA,SAAS,oBAAoB,MAA+B,YAAsD;AAChH,QAAM,mBAAmB,KAAK;AAC9B,MAAI,CAAC,SAAS,gBAAgB,KAAK,OAAO,iBAAiB,kBAAkB,YAC3E,OAAO,KAAK,kBAAkB,YAAY,OAAO,KAAK,YAAY,YAClE,OAAO,KAAK,uBAAuB,UAAU;AAC7C,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,kBAAkB,EAAE,eAAe,iBAAiB,cAAc;AAAA,IAClE,eAAe,KAAK;AAAA,IACpB,SAAS,KAAK;AAAA,IACd,KAAK;AAAA,IACL,oBAAoB,KAAK;AAAA,IACzB,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IACpE,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IACpE,GAAI,OAAO,KAAK,SAAS,WAAW,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IAC3D,GAAI,OAAO,KAAK,cAAc,WAAW,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,EAC5E;AACF;AAEA,SAAS,qBACP,MACA,aACA,MACoB;AACpB,QAAM,UAAU,YAAY,KAAK,CAAC,eAAe,WAAW,YAAY,sBAAsB,KAAK,YAAY,CAAC;AAChH,MAAI,YAAY,OAAW,OAAM,IAAI,MAAM,2CAA2C;AACtF,QAAM,UAAU,oBAAoB,MAAM,CAAC,CAAC;AAC5C,QAAM,SAAS,iBAAiB,IAAI;AACpC,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,kBAAkB,QAAQ;AAAA,IAC1B,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ;AAAA,IACd,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,IAC5B,WAAW,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC1C,SAAS,WAAW,QAAQ,WAAW,YAAY,IAC/C,WAAW,QAAQ,MAAM,aAAa,MAAM,IAC5C,WAAW;AAAA,MACf,OAAO,WAAW,YAAY,yBAC1B,wBAAwB,UAAU,IAClC,QAAQ;AAAA,MACZ,MAAM,WAAW;AAAA,MACjB,SAAS,CAAC,GAAG,WAAW,OAAO;AAAA,IACjC,EAAE;AAAA,IACF;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,cAAc,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IAChE,SAAS,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,MAAqC;AAC7D,aAAW,OAAO,CAAC,UAAU,aAAa,gBAAgB,GAAG;AAC3D,UAAM,SAAS,UAAU,KAAK,GAAG,CAAC;AAClC,QAAI,WAAW,OAAW,QAAO;AAAA,EACnC;AACA,MAAI,OAAO,KAAK,SAAS,UAAU;AACjC,UAAM,QAAQ,KAAK,KAAK,MAAM,6BAA6B;AAC3D,UAAM,SAAS,UAAU,QAAQ,CAAC,GAAG,KAAK,CAAC;AAC3C,QAAI,WAAW,OAAW,QAAO;AAAA,EACnC;AACA,QAAM,IAAI,MAAM,6CAA6C;AAC/D;AAEA,SAAS,iBAAiB,WAA8B,SAAqC;AAC3F,SAAO,UAAU,MAAM,CAAC,YAAY,QAAQ;AAAA,IAAK,CAAC,UAChD,iBAAiB,MAAM,OAAO,MAAM,iBAAiB,QAAQ,OAAO,KACpE,OAAO,MAAM,UAAU,YAAY,OAAO,QAAQ,UAAU,YAC5D,UAAU,MAAM,OAAO,QAAQ,KAAK,KACpC,MAAM,SAAS,QAAQ,QACvB,QAAQ,QAAQ,MAAM,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AACH;AAEA,SAAS,UAAU,SAAiB,WAA4B;AAC9D,SAAO,YAAY,aAAa,QAAQ,SAAS,IAAI,SAAS,EAAE;AAClE;AAEA,SAAS,iBAAiB,SAAyB;AACjD,SAAO,QAAQ,WAAW,YAAY,IAAI,UAAU,aAAa,OAAO;AAC1E;AAEA,SAAS,wBAAwB,YAAqC;AACpE,MAAI,OAAO,WAAW,UAAU,SAAU,OAAM,IAAI,MAAM,qCAAqC;AAC/F,SAAO,WAAW;AACpB;AAEA,SAAS,UAAU,KAAuD;AACxE,QAAM,OAAO,EAAE,GAAG,IAAI;AACtB,aAAW,SAAS,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG,EAAG,QAAO,KAAK,KAAK;AACpF,SAAO;AACT;AAEA,SAAS,cAAc,MAA0B,OAAwB;AACvE,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,WAAO,mBAAmB,MAAM,KAAK;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,OAAuB;AAC3C,SAAO,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B;AAEA,SAAS,kBAAkB,OAA0C;AACnE,SAAO,SAAS,KAAK,KAAK,OAAO,MAAM,YAAY,YAAY,OAAO,MAAM,UAAU,YACpF,OAAO,MAAM,SAAS,YAAY,MAAM,QAAQ,MAAM,OAAO,KAC7D,MAAM,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ;AAC9D;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO;AACnE,QAAM,OAAO,IAAI,KAAK,OAAO,UAAU,YAAY,QAAQ,OAAiB,QAAQ,MAAO,KAAK;AAChG,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,SAAY;AACpD;AAEA,eAAe,gBAAgB,MAA6B;AAC1D,QAAM,MAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,MAAM,MAAM,GAAK;AACzB;AAEA,eAAe,YAAY,MAAc,OAA+B;AACtE,QAAM,YAAY,QAAQ,IAAI;AAC9B,QAAM,gBAAgB,SAAS;AAC/B,QAAM,YAAY,GAAG,IAAI,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC1E,QAAM,UAAU,WAAW,GAAG,KAAK,UAAU,OAAO,cAAc,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACzF,QAAM,OAAO,WAAW,IAAI;AAC5B,QAAM,MAAM,MAAM,GAAK;AACzB;AAEA,SAAS,aAAa,MAAc,OAAyB;AAC3D,SAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAEA,eAAe,SAAY,MAAiC;AAC1D,MAAI;AACF,WAAO,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,SAAS,KAAK,KAAK,MAAM,SAAS,SAAU,QAAO;AACvD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,WAAW,MAAgC;AACxD,SAAQ,MAAM,SAAkB,IAAI,MAAO;AAC7C;AAEA,eAAe,gBACb,WACA,UACsC;AACtC,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,SAAS,KAAK,KAAK,MAAM,SAAS,SAAU,QAAO;AACvD,UAAM;AAAA,EACR;AACA,QAAM,SAA4B,CAAC;AACnC,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,UAAM,OAAO,KAAK,WAAW,IAAI;AACjC,UAAM,UAAU,MAAM,SAA0B,IAAI,EAAE,MAAM,MAAM,IAAI;AACtE,QAAI,YAAY,QAAQ,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC3E,YAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAC9B;AAAA,IACF;AACA,WAAO,KAAK,OAAO;AACnB,QAAI,mBAAmB,SAAS,QAAQ,EAAG,QAAO;AAAA,EACpD;AACA,MAAI,OAAO,UAAU,IAAI;AACvB,WAAO,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,SAAS,CAAC;AACrF,UAAM,GAAG,KAAK,WAAW,GAAG,OAAO,CAAC,EAAG,KAAK,OAAO,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,mBACP,SACA,UACS;AACT,SAAO,QAAQ,YAAY,KAAK,QAAQ,aAAa,SAAS,YAC5D,QAAQ,SAAS,SAAS,QAAQ,QAAQ,cAAc,SAAS,aACjE,KAAK,UAAU,QAAQ,WAAW,MAAM,KAAK,UAAU,SAAS,WAAW,KAC3E,KAAK,UAAU,QAAQ,SAAS,MAAM,KAAK,UAAU,SAAS,SAAS;AAC3E;;;ACtoBA,SAAS,iBAAiB;AAC1B,SAAS,kBAA0C;;;ACDnD,SAAS,qBAAqB;AAC9B,SAAS,QAAAC,aAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,YAAY,KAAK,8BAA8B;AACxD,SAAS,mBAAAC,wBAAuB;;;ACSzB,SAAS,gBAAgB,QAAgC;AAC9D,QAAM,YAAsC,2BAA2B,MAAM,IACzE,SACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AAEF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,cAAc,UAAU,MAAM,EAAE,CAAC;AAAA,IACjE,mBAAmB;AAAA,EACrB;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;ADRO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAmBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAWC,MAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AAYA,IAAM,gBAAwC;AAAA,EAC5C;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,IAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,aAAW,GAAG;AACd,SAAO,IAAI,uBAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,SAAS,MAAMC;AAAA,UACnB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,uBAAuB,SAAS;AAAA,UAChC;AAAA,QACF;AACA,cAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,MAAM;AACnD,eAAO,gBAAgB,SAAS;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;;;AE9SA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;AJIpC,IAAM,kBAAkB;;;AHY/B,IAAM,iBAAiB;AAYhB,SAAS,mBAAmB,QAAuC;AACxE,QAAM,cAAc,qBAAqB,OAAO,SAAS;AACzD,QAAM,SAAS,OAAO,OAAO,cAAc,MAAM;AACjD,QAAM,UAAU,OAAO,OAAO,cAAc,QAAQ;AACpD,QAAM,WAAW,2BAA2B;AAAA,IAC1C;AAAA,IACA,UAAU,YAAY,SAAS;AAAA,IAC/B;AAAA,IACA,eAAe;AAAA,EACjB,CAAC;AACD,QAAM,sBAAsB,qCAAqC,WAAW;AAC5E,QAAM,eAAe,kBAAkB;AAAA,IACrC;AAAA,IACA,gBAAgB,CAAC,cAAc;AAAA,IAC/B;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,IAAI,kBAAkB,EAAE,GAAG,QAAQ,WAAW,YAAY,CAAC;AACzE,QAAM,UAAU,iBAAiB,OAAO,EAAE,UAAAC,UAAS,MAAM;AACvD,UAAM,WAAW,cAAcA,SAAQ;AACvC,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,UAAM,YAAY,MAAM,gBAAgB,OAAO;AAC/C,UAAM,YAAY,0BAA0B;AAC5C,UAAM,SAAS,IAAIC;AAAA,MACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,MAC9C;AAAA,QACE,qBAAqB;AAAA,QACrB,cAAc;AAAA,MAChB;AAAA,IACF;AACA,2BAAuB,QAAQ;AAAA,MAC7B,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB;AAAA,MACA,0BAA0B,CAAC,WAAW,MAAM,wBAAwB,SAAS,WAAW,MAAM;AAAA,IAChG,GAAG,SAAS;AACZ,wBAAoB,QAAQ,WAAW,OAAO,QAAQ;AACtD,WAAO;AAAA,EACT,GAAG;AAAA,IACD,QAAQ;AAAA,IACR,SAAS,MAAM,gBAAgB,oBAAoB;AAAA,EACrD,CAAC;AAED,QAAM,kBAAkB;AAAA,IACtB,eAAe,OAAO;AAAA,IACtB,mBAAmB;AAAA,IACnB,yBAAyB,IAAI,IAAI,oCAAoC;AAAA,IACrE,iBAAiB,CAAC,cAAc;AAAA,IAChC,cAAc;AAAA,EAChB;AACA,QAAM,eAAe,CAAC,YAAY,QAAQ;AAE1C,SAAO;AAAA,IACL,MAAM,MAAM,SAAqC;AAC/C,YAAM,WAAW,sBAAsB,SAAS,eAAe;AAC/D,UAAI,aAAa,OAAW,QAAO;AACnC,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAI,IAAI,aAAa,YAAY;AAC/B,eAAO,QAAQ,WAAW,QACtB,KAAK,EAAE,IAAI,KAAK,CAAC,IACjB,iBAAiB,KAAK;AAAA,MAC5B;AACA,YAAM,cAAc,6BAA6B,SAAS,YAAY;AACtE,UAAI,gBAAgB,OAAW,QAAO;AAEtC,UAAI,IAAI,aAAa,YAAY;AAC/B,YAAI,QAAQ,WAAW,MAAO,QAAO,iBAAiB,KAAK;AAC3D,YAAI;AACF,gBAAM,cAAc,MAAM,MAAM,iBAAiB,cAAc,GAAG,CAAC;AACnE,iBAAO,SAAS,SAAS,aAAa,GAAG;AAAA,QAC3C,QAAQ;AACN,iBAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;AAAA,QACxE;AAAA,MACF;AACA,UAAI,IAAI,aAAa,qBAAqB;AACxC,YAAI,QAAQ,WAAW,UAAW,QAAO,aAAa,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC,GAAG,OAAO,WAAW;AAC7G,YAAI,QAAQ,WAAW,OAAQ,QAAO,iBAAiB,MAAM;AAC7D,cAAMC,iBAAgB,uBAAuB,SAAS,OAAO,WAAW;AACxE,YAAIA,mBAAkB,OAAW,QAAO,aAAaA,gBAAe,OAAO,WAAW;AACtF,YAAI;AACF,gBAAM,MAAM,iBAAiB,cAAc,GAAG,GAAG,OAAO;AACxD,iBAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,OAAO,WAAW;AAAA,QACjE,SAAS,OAAO;AAEd,iBAAO;AAAA,YACL,iBAAiB,6BACb,KAAK,EAAE,OAAO,MAAM,SAAS,MAAM,0BAA0B,GAAG,GAAG,IACnE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;AAAA,YACtE,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,UAAI,IAAI,aAAa,YAAY,SAAU,QAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAClF,YAAM,gBAAgB,eAAe,SAAS,OAAO,cAAc;AACnE,UAAI,kBAAkB,OAAW,QAAO;AACxC,YAAM,OAAO,MAAM,aAAa,OAAO;AACvC,UAAI,gBAAgB,SAAU,QAAO;AACrC,aAAO,QAAQ,MAAM,SAAS,EAAE,UAAU,KAAK,CAAC;AAAA,IAClD;AAAA,IACA,OAAO,MAAM,QAAQ,MAAM;AAAA,EAC7B;AACF;AAEA,SAAS,oBACP,QACA,WACA,OACA,UACM;AACN,QAAM,cAAcC,gBAAe,EAAE,MAAM,UAAU,YAAY,CAAC,GAAG,sBAAsB,MAAM,GAAG,SAAS;AAC7G,QAAM,eAAeA,gBAAe;AAAA,IAClC,MAAM;AAAA,IACN,YAAY;AAAA,MACV,WAAW,EAAE,MAAM,UAAU;AAAA,MAC7B,YAAY,EAAE,MAAM,SAAS;AAAA,MAC7B,aAAa,EAAE,MAAM,UAAU,QAAQ,MAAM;AAAA,MAC7C,WAAW,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,IACnD;AAAA,IACA,UAAU,CAAC,aAAa,YAAY;AAAA,IACpC,sBAAsB;AAAA,EACxB,GAAG,SAAS;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,cAAc;AAAA,QACd,gBAAgB;AAAA,QAChB,iBAAiB;AAAA,QACjB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY;AACV,YAAM,SAAS,MAAM,MAAM,cAAc,SAAS,SAAS,SAAS,SAAS;AAC7E,aAAO;AAAA,QACL,SAAS,CAAC;AAAA,UACR,MAAM;AAAA,UACN,MAAM,OAAO,YACT,4BACA;AAAA,QACN,CAAC;AAAA,QACD,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;AAOA,SAAS,cAAcH,WAA+C;AACpE,QAAM,UAAUA,WAAU,OAAO;AACjC,MAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,YAAYA,WAAU,OAAO;AACnC,MAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,WAAW,KACpD,CAAC,UAAU,MAAM,CAAC,QAAQ,OAAO,QAAQ,QAAQ,GAAG;AACpD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO,EAAE,SAAS,UAAU;AAC9B;AAEA,SAAS,qBAAqB,KAAe;AAC3C,QAAM,WAAW,IAAI,IAAI,GAAG;AAC5B,WAAS,OAAO;AAChB,WAAS,SAAS;AAClB,WAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ,EAAE,KAAK;AAC7D,MAAI,SAAS,aAAa,IAAK,UAAS,WAAW;AACnD,SAAO;AACT;AAEA,SAAS,cAAc,KAAkB;AACvC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,MAAI,UAAU,QAAQ,MAAM,SAAS,IAAK,OAAM,IAAI,MAAM,yBAAyB;AACnF,SAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA8D;AACtG,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,YAAY,WAAW,CAAC;AAC9B,SAAO,UAAU,SAAS,MAAM,IAAI,SAAY,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;AAC/F;AAEA,SAAS,uBAAuB,SAAkB,aAA2C;AAC3F,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,SAAO,WAAW,QAAQ,WAAW,IAAI,IAAI,WAAW,EAAE,SACtD,SACA,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;AACnD;AAEA,SAAS,aAAa,UAAoB,aAA+B;AACvE,QAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAC5C,UAAQ,IAAI,+BAA+B,IAAI,IAAI,WAAW,EAAE,MAAM;AACtE,UAAQ,IAAI,gCAAgC,eAAe;AAC3D,UAAQ,IAAI,gCAAgC,cAAc;AAC1D,UAAQ,IAAI,QAAQ,QAAQ;AAC5B,SAAO,IAAI,SAAS,SAAS,MAAM,EAAE,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AACzE;AAEA,SAAS,KAAK,OAAgB,SAAS,KAAe;AACpD,SAAO,SAAS,KAAK,OAAO,EAAE,QAAQ,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AAClF;AAEA,SAAS,iBAAiB,OAAyB;AACjD,SAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/E;AAEA,SAAS,gBAAgB,SAAuB;AAC9C,UAAQ,OAAO,MAAM,wBAAwB,OAAO;AAAA,CAAI;AAC1D;;;AD9OA,eAAsB,OAAsB;AAC1C,UAAQ,MAAM,EAAK;AACnB,QAAM,YAAY,YAAY,mBAAmB;AACjD,QAAM,WAAW,qBAAqB,kBAAkB;AACxD,QAAM,cAAc,eAAe,qBAAqB;AACxD,MAAI,OAAO,WAAW,WAAW,IAAI,GAAI,OAAM,IAAI,MAAM,qDAAqD;AAC9G,QAAM,cAAc,QAAQ,IAAI,mBAAmB;AACnD,QAAM,mBAAmB,IAAI;AAAA,IAC3B,QAAQ,IAAI,6BACV;AAAA,EACJ;AACA,QAAM,gBAAgB,MAAM,kBAAkB,gBAAgB;AAC9D,QAAM,MAAM,mBAAmB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,IAAI,WAAW;AAAA,IACjC;AAAA,IACA,oBAAoB,gBAAgB,QAAQ,IAAI,6BAA6B,GAAG;AAAA,IAChF,kBAAkB,QAAQ,IAAI,4BAA4B;AAAA,IAC1D,gBAAgB,UAAU,QAAQ,IAAI,sBAAsB;AAAA,IAC5D;AAAA,EACF,CAAC;AACD,QAAM,cAAc,cAAc,GAAG;AACrC,QAAM,SAAS,aAAa,WAAW;AACvC,QAAM,OAAO,QAAQ,IAAI,QAAQ;AACjC,QAAM,OAAO,gBAAgB,QAAQ,IAAI,MAAM,GAAI;AACnD,SAAO,OAAO,MAAM,MAAM,MAAM;AAC9B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AACD,QAAM,WAAW,MAAM;AACrB,WAAO,MAAM,MAAM,KAAK,IAAI,MAAM,CAAC;AAAA,EACrC;AACA,UAAQ,KAAK,UAAU,QAAQ;AAC/B,UAAQ,KAAK,WAAW,QAAQ;AAClC;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,QAAQ,QAAQ,IAAI,IAAI,GAAG,KAAK;AACtC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,IAAI,eAAe;AAClD,SAAO;AACT;AAEA,SAAS,YAAY,MAAmB;AACtC,QAAM,MAAM,IAAI,IAAI,eAAe,IAAI,CAAC;AACxC,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,eAAe,IAAI,aAAa,aAAa;AAC7F,UAAM,IAAI,MAAM,GAAG,IAAI,oCAAoC;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAsB;AAClD,QAAM,QAAQ,eAAe,IAAI;AACjC,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,4BAA4B;AAC3E,SAAO,QAAQ,KAAK;AACtB;AAEA,SAAS,gBAAgB,OAA2B,UAA0B;AAC5E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,EAAG,OAAM,IAAI,MAAM,gDAAgD;AAC9G,SAAO;AACT;AAEA,SAAS,UAAU,OAAiD;AAClE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO;AACrE;AAEA,KAAK,KAAK,EAAE,MAAM,MAAM;AACtB,UAAQ,OAAO,MAAM,wCAAwC;AAC7D,UAAQ,WAAW;AACrB,CAAC;","names":["McpServer","fromJsonSchema","join","invokeOperation","join","invokeOperation","authInfo","McpServer","originFailure","fromJsonSchema"]}
1	+ {"version":3,"sources":["../src/http-cli.ts","../src/http.ts","../src/oauth.ts","../src/remote-store.ts","../src/server.ts","../src/tools.ts","../src/results.ts","../package.json","../src/version.ts"],"sourcesContent":["import { createServer } from \"node:http\";\nimport { isAbsolute, resolve } from \"node:path\";\n\nimport { toNodeHandler } from \"@modelcontextprotocol/node\";\n\nimport { createHostedMcpApp } from \"./http.js\";\nimport { loadOAuthMetadata } from \"./oauth.js\";\n\nexport async function main(): Promise<void> {\n process.umask(0o077);\n const publicUrl = requiredUrl(\"TC_MCP_PUBLIC_URL\");\n const stateDir = requiredAbsolutePath(\"TC_MCP_STATE_DIR\");\n const stateSecret = requiredString(\"TC_MCP_STATE_SECRET\");\n if (Buffer.byteLength(stateSecret) < 32) throw new Error(\"TC_MCP_STATE_SECRET must contain at least 32 bytes.\");\n const openkeyHost = process.env.TC_OPENKEY_HOST ?? \"https://openkey.so\";\n const oauthMetadataUrl = new URL(\n process.env.TC_MCP_OAUTH_METADATA_URL ??\n \"https://api.openkey.so/.well-known/oauth-authorization-server/api/auth\",\n );\n const oauthMetadata = await loadOAuthMetadata(oauthMetadataUrl);\n const app = createHostedMcpApp({\n publicUrl,\n stateDir,\n stateSecret,\n nodeHost: process.env.TC_HOST ?? \"https://tee.node.tinycloud.xyz\",\n openkeyHost,\n approvalTtlSeconds: positiveInteger(process.env.TC_MCP_APPROVAL_TTL_SECONDS, 300),\n delegationExpiry: process.env.TC_MCP_DELEGATION_EXPIRY ?? \"1h\",\n allowedOrigins: commaList(process.env.TC_MCP_ALLOWED_ORIGINS),\n oauthMetadata,\n });\n const nodeHandler = toNodeHandler(app);\n const server = createServer(nodeHandler);\n const host = process.env.HOST ?? \"0.0.0.0\";\n const port = positiveInteger(process.env.PORT, 3000);\n server.listen(port, host, () => {\n process.stderr.write(`[tinycloud-mcp-http] listening on ${host}:${port}\\n`);\n });\n const shutdown = () => {\n server.close(() => void app.close());\n };\n process.once(\"SIGINT\", shutdown);\n process.once(\"SIGTERM\", shutdown);\n}\n\nfunction requiredString(name: string): string {\n const value = process.env[name]?.trim();\n if (!value) throw new Error(`${name} is required.`);\n return value;\n}\n\nfunction requiredUrl(name: string): URL {\n const url = new URL(requiredString(name));\n if (url.protocol !== \"https:\" && url.hostname !== \"localhost\" && url.hostname !== \"127.0.0.1\") {\n throw new Error(`${name} must use HTTPS outside localhost.`);\n }\n return url;\n}\n\nfunction requiredAbsolutePath(name: string): string {\n const value = requiredString(name);\n if (!isAbsolute(value)) throw new Error(`${name} must be an absolute path.`);\n return resolve(value);\n}\n\nfunction positiveInteger(value: string \| undefined, fallback: number): number {\n if (value === undefined) return fallback;\n const parsed = Number(value);\n if (!Number.isInteger(parsed) \|\| parsed <= 0) throw new Error(\"Expected a positive integer environment value.\");\n return parsed;\n}\n\nfunction commaList(value: string \| undefined): string[] \| undefined {\n if (value === undefined) return undefined;\n return value.split(\",\").map((entry) => entry.trim()).filter(Boolean);\n}\n\nvoid main().catch(() => {\n process.stderr.write(\"[tinycloud-mcp-http] Startup failed.\\n\");\n process.exitCode = 1;\n});\n","import {\n McpServer,\n createMcpHandler,\n fromJsonSchema,\n getOAuthProtectedResourceMetadataUrl,\n hostHeaderValidationResponse,\n oauthMetadataResponse,\n requireBearerAuth,\n type AuthInfo,\n type OAuthMetadata,\n} from \"@modelcontextprotocol/server\";\n\nimport { createOpenKeyTokenVerifier } from \"./oauth.js\";\nimport { ApprovalOwnerMismatchError, RemoteTenantStore, type RemoteStoreConfig } from \"./remote-store.js\";\nimport { MCP_SERVER_NAME } from \"./server.js\";\nimport { createJsonSchemaValidator, registerTinyCloudTools } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nconst REQUIRED_SCOPE = \"tinycloud:mcp\";\n\nexport interface HostedMcpConfig extends RemoteStoreConfig {\n readonly oauthMetadata: OAuthMetadata;\n readonly allowedOrigins?: readonly string[];\n}\n\nexport interface HostedMcpApp {\n readonly fetch: (request: Request) => Promise<Response>;\n readonly close: () => Promise<void>;\n}\n\nexport function createHostedMcpApp(config: HostedMcpConfig): HostedMcpApp {\n const resourceUrl = canonicalResourceUrl(config.publicUrl);\n const issuer = String(config.oauthMetadata.issuer);\n const jwksUri = String(config.oauthMetadata.jwks_uri);\n const verifier = createOpenKeyTokenVerifier({\n issuer,\n audience: resourceUrl.toString(),\n jwksUri,\n requiredScope: REQUIRED_SCOPE,\n });\n const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(resourceUrl);\n const authenticate = requireBearerAuth({\n verifier,\n requiredScopes: [REQUIRED_SCOPE],\n resourceMetadataUrl,\n });\n const store = new RemoteTenantStore({ ...config, publicUrl: resourceUrl });\n const handler = createMcpHandler(async ({ authInfo }) => {\n const identity = oauthIdentity(authInfo);\n const { subject, ownerDids } = identity;\n const stateRoot = store.tenantStateRoot(subject);\n const validator = createJsonSchemaValidator();\n const server = new McpServer(\n { name: MCP_SERVER_NAME, version: MCP_VERSION },\n {\n jsonSchemaValidator: validator,\n instructions: \"Call tinycloud_connect first. If an operation returns authority_required, open approval.url, then retry that operation unchanged.\",\n },\n );\n registerTinyCloudTools(server, {\n profile: \"agent\",\n explicitProfile: true,\n allowOwnerProfile: false,\n stateRoot,\n transformOperationResult: (result) => store.decorateAuthorityResult(subject, ownerDids, result),\n }, validator);\n registerConnectTool(server, validator, store, identity);\n return server;\n }, {\n legacy: \"stateless\",\n onerror: () => writeDiagnostic(\"MCP request failed\"),\n });\n\n const metadataOptions = {\n oauthMetadata: config.oauthMetadata,\n resourceServerUrl: resourceUrl,\n serviceDocumentationUrl: new URL(\"https://docs.tinycloud.xyz/cli/mcp\"),\n scopesSupported: [REQUIRED_SCOPE],\n resourceName: \"TinyCloud hosted MCP\",\n };\n const allowedHosts = [resourceUrl.hostname];\n\n return {\n async fetch(request: Request): Promise<Response> {\n const metadata = oauthMetadataResponse(request, metadataOptions);\n if (metadata !== undefined) return metadata;\n const url = new URL(request.url);\n if (url.pathname === \"/healthz\") {\n return request.method === \"GET\"\n ? json({ ok: true })\n : methodNotAllowed(\"GET\");\n }\n const hostFailure = hostHeaderValidationResponse(request, allowedHosts);\n if (hostFailure !== undefined) return hostFailure;\n\n if (url.pathname === \"/connect\") {\n if (request.method !== \"GET\") return methodNotAllowed(\"GET\");\n try {\n const destination = await store.approvalRedirect(requiredState(url));\n return Response.redirect(destination, 302);\n } catch {\n return json({ error: \"The approval link is invalid or expired.\" }, 400);\n }\n }\n if (url.pathname === \"/connect/callback\") {\n if (request.method === \"OPTIONS\") return callbackCors(new Response(null, { status: 204 }), config.openkeyHost);\n if (request.method !== \"POST\") return methodNotAllowed(\"POST\");\n const originFailure = validateCallbackOrigin(request, config.openkeyHost);\n if (originFailure !== undefined) return callbackCors(originFailure, config.openkeyHost);\n try {\n await store.completeApproval(requiredState(url), request);\n return callbackCors(json({ success: true }), config.openkeyHost);\n } catch (error) {\n // Only fixed server-authored text reaches OpenKey; callback input is never echoed.\n return callbackCors(\n error instanceof ApprovalOwnerMismatchError\n ? json({ error: error.message, code: \"approval_owner_mismatch\" }, 403)\n : json({ error: \"TinyCloud could not accept this delegation.\" }, 400),\n config.openkeyHost,\n );\n }\n }\n if (url.pathname !== resourceUrl.pathname) return json({ error: \"Not found\" }, 404);\n const originFailure = validateOrigin(request, config.allowedOrigins);\n if (originFailure !== undefined) return originFailure;\n const auth = await authenticate(request);\n if (auth instanceof Response) return auth;\n return handler.fetch(request, { authInfo: auth });\n },\n close: () => handler.close(),\n };\n}\n\nfunction registerConnectTool(\n server: McpServer,\n validator: ReturnType<typeof createJsonSchemaValidator>,\n store: RemoteTenantStore,\n identity: OAuthIdentity,\n): void {\n const inputSchema = fromJsonSchema({ type: \"object\", properties: {}, additionalProperties: false }, validator);\n const outputSchema = fromJsonSchema({\n type: \"object\",\n properties: {\n connected: { type: \"boolean\" },\n sessionDid: { type: \"string\" },\n approvalUrl: { type: \"string\", format: \"uri\" },\n expiresAt: { type: \"string\", format: \"date-time\" },\n },\n required: [\"connected\", \"sessionDid\"],\n additionalProperties: false,\n }, validator);\n server.registerTool(\n \"tinycloud_connect\",\n {\n title: \"Connect TinyCloud\",\n description: \"Check the hosted delegate connection and return a one-time OpenKey approval URL when setup is required.\",\n inputSchema,\n outputSchema,\n annotations: {\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n },\n async () => {\n const status = await store.connectStatus(identity.subject, identity.ownerDids);\n return {\n content: [{\n type: \"text\" as const,\n text: status.connected\n ? \"TinyCloud is connected.\"\n : \"TinyCloud approval is required; open approvalUrl, then call this tool again.\",\n }],\n structuredContent: status,\n };\n },\n );\n}\n\ninterface OAuthIdentity {\n readonly subject: string;\n readonly ownerDids: string[];\n}\n\nfunction oauthIdentity(authInfo: AuthInfo \| undefined): OAuthIdentity {\n const subject = authInfo?.extra?.subject;\n if (typeof subject !== \"string\" \|\| subject.length === 0) {\n throw new Error(\"The authenticated MCP request has no OpenKey subject.\");\n }\n const ownerDids = authInfo?.extra?.ownerDids;\n if (!Array.isArray(ownerDids) \|\| ownerDids.length === 0 \|\|\n !ownerDids.every((did) => typeof did === \"string\")) {\n throw new Error(\"The authenticated MCP request has no OpenKey owner identity.\");\n }\n return { subject, ownerDids };\n}\n\nfunction canonicalResourceUrl(url: URL): URL {\n const resource = new URL(url);\n resource.hash = \"\";\n resource.search = \"\";\n resource.pathname = resource.pathname.replace(/\\/+$/, \"\") \|\| \"/mcp\";\n if (resource.pathname === \"/\") resource.pathname = \"/mcp\";\n return resource;\n}\n\nfunction requiredState(url: URL): string {\n const state = url.searchParams.get(\"state\");\n if (state === null \|\| state.length > 512) throw new Error(\"Missing approval state.\");\n return state;\n}\n\nfunction validateOrigin(request: Request, allowed: readonly string[] \| undefined): Response \| undefined {\n const origin = request.headers.get(\"origin\");\n if (origin === null) return undefined;\n const allowlist = allowed ?? [];\n return allowlist.includes(origin) ? undefined : json({ error: \"Origin is not allowed.\" }, 403);\n}\n\nfunction validateCallbackOrigin(request: Request, openkeyHost: string): Response \| undefined {\n const origin = request.headers.get(\"origin\");\n return origin === null \|\| origin === new URL(openkeyHost).origin\n ? undefined\n : json({ error: \"Origin is not allowed.\" }, 403);\n}\n\nfunction callbackCors(response: Response, openkeyHost: string): Response {\n const headers = new Headers(response.headers);\n headers.set(\"access-control-allow-origin\", new URL(openkeyHost).origin);\n headers.set(\"access-control-allow-methods\", \"POST, OPTIONS\");\n headers.set(\"access-control-allow-headers\", \"content-type\");\n headers.set(\"vary\", \"Origin\");\n return new Response(response.body, { status: response.status, headers });\n}\n\nfunction json(value: unknown, status = 200): Response {\n return Response.json(value, { status, headers: { \"cache-control\": \"no-store\" } });\n}\n\nfunction methodNotAllowed(allow: string): Response {\n return new Response(\"Method not allowed\", { status: 405, headers: { allow } });\n}\n\nfunction writeDiagnostic(message: string): void {\n process.stderr.write(`[tinycloud-mcp-http] ${message}\\n`);\n}\n","import {\n OAuthError,\n OAuthErrorCode,\n type AuthInfo,\n type OAuthMetadata,\n type OAuthTokenVerifier,\n} from \"@modelcontextprotocol/server\";\nimport { createRemoteJWKSet, errors, jwtVerify, type JWTPayload } from \"jose\";\n\nconst OWNER_DIDS_CLAIM = \"https://tinycloud.xyz/owner_dids\";\n\nexport interface OpenKeyOAuthConfig {\n readonly issuer: string;\n readonly audience: string;\n readonly jwksUri: string;\n readonly requiredScope?: string;\n}\n\nexport function createOpenKeyTokenVerifier(config: OpenKeyOAuthConfig): OAuthTokenVerifier {\n const jwks = createRemoteJWKSet(new URL(config.jwksUri));\n return {\n async verifyAccessToken(token: string): Promise<AuthInfo> {\n try {\n const { payload } = await jwtVerify(token, jwks, {\n issuer: config.issuer,\n audience: config.audience,\n });\n return authInfo(token, payload, config);\n } catch (error) {\n if (error instanceof errors.JOSEError) {\n throw new OAuthError(OAuthErrorCode.InvalidToken, \"The OpenKey access token is invalid.\");\n }\n throw error;\n }\n },\n };\n}\n\nexport async function loadOAuthMetadata(metadataUrl: URL): Promise<OAuthMetadata> {\n const response = await fetch(metadataUrl, {\n headers: { accept: \"application/json\" },\n signal: AbortSignal.timeout(10_000),\n });\n if (!response.ok) throw new Error(\"OpenKey OAuth discovery failed.\");\n const metadata = await response.json() as OAuthMetadata;\n if (typeof metadata.issuer !== \"string\" \|\| typeof metadata.jwks_uri !== \"string\") {\n throw new Error(\"OpenKey OAuth metadata is incomplete.\");\n }\n return metadata;\n}\n\nfunction authInfo(\n token: string,\n payload: JWTPayload,\n config: OpenKeyOAuthConfig,\n): AuthInfo {\n if (typeof payload.sub !== \"string\" \|\| payload.sub.length === 0) {\n throw new OAuthError(OAuthErrorCode.InvalidToken, \"The OpenKey access token does not identify a subject.\");\n }\n if (typeof payload.exp !== \"number\") {\n throw new OAuthError(OAuthErrorCode.InvalidToken, \"The OpenKey access token has no expiry.\");\n }\n const scopes = typeof payload.scope === \"string\"\n ? payload.scope.split(/\\s+/).filter(Boolean)\n : [];\n if (config.requiredScope !== undefined && !scopes.includes(config.requiredScope)) {\n throw new OAuthError(\n OAuthErrorCode.InsufficientScope,\n \"The OpenKey access token is missing the TinyCloud MCP scope.\",\n );\n }\n const clientId = firstString(payload.azp, payload.client_id) ?? \"unknown\";\n const ownerDids = Array.isArray(payload[OWNER_DIDS_CLAIM])\n ? payload[OWNER_DIDS_CLAIM].filter((value): value is string => typeof value === \"string\")\n : [];\n if (ownerDids.length === 0) {\n throw new OAuthError(\n OAuthErrorCode.InvalidToken,\n \"The OpenKey access token has no TinyCloud owner identity.\",\n );\n }\n return {\n token,\n clientId,\n scopes,\n expiresAt: payload.exp,\n resource: new URL(config.audience),\n extra: {\n subject: payload.sub,\n ownerDids,\n },\n };\n}\n\nfunction firstString(...values: unknown[]): string \| undefined {\n return values.find((value): value is string => typeof value === \"string\" && value.length > 0);\n}\n","import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport {\n TinyCloudNode,\n principalDidEquals,\n type PermissionEntry,\n type PortableDelegation,\n type TinyCloudSession,\n} from \"@tinycloud/node-sdk\";\nimport { TCWSessionManager, importKey, initPanicHook } from \"@tinycloud/node-sdk-wasm\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nconst PROFILE = \"agent\";\nconst MAX_CALLBACK_BYTES = 256 * 1024;\nconst BOOTSTRAP_PERMISSIONS: PermissionEntry[] = [\n {\n service: \"tinycloud.kv\",\n space: \"account\",\n path: \"spaces/\",\n actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n },\n {\n service: \"tinycloud.kv\",\n space: \"account\",\n path: \"applications/\",\n actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n },\n];\n\nexport interface RemoteStoreConfig {\n readonly stateDir: string;\n readonly stateSecret: string;\n readonly publicUrl: URL;\n readonly nodeHost: string;\n readonly openkeyHost: string;\n readonly approvalTtlSeconds: number;\n readonly delegationExpiry: string;\n}\n\ninterface TenantProfile {\n readonly stateRoot: string;\n readonly sessionDid: string;\n readonly jwk: Record<string, unknown>;\n}\n\ninterface PendingApproval {\n readonly version: 1;\n readonly nonce: string;\n readonly tenantId: string;\n readonly kind: \"bootstrap\" \| \"delegation\";\n readonly requestId?: string;\n readonly permissions: PermissionEntry[];\n readonly ownerDids: string[];\n readonly createdAt: string;\n readonly expiresAt: string;\n}\n\nexport interface ConnectStatus {\n readonly connected: boolean;\n readonly sessionDid: string;\n readonly approvalUrl?: string;\n readonly expiresAt?: string;\n}\n\ninterface CallbackSession {\n readonly delegationHeader: { Authorization: string };\n readonly delegationCid: string;\n readonly spaceId: string;\n readonly jwk: Record<string, unknown>;\n readonly verificationMethod: string;\n readonly address?: string;\n readonly chainId?: number;\n readonly siwe?: string;\n readonly signature?: string;\n}\n\n/*\n The approving wallet is not the OpenKey principal whose MCP request created\n * the approval link. The message is static so callers may show it verbatim.\n /\nexport class ApprovalOwnerMismatchError extends Error {\n constructor() {\n super(\"This approval link was requested by a different TinyCloud account, so the delegation was not stored.\");\n this.name = \"ApprovalOwnerMismatchError\";\n }\n}\n\nexport class RemoteTenantStore {\n readonly #config: RemoteStoreConfig;\n readonly #initializing = new Map<string, Promise<TenantProfile>>();\n\n constructor(config: RemoteStoreConfig) {\n this.#config = config;\n }\n\n tenantStateRoot(subject: string): string {\n return join(this.#config.stateDir, \"tenants\", this.#tenantId(subject));\n }\n\n async connectStatus(subject: string, ownerDids: readonly string[] = []): Promise<ConnectStatus> {\n const tenant = await this.#ensureTenant(subject);\n if (await this.#hasValidSession(tenant, ownerDids)) {\n return { connected: true, sessionDid: tenant.sessionDid };\n }\n const pending = await this.#createPending(subject, ownerDids, \"bootstrap\", BOOTSTRAP_PERMISSIONS);\n return {\n connected: false,\n sessionDid: tenant.sessionDid,\n approvalUrl: this.#connectUrl(pending),\n expiresAt: pending.expiresAt,\n };\n }\n\n async decorateAuthorityResult(\n subject: string,\n ownerDids: readonly string[],\n result: unknown,\n ): Promise<unknown> {\n if (!isRecord(result) \|\| result.status !== \"authority_required\") return result;\n const request = isRecord(result.request) ? result.request : undefined;\n const requestId = typeof request?.requestId === \"string\" ? request.requestId : undefined;\n const requested = Array.isArray(request?.requested)\n ? request.requested.filter(isPermissionEntry)\n : [];\n if (requestId === undefined \|\| requested.length === 0) return result;\n const pending = await this.#createPending(subject, ownerDids, \"delegation\", requested, requestId);\n return {\n ...result,\n approval: {\n ...(isRecord(result.approval) ? result.approval : {}),\n kind: \"openkey\",\n requestId,\n url: this.#connectUrl(pending),\n fallback: \"Open the approval URL, then retry the same MCP tool.\",\n },\n };\n }\n\n async approvalRedirect(state: string): Promise<string> {\n const pending = await this.#readPending(state, false);\n const tenant = await this.#readTenant(pending.tenantId);\n const callback = new URL(\"/connect/callback\", this.#config.publicUrl);\n callback.searchParams.set(\"state\", state);\n const params = new URLSearchParams({\n did: tenant.sessionDid,\n callback: callback.toString(),\n host: this.#config.nodeHost,\n jwk: Buffer.from(JSON.stringify(publicJwk(tenant.jwk))).toString(\"base64url\"),\n permissions: Buffer.from(JSON.stringify({\n permissions: pending.permissions,\n reason: [\n pending.kind === \"bootstrap\"\n ? \"Connect this TinyCloud account to the hosted MCP delegate.\"\n : \"Approve the exact capabilities requested by the TinyCloud MCP operation.\",\n // Owner DIDs come from the verified OpenKey access token of the MCP\n // client that created this link, never from the link itself.\n ...(pending.ownerDids.length === 0\n ? []\n : [`Requested by TinyCloud account ${pending.ownerDids.join(\", \")}; approve only if that is you.`]),\n ].join(\" \"),\n })).toString(\"base64url\"),\n expiry: this.#config.delegationExpiry,\n });\n return `${this.#config.openkeyHost.replace(/\\/+$/, \"\")}/delegate?${params.toString()}`;\n }\n\n async completeApproval(state: string, request: Request): Promise<void> {\n const length = Number(request.headers.get(\"content-length\") ?? \"0\");\n if (Number.isFinite(length) && length > MAX_CALLBACK_BYTES) throw new Error(\"Callback body is too large.\");\n const text = await request.text();\n if (Buffer.byteLength(text) > MAX_CALLBACK_BYTES) throw new Error(\"Callback body is too large.\");\n const data = JSON.parse(text) as unknown;\n if (!isRecord(data)) throw new Error(\"Callback body is invalid.\");\n\n const pending = await this.#readPending(state, true);\n try {\n const tenant = await this.#readTenant(pending.tenantId);\n if (pending.kind === \"bootstrap\") {\n await this.#storeBootstrap(tenant, pending, data);\n } else {\n await this.#storeDelegation(tenant, pending, data);\n }\n await rm(this.#pendingPath(tenant.stateRoot, pending.nonce) + \".processing\", { force: true });\n } catch (error) {\n await this.#restorePending(pending).catch(() => undefined);\n throw error;\n }\n }\n\n async #storeBootstrap(\n tenant: TenantProfile,\n pending: PendingApproval,\n data: Record<string, unknown>,\n ): Promise<void> {\n const { node, session } = await this.#restoreApproval(tenant, data);\n if (pending.ownerDids.length > 0 && !pending.ownerDids.some((did) => samePrincipal(node.did, did))) {\n throw new ApprovalOwnerMismatchError();\n }\n const granted = [...node.getVerifiedSessionCapabilities()];\n if (!permissionsCover(pending.permissions, granted)) {\n throw new Error(\"The approved delegation does not cover the requested account access.\");\n }\n const profile = await readJson<Record<string, unknown>>(this.#profilePath(tenant.stateRoot));\n await secureWrite(this.#profilePath(tenant.stateRoot), {\n ...profile,\n ownerDid: normalizeDid(node.did),\n spaceId: session.spaceId,\n });\n await secureWrite(this.#sessionPath(tenant.stateRoot), {\n authMethod: \"openkey\",\n ...session,\n });\n }\n\n async #storeDelegation(\n tenant: TenantProfile,\n pending: PendingApproval,\n data: Record<string, unknown>,\n ): Promise<void> {\n if (pending.requestId === undefined) throw new Error(\"Authority request is missing.\");\n // Unlike bootstrap there is no empty-list exemption: a delegation is only\n // imported when its verified signer is the OAuth principal that asked.\n const { node } = await this.#restoreApproval(tenant, data);\n if (!pending.ownerDids.some((did) => samePrincipal(node.did, did))) throw new ApprovalOwnerMismatchError();\n const delegation = portableFromCallback(data, pending.permissions, this.#config.nodeHost);\n const result = await invokeOperation(\n \"tinycloud.auth.import\",\n 1,\n { profile: PROFILE, stateRoot: tenant.stateRoot },\n {\n requestId: pending.requestId,\n delegationCid: delegation.cid,\n delegation,\n },\n );\n if (result.status !== \"ok\") throw new Error(\"TinyCloud rejected the approved delegation.\");\n }\n\n /\n Verify the OpenKey callback as a SIWE session for this tenant's key. The\n * WASM verifier binds the authorization bytes and CID to the signed SIWE, so\n * `node.did` is the wallet that signed exactly the delegation being stored.\n /\n async #restoreApproval(\n tenant: TenantProfile,\n data: Record<string, unknown>,\n ): Promise<{ node: TinyCloudNode; session: CallbackSession }> {\n const session = sessionFromCallback(data, tenant.jwk);\n const node = new TinyCloudNode({ host: this.#config.nodeHost });\n await node.restoreSession(session);\n if (!samePrincipal(node.sessionDid, tenant.sessionDid)) {\n throw new Error(\"The approved delegation targets a different session.\");\n }\n return { node, session };\n }\n\n async #ensureTenant(subject: string): Promise<TenantProfile> {\n const tenantId = this.#tenantId(subject);\n const current = this.#initializing.get(tenantId);\n if (current !== undefined) return current;\n const initializing = this.#initializeTenant(tenantId).finally(() => {\n this.#initializing.delete(tenantId);\n });\n this.#initializing.set(tenantId, initializing);\n return initializing;\n }\n\n async #hasValidSession(tenant: TenantProfile, ownerDids: readonly string[]): Promise<boolean> {\n const raw = await readJson<Record<string, unknown>>(this.#sessionPath(tenant.stateRoot));\n if (raw === null) return false;\n try {\n const node = new TinyCloudNode({ host: this.#config.nodeHost });\n await node.restoreSession(raw as unknown as TinyCloudSession);\n return samePrincipal(node.sessionDid, tenant.sessionDid) &&\n ownerDids.some((did) => samePrincipal(node.did, did));\n } catch {\n await rm(this.#sessionPath(tenant.stateRoot), { force: true });\n return false;\n }\n }\n\n async #initializeTenant(tenantId: string): Promise<TenantProfile> {\n const stateRoot = join(this.#config.stateDir, \"tenants\", tenantId);\n const keyPath = this.#keyPath(stateRoot);\n await secureDirectory(join(stateRoot, \".tinycloud\", \"profiles\", PROFILE));\n let jwk = await readJson<Record<string, unknown>>(keyPath);\n let sessionDid: string;\n if (jwk === null) {\n const generated = generateSessionKey();\n jwk = generated.jwk;\n sessionDid = generated.did;\n await secureWrite(keyPath, jwk);\n } else {\n sessionDid = didFromJwk(jwk);\n }\n const profilePath = this.#profilePath(stateRoot);\n if (!(await fileExists(profilePath))) {\n await secureWrite(profilePath, {\n name: PROFILE,\n host: this.#config.nodeHost,\n chainId: 1,\n spaceName: \"default\",\n did: sessionDid,\n sessionDid,\n createdAt: new Date().toISOString(),\n posture: \"delegate-session\",\n operatorType: \"agent\",\n authMethod: \"openkey\",\n openkeyHost: this.#config.openkeyHost,\n });\n }\n return { stateRoot, sessionDid, jwk };\n }\n\n async #readTenant(tenantId: string): Promise<TenantProfile> {\n if (!/^[a-f0-9]{64}$/.test(tenantId)) throw new Error(\"Approval state is invalid.\");\n const stateRoot = join(this.#config.stateDir, \"tenants\", tenantId);\n const jwk = await readJson<Record<string, unknown>>(this.#keyPath(stateRoot));\n if (jwk === null) throw new Error(\"The TinyCloud delegate no longer exists.\");\n return { stateRoot, jwk, sessionDid: didFromJwk(jwk) };\n }\n\n async #createPending(\n subject: string,\n ownerDids: readonly string[],\n kind: PendingApproval[\"kind\"],\n permissions: PermissionEntry[],\n requestId?: string,\n ): Promise<PendingApproval> {\n const tenant = await this.#ensureTenant(subject);\n const tenantId = this.#tenantId(subject);\n const reusable = await reusablePending(\n this.#pendingDirectory(tenant.stateRoot),\n { tenantId, kind, requestId, permissions, ownerDids: ownerDids.map(normalizeDid) },\n );\n if (reusable !== undefined) return reusable;\n const nonce = randomBytes(24).toString(\"base64url\");\n const created = Date.now();\n const pending: PendingApproval = {\n version: 1,\n nonce,\n tenantId,\n kind,\n ...(requestId === undefined ? {} : { requestId }),\n permissions,\n ownerDids: ownerDids.map(normalizeDid),\n createdAt: new Date(created).toISOString(),\n expiresAt: new Date(created + this.#config.approvalTtlSeconds 1000).toISOString(),\n };\n await secureWrite(this.#pendingPath(tenant.stateRoot, nonce), pending);\n return pending;\n }\n\n async #readPending(state: string, consume: boolean): Promise<PendingApproval> {\n const [tenantId, nonce, signature] = state.split(\".\");\n if (tenantId === undefined \|\| nonce === undefined \|\| signature === undefined) {\n throw new Error(\"Approval state is invalid.\");\n }\n const expected = this.#signState(tenantId, nonce);\n const supplied = Buffer.from(signature, \"base64url\");\n const expectedBytes = Buffer.from(expected, \"base64url\");\n if (supplied.length !== expectedBytes.length \|\| !timingSafeEqual(supplied, expectedBytes)) {\n throw new Error(\"Approval state is invalid.\");\n }\n const stateRoot = join(this.#config.stateDir, \"tenants\", tenantId);\n const path = this.#pendingPath(stateRoot, nonce);\n const claimed = `${path}.processing`;\n if (consume) await rename(path, claimed);\n try {\n const pending = await readJson<PendingApproval>(consume ? claimed : path);\n if (pending === null \|\| pending.version !== 1 \|\| pending.tenantId !== tenantId \|\| pending.nonce !== nonce) {\n throw new Error(\"Approval state is invalid or already used.\");\n }\n if (new Date(pending.expiresAt).getTime() <= Date.now()) {\n await rm(consume ? claimed : path, { force: true });\n throw new Error(\"Approval state has expired.\");\n }\n return pending;\n } catch (error) {\n if (consume) await rename(claimed, path).catch(() => undefined);\n throw error;\n }\n }\n\n async #restorePending(pending: PendingApproval): Promise<void> {\n const stateRoot = join(this.#config.stateDir, \"tenants\", pending.tenantId);\n const path = this.#pendingPath(stateRoot, pending.nonce);\n await rename(`${path}.processing`, path);\n }\n\n #connectUrl(pending: PendingApproval): string {\n const url = new URL(\"/connect\", this.#config.publicUrl);\n url.searchParams.set(\"state\", `${pending.tenantId}.${pending.nonce}.${this.#signState(pending.tenantId, pending.nonce)}`);\n return url.toString();\n }\n\n #tenantId(subject: string): string {\n return createHmac(\"sha256\", this.#config.stateSecret).update(`tenant:${subject}`).digest(\"hex\");\n }\n\n #signState(tenantId: string, nonce: string): string {\n return createHmac(\"sha256\", this.#config.stateSecret)\n .update(`approval:${tenantId}:${nonce}`)\n .digest(\"base64url\");\n }\n\n #profilePath(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"profile.json\");\n }\n\n #keyPath(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"key.json\");\n }\n\n #sessionPath(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"session.json\");\n }\n\n #pendingPath(stateRoot: string, nonce: string): string {\n return join(this.#pendingDirectory(stateRoot), `${nonce}.json`);\n }\n\n #pendingDirectory(stateRoot: string): string {\n return join(stateRoot, \".tinycloud\", \"profiles\", PROFILE, \"pending\");\n }\n}\n\nlet wasmInitialized = false;\n\nfunction generateSessionKey(): { jwk: Record<string, unknown>; did: string } {\n ensureWasm();\n const manager = new TCWSessionManager();\n const keyId = manager.createSessionKey(\"hosted-mcp\");\n const serialized = manager.jwk(keyId);\n if (!serialized) throw new Error(\"Could not generate the hosted delegate key.\");\n return { jwk: JSON.parse(serialized) as Record<string, unknown>, did: manager.getDID(keyId) };\n}\n\nfunction didFromJwk(jwk: Record<string, unknown>): string {\n ensureWasm();\n const manager = new TCWSessionManager();\n const keyId = importKey(manager, JSON.stringify(jwk), \"hosted-mcp\");\n return manager.getDID(keyId);\n}\n\nfunction ensureWasm(): void {\n if (wasmInitialized) return;\n initPanicHook();\n wasmInitialized = true;\n}\n\nfunction sessionFromCallback(data: Record<string, unknown>, privateJwk: Record<string, unknown>): CallbackSession {\n const delegationHeader = data.delegationHeader;\n if (!isRecord(delegationHeader) \|\| typeof delegationHeader.Authorization !== \"string\" \|\|\n typeof data.delegationCid !== \"string\" \|\| typeof data.spaceId !== \"string\" \|\|\n typeof data.verificationMethod !== \"string\") {\n throw new Error(\"OpenKey returned an incomplete delegation.\");\n }\n return {\n delegationHeader: { Authorization: delegationHeader.Authorization },\n delegationCid: data.delegationCid,\n spaceId: data.spaceId,\n jwk: privateJwk,\n verificationMethod: data.verificationMethod,\n ...(typeof data.address === \"string\" ? { address: data.address } : {}),\n ...(typeof data.chainId === \"number\" ? { chainId: data.chainId } : {}),\n ...(typeof data.siwe === \"string\" ? { siwe: data.siwe } : {}),\n ...(typeof data.signature === \"string\" ? { signature: data.signature } : {}),\n };\n}\n\nfunction portableFromCallback(\n data: Record<string, unknown>,\n permissions: PermissionEntry[],\n host: string,\n): PortableDelegation {\n const primary = permissions.find((permission) => permission.service !== \"tinycloud.encryption\") ?? permissions[0];\n if (primary === undefined) throw new Error(\"The authority request has no permissions.\");\n const session = sessionFromCallback(data, {});\n const expiry = delegationExpiry(data);\n return {\n cid: session.delegationCid,\n delegationHeader: session.delegationHeader,\n spaceId: session.spaceId,\n path: primary.path,\n actions: [...primary.actions],\n resources: permissions.map((permission) => ({\n service: permission.service.startsWith(\"tinycloud.\")\n ? permission.service.slice(\"tinycloud.\".length)\n : permission.service,\n space: permission.service === \"tinycloud.encryption\"\n ? requiredPermissionSpace(permission)\n : session.spaceId,\n path: permission.path,\n actions: [...permission.actions],\n })),\n expiry,\n delegateDID: session.verificationMethod,\n ownerAddress: typeof data.address === \"string\" ? data.address : \"\",\n chainId: typeof data.chainId === \"number\" ? data.chainId : 1,\n host,\n };\n}\n\nfunction delegationExpiry(data: Record<string, unknown>): Date {\n for (const key of [\"expiry\", \"expiresAt\", \"expirationTime\"]) {\n const parsed = parseDate(data[key]);\n if (parsed !== undefined) return parsed;\n }\n if (typeof data.siwe === \"string\") {\n const match = data.siwe.match(/^Expiration Time:\\s(.+)$/im);\n const parsed = parseDate(match?.[1]?.trim());\n if (parsed !== undefined) return parsed;\n }\n throw new Error(\"OpenKey did not return a delegation expiry.\");\n}\n\nfunction permissionsCover(requested: PermissionEntry[], granted: PermissionEntry[]): boolean {\n return requested.every((request) => granted.some((grant) =>\n normalizeService(grant.service) === normalizeService(request.service) &&\n typeof grant.space === \"string\" && typeof request.space === \"string\" &&\n sameSpace(grant.space, request.space) &&\n grant.path === request.path &&\n request.actions.every((action) => grant.actions.includes(action))\n ));\n}\n\nfunction sameSpace(granted: string, requested: string): boolean {\n return granted === requested \|\| granted.endsWith(`:${requested}`);\n}\n\nfunction normalizeService(service: string): string {\n return service.startsWith(\"tinycloud.\") ? service : `tinycloud.${service}`;\n}\n\nfunction requiredPermissionSpace(permission: PermissionEntry): string {\n if (typeof permission.space !== \"string\") throw new Error(\"The authority request has no space.\");\n return permission.space;\n}\n\nfunction publicJwk(jwk: Record<string, unknown>): Record<string, unknown> {\n const copy = { ...jwk };\n for (const field of [\"d\", \"p\", \"q\", \"dp\", \"dq\", \"qi\", \"oth\", \"k\"]) delete copy[field];\n return copy;\n}\n\nfunction samePrincipal(left: string \| undefined, right: string): boolean {\n if (typeof left !== \"string\") return false;\n try {\n return principalDidEquals(left, right);\n } catch {\n return false;\n }\n}\n\nfunction normalizeDid(value: string): string {\n return value.split(\"#\", 1)[0]!;\n}\n\nfunction isPermissionEntry(value: unknown): value is PermissionEntry {\n return isRecord(value) && typeof value.service === \"string\" && typeof value.space === \"string\" &&\n typeof value.path === \"string\" && Array.isArray(value.actions) &&\n value.actions.every((action) => typeof action === \"string\");\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseDate(value: unknown): Date \| undefined {\n if (typeof value !== \"string\" && typeof value !== \"number\") return undefined;\n const date = new Date(typeof value === \"number\" && value < 10_000_000_000 ? value 1000 : value);\n return Number.isNaN(date.getTime()) ? undefined : date;\n}\n\nasync function secureDirectory(path: string): Promise<void> {\n await mkdir(path, { recursive: true, mode: 0o700 });\n await chmod(path, 0o700);\n}\n\nasync function secureWrite(path: string, value: unknown): Promise<void> {\n const directory = dirname(path);\n await secureDirectory(directory);\n const temporary = `${path}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`;\n await writeFile(temporary, `${JSON.stringify(value, jsonReplacer, 2)}\\n`, { mode: 0o600 });\n await rename(temporary, path);\n await chmod(path, 0o600);\n}\n\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n return value instanceof Date ? value.toISOString() : value;\n}\n\nasync function readJson<T>(path: string): Promise<T \| null> {\n try {\n return JSON.parse(await readFile(path, \"utf8\")) as T;\n } catch (error) {\n if (isRecord(error) && error.code === \"ENOENT\") return null;\n throw error;\n }\n}\n\nasync function fileExists(path: string): Promise<boolean> {\n return (await readJson<unknown>(path)) !== null;\n}\n\nasync function reusablePending(\n directory: string,\n expected: Pick<PendingApproval, \"tenantId\" \| \"kind\" \| \"requestId\" \| \"permissions\" \| \"ownerDids\">,\n): Promise<PendingApproval \| undefined> {\n let names: string[];\n try {\n names = await readdir(directory);\n } catch (error) {\n if (isRecord(error) && error.code === \"ENOENT\") return undefined;\n throw error;\n }\n const active: PendingApproval[] = [];\n for (const name of names) {\n if (!name.endsWith(\".json\")) continue;\n const path = join(directory, name);\n const pending = await readJson<PendingApproval>(path).catch(() => null);\n if (pending === null \|\| new Date(pending.expiresAt).getTime() <= Date.now()) {\n await rm(path, { force: true });\n continue;\n }\n active.push(pending);\n if (samePendingRequest(pending, expected)) return pending;\n }\n if (active.length >= 64) {\n active.sort((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt));\n await rm(join(directory, `${active[0]!.nonce}.json`), { force: true });\n }\n return undefined;\n}\n\nfunction samePendingRequest(\n pending: PendingApproval,\n expected: Pick<PendingApproval, \"tenantId\" \| \"kind\" \| \"requestId\" \| \"permissions\" \| \"ownerDids\">,\n): boolean {\n return pending.version === 1 && pending.tenantId === expected.tenantId &&\n pending.kind === expected.kind && pending.requestId === expected.requestId &&\n JSON.stringify(pending.permissions) === JSON.stringify(expected.permissions) &&\n JSON.stringify(pending.ownerDids) === JSON.stringify(expected.ownerDids);\n}\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\nexport function createTinyCloudMcpServer(selection: McpStartupSelection): McpServer {\n const validator = createJsonSchemaValidator();\n const server = new McpServer(\n { name: MCP_SERVER_NAME, version: MCP_VERSION },\n { jsonSchemaValidator: validator },\n );\n registerTinyCloudTools(server, selection, validator);\n return server;\n}\n\n/** Start the only supported MCP transport: local stdio. /\nexport function serveTinyCloudMcp(selection: McpStartupSelection): StdioServerHandle {\n return serveStdio(\n () => createTinyCloudMcpServer(selection),\n { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\n\nexport const TOOL_NAMES = [\n \"tinycloud_status\",\n \"tinycloud_auth_status\",\n \"tinycloud_auth_capabilities\",\n \"tinycloud_auth_request\",\n \"tinycloud_auth_import\",\n \"tinycloud_account_spaces_list\",\n \"tinycloud_account_applications_list\",\n \"tinycloud_kv_list\",\n \"tinycloud_kv_get\",\n \"tinycloud_kv_head\",\n \"tinycloud_kv_put\",\n \"tinycloud_kv_delete\",\n \"tinycloud_sql_schema_inspect\",\n \"tinycloud_sql_query\",\n \"tinycloud_sql_execute\",\n \"tinycloud_secrets_get\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\nexport interface McpStartupSelection {\n readonly profile: string;\n readonly explicitProfile: boolean;\n readonly allowOwnerProfile: boolean;\n /* Absolute TinyCloud home used to isolate one hosted OAuth principal. /\n readonly stateRoot?: string;\n /* Hosted transports may attach a browser approval URL to canonical results. /\n readonly transformOperationResult?: (result: unknown) => Promise<unknown>;\n}\n\nexport interface McpInvocationTarget {\n readonly profile: string;\n readonly allowOwnerProfile?: true;\n readonly stateRoot?: string;\n}\n\n/* Project one startup selection into the only owner-sensitive target shape. /\nexport function invocationTargetForMcp(\n selection: McpStartupSelection,\n): McpInvocationTarget {\n return {\n profile: selection.profile,\n ...(selection.explicitProfile && selection.allowOwnerProfile\n ? { allowOwnerProfile: true }\n : {}),\n ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n };\n}\n\ninterface CatalogOperation {\n readonly id: string;\n readonly version: number;\n readonly title: string;\n readonly description: string;\n readonly input: Record<string, unknown>;\n readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\n\ninterface ToolBinding {\n readonly name: ToolName;\n readonly operationId: string;\n readonly operationVersion: number;\n readonly readOnlyHint: boolean;\n readonly idempotentHint: boolean;\n readonly destructiveHint: boolean;\n readonly openWorldHint: boolean;\n}\n\nconst TOOL_BINDINGS: readonly ToolBinding[] = [\n {\n name: \"tinycloud_status\",\n operationId: \"tinycloud.status.get\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_status\",\n operationId: \"tinycloud.auth.status\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_capabilities\",\n operationId: \"tinycloud.auth.capabilities\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_request\",\n operationId: \"tinycloud.auth.request\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_auth_import\",\n operationId: \"tinycloud.auth.import\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: false,\n },\n {\n name: \"tinycloud_account_spaces_list\",\n operationId: \"tinycloud.account.spaces.list\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_account_applications_list\",\n operationId: \"tinycloud.account.applications.list\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_list\",\n operationId: \"tinycloud.kv.list\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_get\",\n operationId: \"tinycloud.kv.get\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_head\",\n operationId: \"tinycloud.kv.head\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_put\",\n operationId: \"tinycloud.kv.put\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: true,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_kv_delete\",\n operationId: \"tinycloud.kv.delete\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: true,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_sql_schema_inspect\",\n operationId: \"tinycloud.sql.schema.inspect\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_sql_query\",\n operationId: \"tinycloud.sql.query\",\n operationVersion: 1,\n readOnlyHint: true,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_sql_execute\",\n operationId: \"tinycloud.sql.execute\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: false,\n destructiveHint: true,\n openWorldHint: true,\n },\n {\n name: \"tinycloud_secrets_get\",\n operationId: \"tinycloud.secrets.get\",\n operationVersion: 1,\n readOnlyHint: false,\n idempotentHint: true,\n destructiveHint: false,\n openWorldHint: true,\n },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n const ajv = new Ajv({ strict: false });\n addFormats(ajv);\n return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n server: McpServer,\n selection: McpStartupSelection,\n validator: AjvJsonSchemaValidator,\n): void {\n const definitions = new Map(\n generatedCatalog.operations.map((operation) => [\n `${operation.id}@${operation.version}`,\n operation,\n ]),\n );\n\n for (const binding of TOOL_BINDINGS) {\n const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n if (operation === undefined) {\n throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n }\n\n const inputSchema = fromJsonSchema(\n operation.input as Parameters<typeof fromJsonSchema>[0],\n validator,\n );\n const outputSchema = fromJsonSchema(\n operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n validator,\n );\n const annotations: ToolAnnotations = {\n readOnlyHint: binding.readOnlyHint,\n idempotentHint: binding.idempotentHint,\n destructiveHint: binding.destructiveHint,\n openWorldHint: binding.openWorldHint,\n };\n\n server.registerTool(\n binding.name,\n {\n title: operation.title,\n description: operation.description,\n inputSchema,\n outputSchema,\n annotations,\n },\n async (input: unknown): Promise<McpToolResult> => {\n const result = await invokeOperation(\n binding.operationId,\n binding.operationVersion,\n invocationTargetForMcp(selection),\n input,\n );\n const projected = selection.transformOperationResult === undefined\n ? result\n : await selection.transformOperationResult(result);\n return toMcpToolResult(projected);\n },\n );\n }\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n return TOOL_BINDINGS;\n}\n","/\n MCP has one structured result channel for a TinyCloud operation. Text is a\n * fixed, non-sensitive status line; it never serializes the operation result.\n /\nexport interface CanonicalOperationResult {\n readonly status: \"ok\" \| \"authority_required\" \| \"setup_required\" \| \"error\";\n readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n readonly content: [{ readonly type: \"text\"; readonly text: string }];\n readonly structuredContent: CanonicalOperationResult;\n}\n\nexport function toMcpToolResult(result: unknown): McpToolResult {\n const canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n ? result\n : {\n status: \"error\",\n operation: {},\n context: {},\n error: { code: \"INTERNAL_ERROR\" },\n };\n\n return {\n content: [{ type: \"text\", text: resultSummary(canonical.status) }],\n structuredContent: canonical,\n };\n}\n\n/* The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n if (value === null \|\| typeof value !== \"object\" \|\| Array.isArray(value)) return false;\n const status = (value as { status?: unknown }).status;\n return status === \"ok\" \|\|\n status === \"authority_required\" \|\|\n status === \"setup_required\" \|\|\n status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n switch (status) {\n case \"ok\":\n return \"TinyCloud operation completed; use the structured result.\";\n case \"authority_required\":\n return \"TinyCloud authority is required; use the structured request and approval action.\";\n case \"setup_required\":\n return \"TinyCloud setup is required; use the structured setup action.\";\n case \"error\":\n return \"TinyCloud operation failed; use the structured error.\";\n }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","{\n \"name\": \"@tinycloud/mcp\",\n \"version\": \"0.3.4-beta.5\",\n \"description\": \"TinyCloud delegated operations MCP server\",\n \"keywords\": [\n \"tinycloud\",\n \"mcp\",\n \"model-context-protocol\",\n \"agents\",\n \"delegation\",\n \"ucan\",\n \"kv\",\n \"sqlite\"\n ],\n \"author\": \"TinyCloud, Inc.\",\n \"license\": \"EGPL\",\n \"type\": \"module\",\n \"main\": \"dist/index.cjs\",\n \"module\": \"dist/index.js\",\n \"types\": \"dist/index.d.ts\",\n \"bin\": {\n \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n },\n \"exports\": {\n \".\": {\n \"types\": \"./dist/index.d.ts\",\n \"import\": \"./dist/index.js\",\n \"require\": \"./dist/index.cjs\"\n },\n \"./server\": {\n \"types\": \"./dist/server.d.ts\",\n \"import\": \"./dist/server.js\",\n \"require\": \"./dist/server.cjs\"\n },\n \"./tools\": {\n \"types\": \"./dist/tools.d.ts\",\n \"import\": \"./dist/tools.js\",\n \"require\": \"./dist/tools.cjs\"\n },\n \"./results\": {\n \"types\": \"./dist/results.d.ts\",\n \"import\": \"./dist/results.js\",\n \"require\": \"./dist/results.cjs\"\n },\n \"./http\": {\n \"types\": \"./dist/http.d.ts\",\n \"import\": \"./dist/http.js\",\n \"require\": \"./dist/http.cjs\"\n }\n },\n \"files\": [\n \"dist\",\n \"bin\",\n \"generated\",\n \"skills\"\n ],\n \"engines\": {\n \"node\": \">=20\"\n },\n \"scripts\": {\n \"build\": \"tsup\",\n \"clean\": \"rm -rf dist\",\n \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n \"typecheck\": \"tsc -p tsconfig.json\",\n \"start:http\": \"node dist/http-cli.js\",\n \"generate\": \"bun scripts/generate.ts\",\n \"check:generated\": \"bun scripts/generate.ts --check\"\n },\n \"dependencies\": {\n \"@modelcontextprotocol/node\": \"2.0.0-beta.4\",\n \"@modelcontextprotocol/server\": \"2.0.0-beta.4\",\n \"@tinycloud/node-sdk\": \"3.1.0-beta.3\",\n \"@tinycloud/node-sdk-wasm\": \"1.7.6\",\n \"@tinycloud/operations\": \"0.3.4-beta.5\",\n \"jose\": \"6.1.3\"\n },\n \"devDependencies\": {\n \"@modelcontextprotocol/client\": \"2.0.0-beta.4\",\n \"@types/node\": \"^20\",\n \"tsup\": \"^8.0.0\",\n \"typescript\": \"^5.9.3\"\n },\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n },\n \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,YAAY,eAAe;AAEpC,SAAS,qBAAqB;;;ACH9B;AAAA,EACE,aAAAA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACVP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,oBAAoB,QAAQ,iBAAkC;AAEvE,IAAM,mBAAmB;AASlB,SAAS,2BAA2B,QAAgD;AACzF,QAAM,OAAO,mBAAmB,IAAI,IAAI,OAAO,OAAO,CAAC;AACvD,SAAO;AAAA,IACL,MAAM,kBAAkB,OAAkC;AACxD,UAAI;AACF,cAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,UAC/C,QAAQ,OAAO;AAAA,UACf,UAAU,OAAO;AAAA,QACnB,CAAC;AACD,eAAO,SAAS,OAAO,SAAS,MAAM;AAAA,MACxC,SAAS,OAAO;AACd,YAAI,iBAAiB,OAAO,WAAW;AACrC,gBAAM,IAAI,WAAW,eAAe,cAAc,sCAAsC;AAAA,QAC1F;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,kBAAkB,aAA0C;AAChF,QAAM,WAAW,MAAM,MAAM,aAAa;AAAA,IACxC,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACtC,QAAQ,YAAY,QAAQ,GAAM;AAAA,EACpC,CAAC;AACD,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,iCAAiC;AACnE,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,MAAI,OAAO,SAAS,WAAW,YAAY,OAAO,SAAS,aAAa,UAAU;AAChF,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,SACP,OACA,SACA,QACU;AACV,MAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,WAAW,GAAG;AAC/D,UAAM,IAAI,WAAW,eAAe,cAAc,uDAAuD;AAAA,EAC3G;AACA,MAAI,OAAO,QAAQ,QAAQ,UAAU;AACnC,UAAM,IAAI,WAAW,eAAe,cAAc,yCAAyC;AAAA,EAC7F;AACA,QAAM,SAAS,OAAO,QAAQ,UAAU,WACpC,QAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,IACzC,CAAC;AACL,MAAI,OAAO,kBAAkB,UAAa,CAAC,OAAO,SAAS,OAAO,aAAa,GAAG;AAChF,UAAM,IAAI;AAAA,MACR,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,YAAY,QAAQ,KAAK,QAAQ,SAAS,KAAK;AAChE,QAAM,YAAY,MAAM,QAAQ,QAAQ,gBAAgB,CAAC,IACrD,QAAQ,gBAAgB,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACtF,CAAC;AACL,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,UAAU,IAAI,IAAI,OAAO,QAAQ;AAAA,IACjC,OAAO;AAAA,MACL,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAuC;AAC7D,SAAO,OAAO,KAAK,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAC9F;;;AChGA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,OAAO,OAAO,UAAU,SAAS,QAAQ,IAAI,iBAAiB;AACvE,SAAS,SAAS,YAAY;AAE9B;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,mBAAmB,WAAW,qBAAqB;AAC5D,SAAS,uBAAuB;AAEhC,IAAM,UAAU;AAChB,IAAM,qBAAqB,MAAM;AACjC,IAAM,wBAA2C;AAAA,EAC/C;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,oBAAoB,mBAAmB;AAAA,EACnD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,CAAC,oBAAoB,mBAAmB;AAAA,EACnD;AACF;AAqDO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,cAAc;AACZ,UAAM,sGAAsG;AAC5G,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,MAAwB;AAAA,EACpB;AAAA,EACA,gBAAgB,oBAAI,IAAoC;AAAA,EAEjE,YAAY,QAA2B;AACrC,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,gBAAgB,SAAyB;AACvC,WAAO,KAAK,KAAK,QAAQ,UAAU,WAAW,KAAK,UAAU,OAAO,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,cAAc,SAAiB,YAA+B,CAAC,GAA2B;AAC9F,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,QAAI,MAAM,KAAK,iBAAiB,QAAQ,SAAS,GAAG;AAClD,aAAO,EAAE,WAAW,MAAM,YAAY,OAAO,WAAW;AAAA,IAC1D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,SAAS,WAAW,aAAa,qBAAqB;AAChG,WAAO;AAAA,MACL,WAAW;AAAA,MACX,YAAY,OAAO;AAAA,MACnB,aAAa,KAAK,YAAY,OAAO;AAAA,MACrC,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,wBACJ,SACA,WACA,QACkB;AAClB,QAAI,CAAC,SAAS,MAAM,KAAK,OAAO,WAAW,qBAAsB,QAAO;AACxE,UAAM,UAAU,SAAS,OAAO,OAAO,IAAI,OAAO,UAAU;AAC5D,UAAM,YAAY,OAAO,SAAS,cAAc,WAAW,QAAQ,YAAY;AAC/E,UAAM,YAAY,MAAM,QAAQ,SAAS,SAAS,IAC9C,QAAQ,UAAU,OAAO,iBAAiB,IAC1C,CAAC;AACL,QAAI,cAAc,UAAa,UAAU,WAAW,EAAG,QAAO;AAC9D,UAAM,UAAU,MAAM,KAAK,eAAe,SAAS,WAAW,cAAc,WAAW,SAAS;AAChG,WAAO;AAAA,MACL,GAAG;AAAA,MACH,UAAU;AAAA,QACR,GAAI,SAAS,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AAAA,QACnD,MAAM;AAAA,QACN;AAAA,QACA,KAAK,KAAK,YAAY,OAAO;AAAA,QAC7B,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,OAAgC;AACrD,UAAM,UAAU,MAAM,KAAK,aAAa,OAAO,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ;AACtD,UAAM,WAAW,IAAI,IAAI,qBAAqB,KAAK,QAAQ,SAAS;AACpE,aAAS,aAAa,IAAI,SAAS,KAAK;AACxC,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,KAAK,OAAO;AAAA,MACZ,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,KAAK,QAAQ;AAAA,MACnB,KAAK,OAAO,KAAK,KAAK,UAAU,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,SAAS,WAAW;AAAA,MAC5E,aAAa,OAAO,KAAK,KAAK,UAAU;AAAA,QACtC,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,UACN,QAAQ,SAAS,cACb,+DACA;AAAA;AAAA;AAAA,UAGJ,GAAI,QAAQ,UAAU,WAAW,IAC7B,CAAC,IACD,CAAC,kCAAkC,QAAQ,UAAU,KAAK,IAAI,CAAC,gCAAgC;AAAA,QACrG,EAAE,KAAK,GAAG;AAAA,MACZ,CAAC,CAAC,EAAE,SAAS,WAAW;AAAA,MACxB,QAAQ,KAAK,QAAQ;AAAA,IACvB,CAAC;AACD,WAAO,GAAG,KAAK,QAAQ,YAAY,QAAQ,QAAQ,EAAE,CAAC,aAAa,OAAO,SAAS,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,iBAAiB,OAAe,SAAiC;AACrE,UAAM,SAAS,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AAClE,QAAI,OAAO,SAAS,MAAM,KAAK,SAAS,mBAAoB,OAAM,IAAI,MAAM,6BAA6B;AACzG,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAI,OAAO,WAAW,IAAI,IAAI,mBAAoB,OAAM,IAAI,MAAM,6BAA6B;AAC/F,UAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,QAAI,CAAC,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,2BAA2B;AAEhE,UAAM,UAAU,MAAM,KAAK,aAAa,OAAO,IAAI;AACnD,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ;AACtD,UAAI,QAAQ,SAAS,aAAa;AAChC,cAAM,KAAK,gBAAgB,QAAQ,SAAS,IAAI;AAAA,MAClD,OAAO;AACL,cAAM,KAAK,iBAAiB,QAAQ,SAAS,IAAI;AAAA,MACnD;AACA,YAAM,GAAG,KAAK,aAAa,OAAO,WAAW,QAAQ,KAAK,IAAI,eAAe,EAAE,OAAO,KAAK,CAAC;AAAA,IAC9F,SAAS,OAAO;AACd,YAAM,KAAK,gBAAgB,OAAO,EAAE,MAAM,MAAM,MAAS;AACzD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QACA,SACA,MACe;AACf,UAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,KAAK,iBAAiB,QAAQ,IAAI;AAClE,QAAI,QAAQ,UAAU,SAAS,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,cAAc,KAAK,KAAK,GAAG,CAAC,GAAG;AAClG,YAAM,IAAI,2BAA2B;AAAA,IACvC;AACA,UAAM,UAAU,CAAC,GAAG,KAAK,+BAA+B,CAAC;AACzD,QAAI,CAAC,iBAAiB,QAAQ,aAAa,OAAO,GAAG;AACnD,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,UAAM,UAAU,MAAM,SAAkC,KAAK,aAAa,OAAO,SAAS,CAAC;AAC3F,UAAM,YAAY,KAAK,aAAa,OAAO,SAAS,GAAG;AAAA,MACrD,GAAG;AAAA,MACH,UAAU,aAAa,KAAK,GAAG;AAAA,MAC/B,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,YAAY,KAAK,aAAa,OAAO,SAAS,GAAG;AAAA,MACrD,YAAY;AAAA,MACZ,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,iBACJ,QACA,SACA,MACe;AACf,QAAI,QAAQ,cAAc,OAAW,OAAM,IAAI,MAAM,+BAA+B;AAGpF,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,iBAAiB,QAAQ,IAAI;AACzD,QAAI,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,cAAc,KAAK,KAAK,GAAG,CAAC,EAAG,OAAM,IAAI,2BAA2B;AACzG,UAAM,aAAa,qBAAqB,MAAM,QAAQ,aAAa,KAAK,QAAQ,QAAQ;AACxF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,SAAS,SAAS,WAAW,OAAO,UAAU;AAAA,MAChD;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,eAAe,WAAW;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,WAAW,KAAM,OAAM,IAAI,MAAM,6CAA6C;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBACJ,QACA,MAC4D;AAC5D,UAAM,UAAU,oBAAoB,MAAM,OAAO,GAAG;AACpD,UAAM,OAAO,IAAI,cAAc,EAAE,MAAM,KAAK,QAAQ,SAAS,CAAC;AAC9D,UAAM,KAAK,eAAe,OAAO;AACjC,QAAI,CAAC,cAAc,KAAK,YAAY,OAAO,UAAU,GAAG;AACtD,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,cAAc,SAAyC;AAC3D,UAAM,WAAW,KAAK,UAAU,OAAO;AACvC,UAAM,UAAU,KAAK,cAAc,IAAI,QAAQ;AAC/C,QAAI,YAAY,OAAW,QAAO;AAClC,UAAM,eAAe,KAAK,kBAAkB,QAAQ,EAAE,QAAQ,MAAM;AAClE,WAAK,cAAc,OAAO,QAAQ;AAAA,IACpC,CAAC;AACD,SAAK,cAAc,IAAI,UAAU,YAAY;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAiB,QAAuB,WAAgD;AAC5F,UAAM,MAAM,MAAM,SAAkC,KAAK,aAAa,OAAO,SAAS,CAAC;AACvF,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI;AACF,YAAM,OAAO,IAAI,cAAc,EAAE,MAAM,KAAK,QAAQ,SAAS,CAAC;AAC9D,YAAM,KAAK,eAAe,GAAkC;AAC5D,aAAO,cAAc,KAAK,YAAY,OAAO,UAAU,KACrD,UAAU,KAAK,CAAC,QAAQ,cAAc,KAAK,KAAK,GAAG,CAAC;AAAA,IACxD,QAAQ;AACN,YAAM,GAAG,KAAK,aAAa,OAAO,SAAS,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,UAA0C;AAChE,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ;AACjE,UAAM,UAAU,KAAK,SAAS,SAAS;AACvC,UAAM,gBAAgB,KAAK,WAAW,cAAc,YAAY,OAAO,CAAC;AACxE,QAAI,MAAM,MAAM,SAAkC,OAAO;AACzD,QAAI;AACJ,QAAI,QAAQ,MAAM;AAChB,YAAM,YAAY,mBAAmB;AACrC,YAAM,UAAU;AAChB,mBAAa,UAAU;AACvB,YAAM,YAAY,SAAS,GAAG;AAAA,IAChC,OAAO;AACL,mBAAa,WAAW,GAAG;AAAA,IAC7B;AACA,UAAM,cAAc,KAAK,aAAa,SAAS;AAC/C,QAAI,CAAE,MAAM,WAAW,WAAW,GAAI;AACpC,YAAM,YAAY,aAAa;AAAA,QAC7B,MAAM;AAAA,QACN,MAAM,KAAK,QAAQ;AAAA,QACnB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,KAAK;AAAA,QACL;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,SAAS;AAAA,QACT,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa,KAAK,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AACA,WAAO,EAAE,WAAW,YAAY,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,YAAY,UAA0C;AAC1D,QAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,4BAA4B;AAClF,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ;AACjE,UAAM,MAAM,MAAM,SAAkC,KAAK,SAAS,SAAS,CAAC;AAC5E,QAAI,QAAQ,KAAM,OAAM,IAAI,MAAM,0CAA0C;AAC5E,WAAO,EAAE,WAAW,KAAK,YAAY,WAAW,GAAG,EAAE;AAAA,EACvD;AAAA,EAEA,MAAM,eACJ,SACA,WACA,MACA,aACA,WAC0B;AAC1B,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,UAAM,WAAW,KAAK,UAAU,OAAO;AACvC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK,kBAAkB,OAAO,SAAS;AAAA,MACvC,EAAE,UAAU,MAAM,WAAW,aAAa,WAAW,UAAU,IAAI,YAAY,EAAE;AAAA,IACnF;AACA,QAAI,aAAa,OAAW,QAAO;AACnC,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAClD,UAAM,UAAU,KAAK,IAAI;AACzB,UAAM,UAA2B;AAAA,MAC/B,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C;AAAA,MACA,WAAW,UAAU,IAAI,YAAY;AAAA,MACrC,WAAW,IAAI,KAAK,OAAO,EAAE,YAAY;AAAA,MACzC,WAAW,IAAI,KAAK,UAAU,KAAK,QAAQ,qBAAqB,GAAI,EAAE,YAAY;AAAA,IACpF;AACA,UAAM,YAAY,KAAK,aAAa,OAAO,WAAW,KAAK,GAAG,OAAO;AACrE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,OAAe,SAA4C;AAC5E,UAAM,CAAC,UAAU,OAAO,SAAS,IAAI,MAAM,MAAM,GAAG;AACpD,QAAI,aAAa,UAAa,UAAU,UAAa,cAAc,QAAW;AAC5E,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,UAAM,WAAW,KAAK,WAAW,UAAU,KAAK;AAChD,UAAM,WAAW,OAAO,KAAK,WAAW,WAAW;AACnD,UAAM,gBAAgB,OAAO,KAAK,UAAU,WAAW;AACvD,QAAI,SAAS,WAAW,cAAc,UAAU,CAAC,gBAAgB,UAAU,aAAa,GAAG;AACzF,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ;AACjE,UAAM,OAAO,KAAK,aAAa,WAAW,KAAK;AAC/C,UAAM,UAAU,GAAG,IAAI;AACvB,QAAI,QAAS,OAAM,OAAO,MAAM,OAAO;AACvC,QAAI;AACF,YAAM,UAAU,MAAM,SAA0B,UAAU,UAAU,IAAI;AACxE,UAAI,YAAY,QAAQ,QAAQ,YAAY,KAAK,QAAQ,aAAa,YAAY,QAAQ,UAAU,OAAO;AACzG,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAC9D;AACA,UAAI,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,GAAG;AACvD,cAAM,GAAG,UAAU,UAAU,MAAM,EAAE,OAAO,KAAK,CAAC;AAClD,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,QAAS,OAAM,OAAO,SAAS,IAAI,EAAE,MAAM,MAAM,MAAS;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAyC;AAC7D,UAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AACzE,UAAM,OAAO,KAAK,aAAa,WAAW,QAAQ,KAAK;AACvD,UAAM,OAAO,GAAG,IAAI,eAAe,IAAI;AAAA,EACzC;AAAA,EAEA,YAAY,SAAkC;AAC5C,UAAM,MAAM,IAAI,IAAI,YAAY,KAAK,QAAQ,SAAS;AACtD,QAAI,aAAa,IAAI,SAAS,GAAG,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,KAAK,WAAW,QAAQ,UAAU,QAAQ,KAAK,CAAC,EAAE;AACxH,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA,EAEA,UAAU,SAAyB;AACjC,WAAO,WAAW,UAAU,KAAK,QAAQ,WAAW,EAAE,OAAO,UAAU,OAAO,EAAE,EAAE,OAAO,KAAK;AAAA,EAChG;AAAA,EAEA,WAAW,UAAkB,OAAuB;AAClD,WAAO,WAAW,UAAU,KAAK,QAAQ,WAAW,EACjD,OAAO,YAAY,QAAQ,IAAI,KAAK,EAAE,EACtC,OAAO,WAAW;AAAA,EACvB;AAAA,EAEA,aAAa,WAA2B;AACtC,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,cAAc;AAAA,EAC1E;AAAA,EAEA,SAAS,WAA2B;AAClC,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,UAAU;AAAA,EACtE;AAAA,EAEA,aAAa,WAA2B;AACtC,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,cAAc;AAAA,EAC1E;AAAA,EAEA,aAAa,WAAmB,OAAuB;AACrD,WAAO,KAAK,KAAK,kBAAkB,SAAS,GAAG,GAAG,KAAK,OAAO;AAAA,EAChE;AAAA,EAEA,kBAAkB,WAA2B;AAC3C,WAAO,KAAK,WAAW,cAAc,YAAY,SAAS,SAAS;AAAA,EACrE;AACF;AAEA,IAAI,kBAAkB;AAEtB,SAAS,qBAAoE;AAC3E,aAAW;AACX,QAAM,UAAU,IAAI,kBAAkB;AACtC,QAAM,QAAQ,QAAQ,iBAAiB,YAAY;AACnD,QAAM,aAAa,QAAQ,IAAI,KAAK;AACpC,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,6CAA6C;AAC9E,SAAO,EAAE,KAAK,KAAK,MAAM,UAAU,GAA8B,KAAK,QAAQ,OAAO,KAAK,EAAE;AAC9F;AAEA,SAAS,WAAW,KAAsC;AACxD,aAAW;AACX,QAAM,UAAU,IAAI,kBAAkB;AACtC,QAAM,QAAQ,UAAU,SAAS,KAAK,UAAU,GAAG,GAAG,YAAY;AAClE,SAAO,QAAQ,OAAO,KAAK;AAC7B;AAEA,SAAS,aAAmB;AAC1B,MAAI,gBAAiB;AACrB,gBAAc;AACd,oBAAkB;AACpB;AAEA,SAAS,oBAAoB,MAA+B,YAAsD;AAChH,QAAM,mBAAmB,KAAK;AAC9B,MAAI,CAAC,SAAS,gBAAgB,KAAK,OAAO,iBAAiB,kBAAkB,YAC3E,OAAO,KAAK,kBAAkB,YAAY,OAAO,KAAK,YAAY,YAClE,OAAO,KAAK,uBAAuB,UAAU;AAC7C,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,kBAAkB,EAAE,eAAe,iBAAiB,cAAc;AAAA,IAClE,eAAe,KAAK;AAAA,IACpB,SAAS,KAAK;AAAA,IACd,KAAK;AAAA,IACL,oBAAoB,KAAK;AAAA,IACzB,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IACpE,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IACpE,GAAI,OAAO,KAAK,SAAS,WAAW,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IAC3D,GAAI,OAAO,KAAK,cAAc,WAAW,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,EAC5E;AACF;AAEA,SAAS,qBACP,MACA,aACA,MACoB;AACpB,QAAM,UAAU,YAAY,KAAK,CAAC,eAAe,WAAW,YAAY,sBAAsB,KAAK,YAAY,CAAC;AAChH,MAAI,YAAY,OAAW,OAAM,IAAI,MAAM,2CAA2C;AACtF,QAAM,UAAU,oBAAoB,MAAM,CAAC,CAAC;AAC5C,QAAM,SAAS,iBAAiB,IAAI;AACpC,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,kBAAkB,QAAQ;AAAA,IAC1B,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ;AAAA,IACd,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,IAC5B,WAAW,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC1C,SAAS,WAAW,QAAQ,WAAW,YAAY,IAC/C,WAAW,QAAQ,MAAM,aAAa,MAAM,IAC5C,WAAW;AAAA,MACf,OAAO,WAAW,YAAY,yBAC1B,wBAAwB,UAAU,IAClC,QAAQ;AAAA,MACZ,MAAM,WAAW;AAAA,MACjB,SAAS,CAAC,GAAG,WAAW,OAAO;AAAA,IACjC,EAAE;AAAA,IACF;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,cAAc,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IAChE,SAAS,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,MAAqC;AAC7D,aAAW,OAAO,CAAC,UAAU,aAAa,gBAAgB,GAAG;AAC3D,UAAM,SAAS,UAAU,KAAK,GAAG,CAAC;AAClC,QAAI,WAAW,OAAW,QAAO;AAAA,EACnC;AACA,MAAI,OAAO,KAAK,SAAS,UAAU;AACjC,UAAM,QAAQ,KAAK,KAAK,MAAM,6BAA6B;AAC3D,UAAM,SAAS,UAAU,QAAQ,CAAC,GAAG,KAAK,CAAC;AAC3C,QAAI,WAAW,OAAW,QAAO;AAAA,EACnC;AACA,QAAM,IAAI,MAAM,6CAA6C;AAC/D;AAEA,SAAS,iBAAiB,WAA8B,SAAqC;AAC3F,SAAO,UAAU,MAAM,CAAC,YAAY,QAAQ;AAAA,IAAK,CAAC,UAChD,iBAAiB,MAAM,OAAO,MAAM,iBAAiB,QAAQ,OAAO,KACpE,OAAO,MAAM,UAAU,YAAY,OAAO,QAAQ,UAAU,YAC5D,UAAU,MAAM,OAAO,QAAQ,KAAK,KACpC,MAAM,SAAS,QAAQ,QACvB,QAAQ,QAAQ,MAAM,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AACH;AAEA,SAAS,UAAU,SAAiB,WAA4B;AAC9D,SAAO,YAAY,aAAa,QAAQ,SAAS,IAAI,SAAS,EAAE;AAClE;AAEA,SAAS,iBAAiB,SAAyB;AACjD,SAAO,QAAQ,WAAW,YAAY,IAAI,UAAU,aAAa,OAAO;AAC1E;AAEA,SAAS,wBAAwB,YAAqC;AACpE,MAAI,OAAO,WAAW,UAAU,SAAU,OAAM,IAAI,MAAM,qCAAqC;AAC/F,SAAO,WAAW;AACpB;AAEA,SAAS,UAAU,KAAuD;AACxE,QAAM,OAAO,EAAE,GAAG,IAAI;AACtB,aAAW,SAAS,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG,EAAG,QAAO,KAAK,KAAK;AACpF,SAAO;AACT;AAEA,SAAS,cAAc,MAA0B,OAAwB;AACvE,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,WAAO,mBAAmB,MAAM,KAAK;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,OAAuB;AAC3C,SAAO,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B;AAEA,SAAS,kBAAkB,OAA0C;AACnE,SAAO,SAAS,KAAK,KAAK,OAAO,MAAM,YAAY,YAAY,OAAO,MAAM,UAAU,YACpF,OAAO,MAAM,SAAS,YAAY,MAAM,QAAQ,MAAM,OAAO,KAC7D,MAAM,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ;AAC9D;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO;AACnE,QAAM,OAAO,IAAI,KAAK,OAAO,UAAU,YAAY,QAAQ,OAAiB,QAAQ,MAAO,KAAK;AAChG,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,SAAY;AACpD;AAEA,eAAe,gBAAgB,MAA6B;AAC1D,QAAM,MAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,MAAM,MAAM,GAAK;AACzB;AAEA,eAAe,YAAY,MAAc,OAA+B;AACtE,QAAM,YAAY,QAAQ,IAAI;AAC9B,QAAM,gBAAgB,SAAS;AAC/B,QAAM,YAAY,GAAG,IAAI,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC1E,QAAM,UAAU,WAAW,GAAG,KAAK,UAAU,OAAO,cAAc,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACzF,QAAM,OAAO,WAAW,IAAI;AAC5B,QAAM,MAAM,MAAM,GAAK;AACzB;AAEA,SAAS,aAAa,MAAc,OAAyB;AAC3D,SAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAEA,eAAe,SAAY,MAAiC;AAC1D,MAAI;AACF,WAAO,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,SAAS,KAAK,KAAK,MAAM,SAAS,SAAU,QAAO;AACvD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,WAAW,MAAgC;AACxD,SAAQ,MAAM,SAAkB,IAAI,MAAO;AAC7C;AAEA,eAAe,gBACb,WACA,UACsC;AACtC,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,SAAS,KAAK,KAAK,MAAM,SAAS,SAAU,QAAO;AACvD,UAAM;AAAA,EACR;AACA,QAAM,SAA4B,CAAC;AACnC,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,UAAM,OAAO,KAAK,WAAW,IAAI;AACjC,UAAM,UAAU,MAAM,SAA0B,IAAI,EAAE,MAAM,MAAM,IAAI;AACtE,QAAI,YAAY,QAAQ,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC3E,YAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAC9B;AAAA,IACF;AACA,WAAO,KAAK,OAAO;AACnB,QAAI,mBAAmB,SAAS,QAAQ,EAAG,QAAO;AAAA,EACpD;AACA,MAAI,OAAO,UAAU,IAAI;AACvB,WAAO,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,SAAS,CAAC;AACrF,UAAM,GAAG,KAAK,WAAW,GAAG,OAAO,CAAC,EAAG,KAAK,OAAO,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,mBACP,SACA,UACS;AACT,SAAO,QAAQ,YAAY,KAAK,QAAQ,aAAa,SAAS,YAC5D,QAAQ,SAAS,SAAS,QAAQ,QAAQ,cAAc,SAAS,aACjE,KAAK,UAAU,QAAQ,WAAW,MAAM,KAAK,UAAU,SAAS,WAAW,KAC3E,KAAK,UAAU,QAAQ,SAAS,MAAM,KAAK,UAAU,SAAS,SAAS;AAC3E;;;ACtoBA,SAAS,iBAAiB;AAC1B,SAAS,kBAA0C;;;ACDnD,SAAS,qBAAqB;AAC9B,SAAS,QAAAC,aAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,YAAY,KAAK,8BAA8B;AACxD,SAAS,mBAAAC,wBAAuB;;;ACSzB,SAAS,gBAAgB,QAAgC;AAC9D,QAAM,YAAsC,2BAA2B,MAAM,IACzE,SACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AAEF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,cAAc,UAAU,MAAM,EAAE,CAAC;AAAA,IACjE,mBAAmB;AAAA,EACrB;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;ADRO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAmBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAWC,MAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AAYA,IAAM,gBAAwC;AAAA,EAC5C;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,IAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,aAAW,GAAG;AACd,SAAO,IAAI,uBAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,SAAS,MAAMC;AAAA,UACnB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,uBAAuB,SAAS;AAAA,UAChC;AAAA,QACF;AACA,cAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,MAAM;AACnD,eAAO,gBAAgB,SAAS;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;;;AE9SA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;AJIpC,IAAM,kBAAkB;;;AHY/B,IAAM,iBAAiB;AAYhB,SAAS,mBAAmB,QAAuC;AACxE,QAAM,cAAc,qBAAqB,OAAO,SAAS;AACzD,QAAM,SAAS,OAAO,OAAO,cAAc,MAAM;AACjD,QAAM,UAAU,OAAO,OAAO,cAAc,QAAQ;AACpD,QAAM,WAAW,2BAA2B;AAAA,IAC1C;AAAA,IACA,UAAU,YAAY,SAAS;AAAA,IAC/B;AAAA,IACA,eAAe;AAAA,EACjB,CAAC;AACD,QAAM,sBAAsB,qCAAqC,WAAW;AAC5E,QAAM,eAAe,kBAAkB;AAAA,IACrC;AAAA,IACA,gBAAgB,CAAC,cAAc;AAAA,IAC/B;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,IAAI,kBAAkB,EAAE,GAAG,QAAQ,WAAW,YAAY,CAAC;AACzE,QAAM,UAAU,iBAAiB,OAAO,EAAE,UAAAC,UAAS,MAAM;AACvD,UAAM,WAAW,cAAcA,SAAQ;AACvC,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,UAAM,YAAY,MAAM,gBAAgB,OAAO;AAC/C,UAAM,YAAY,0BAA0B;AAC5C,UAAM,SAAS,IAAIC;AAAA,MACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,MAC9C;AAAA,QACE,qBAAqB;AAAA,QACrB,cAAc;AAAA,MAChB;AAAA,IACF;AACA,2BAAuB,QAAQ;AAAA,MAC7B,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB;AAAA,MACA,0BAA0B,CAAC,WAAW,MAAM,wBAAwB,SAAS,WAAW,MAAM;AAAA,IAChG,GAAG,SAAS;AACZ,wBAAoB,QAAQ,WAAW,OAAO,QAAQ;AACtD,WAAO;AAAA,EACT,GAAG;AAAA,IACD,QAAQ;AAAA,IACR,SAAS,MAAM,gBAAgB,oBAAoB;AAAA,EACrD,CAAC;AAED,QAAM,kBAAkB;AAAA,IACtB,eAAe,OAAO;AAAA,IACtB,mBAAmB;AAAA,IACnB,yBAAyB,IAAI,IAAI,oCAAoC;AAAA,IACrE,iBAAiB,CAAC,cAAc;AAAA,IAChC,cAAc;AAAA,EAChB;AACA,QAAM,eAAe,CAAC,YAAY,QAAQ;AAE1C,SAAO;AAAA,IACL,MAAM,MAAM,SAAqC;AAC/C,YAAM,WAAW,sBAAsB,SAAS,eAAe;AAC/D,UAAI,aAAa,OAAW,QAAO;AACnC,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAI,IAAI,aAAa,YAAY;AAC/B,eAAO,QAAQ,WAAW,QACtB,KAAK,EAAE,IAAI,KAAK,CAAC,IACjB,iBAAiB,KAAK;AAAA,MAC5B;AACA,YAAM,cAAc,6BAA6B,SAAS,YAAY;AACtE,UAAI,gBAAgB,OAAW,QAAO;AAEtC,UAAI,IAAI,aAAa,YAAY;AAC/B,YAAI,QAAQ,WAAW,MAAO,QAAO,iBAAiB,KAAK;AAC3D,YAAI;AACF,gBAAM,cAAc,MAAM,MAAM,iBAAiB,cAAc,GAAG,CAAC;AACnE,iBAAO,SAAS,SAAS,aAAa,GAAG;AAAA,QAC3C,QAAQ;AACN,iBAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;AAAA,QACxE;AAAA,MACF;AACA,UAAI,IAAI,aAAa,qBAAqB;AACxC,YAAI,QAAQ,WAAW,UAAW,QAAO,aAAa,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC,GAAG,OAAO,WAAW;AAC7G,YAAI,QAAQ,WAAW,OAAQ,QAAO,iBAAiB,MAAM;AAC7D,cAAMC,iBAAgB,uBAAuB,SAAS,OAAO,WAAW;AACxE,YAAIA,mBAAkB,OAAW,QAAO,aAAaA,gBAAe,OAAO,WAAW;AACtF,YAAI;AACF,gBAAM,MAAM,iBAAiB,cAAc,GAAG,GAAG,OAAO;AACxD,iBAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,OAAO,WAAW;AAAA,QACjE,SAAS,OAAO;AAEd,iBAAO;AAAA,YACL,iBAAiB,6BACb,KAAK,EAAE,OAAO,MAAM,SAAS,MAAM,0BAA0B,GAAG,GAAG,IACnE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;AAAA,YACtE,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,UAAI,IAAI,aAAa,YAAY,SAAU,QAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAClF,YAAM,gBAAgB,eAAe,SAAS,OAAO,cAAc;AACnE,UAAI,kBAAkB,OAAW,QAAO;AACxC,YAAM,OAAO,MAAM,aAAa,OAAO;AACvC,UAAI,gBAAgB,SAAU,QAAO;AACrC,aAAO,QAAQ,MAAM,SAAS,EAAE,UAAU,KAAK,CAAC;AAAA,IAClD;AAAA,IACA,OAAO,MAAM,QAAQ,MAAM;AAAA,EAC7B;AACF;AAEA,SAAS,oBACP,QACA,WACA,OACA,UACM;AACN,QAAM,cAAcC,gBAAe,EAAE,MAAM,UAAU,YAAY,CAAC,GAAG,sBAAsB,MAAM,GAAG,SAAS;AAC7G,QAAM,eAAeA,gBAAe;AAAA,IAClC,MAAM;AAAA,IACN,YAAY;AAAA,MACV,WAAW,EAAE,MAAM,UAAU;AAAA,MAC7B,YAAY,EAAE,MAAM,SAAS;AAAA,MAC7B,aAAa,EAAE,MAAM,UAAU,QAAQ,MAAM;AAAA,MAC7C,WAAW,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,IACnD;AAAA,IACA,UAAU,CAAC,aAAa,YAAY;AAAA,IACpC,sBAAsB;AAAA,EACxB,GAAG,SAAS;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,cAAc;AAAA,QACd,gBAAgB;AAAA,QAChB,iBAAiB;AAAA,QACjB,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,YAAY;AACV,YAAM,SAAS,MAAM,MAAM,cAAc,SAAS,SAAS,SAAS,SAAS;AAC7E,aAAO;AAAA,QACL,SAAS,CAAC;AAAA,UACR,MAAM;AAAA,UACN,MAAM,OAAO,YACT,4BACA;AAAA,QACN,CAAC;AAAA,QACD,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;AAOA,SAAS,cAAcH,WAA+C;AACpE,QAAM,UAAUA,WAAU,OAAO;AACjC,MAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,YAAYA,WAAU,OAAO;AACnC,MAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,WAAW,KACpD,CAAC,UAAU,MAAM,CAAC,QAAQ,OAAO,QAAQ,QAAQ,GAAG;AACpD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO,EAAE,SAAS,UAAU;AAC9B;AAEA,SAAS,qBAAqB,KAAe;AAC3C,QAAM,WAAW,IAAI,IAAI,GAAG;AAC5B,WAAS,OAAO;AAChB,WAAS,SAAS;AAClB,WAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ,EAAE,KAAK;AAC7D,MAAI,SAAS,aAAa,IAAK,UAAS,WAAW;AACnD,SAAO;AACT;AAEA,SAAS,cAAc,KAAkB;AACvC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,MAAI,UAAU,QAAQ,MAAM,SAAS,IAAK,OAAM,IAAI,MAAM,yBAAyB;AACnF,SAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA8D;AACtG,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,YAAY,WAAW,CAAC;AAC9B,SAAO,UAAU,SAAS,MAAM,IAAI,SAAY,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;AAC/F;AAEA,SAAS,uBAAuB,SAAkB,aAA2C;AAC3F,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,SAAO,WAAW,QAAQ,WAAW,IAAI,IAAI,WAAW,EAAE,SACtD,SACA,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;AACnD;AAEA,SAAS,aAAa,UAAoB,aAA+B;AACvE,QAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAC5C,UAAQ,IAAI,+BAA+B,IAAI,IAAI,WAAW,EAAE,MAAM;AACtE,UAAQ,IAAI,gCAAgC,eAAe;AAC3D,UAAQ,IAAI,gCAAgC,cAAc;AAC1D,UAAQ,IAAI,QAAQ,QAAQ;AAC5B,SAAO,IAAI,SAAS,SAAS,MAAM,EAAE,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AACzE;AAEA,SAAS,KAAK,OAAgB,SAAS,KAAe;AACpD,SAAO,SAAS,KAAK,OAAO,EAAE,QAAQ,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AAClF;AAEA,SAAS,iBAAiB,OAAyB;AACjD,SAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/E;AAEA,SAAS,gBAAgB,SAAuB;AAC9C,UAAQ,OAAO,MAAM,wBAAwB,OAAO;AAAA,CAAI;AAC1D;;;AD9OA,eAAsB,OAAsB;AAC1C,UAAQ,MAAM,EAAK;AACnB,QAAM,YAAY,YAAY,mBAAmB;AACjD,QAAM,WAAW,qBAAqB,kBAAkB;AACxD,QAAM,cAAc,eAAe,qBAAqB;AACxD,MAAI,OAAO,WAAW,WAAW,IAAI,GAAI,OAAM,IAAI,MAAM,qDAAqD;AAC9G,QAAM,cAAc,QAAQ,IAAI,mBAAmB;AACnD,QAAM,mBAAmB,IAAI;AAAA,IAC3B,QAAQ,IAAI,6BACV;AAAA,EACJ;AACA,QAAM,gBAAgB,MAAM,kBAAkB,gBAAgB;AAC9D,QAAM,MAAM,mBAAmB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,IAAI,WAAW;AAAA,IACjC;AAAA,IACA,oBAAoB,gBAAgB,QAAQ,IAAI,6BAA6B,GAAG;AAAA,IAChF,kBAAkB,QAAQ,IAAI,4BAA4B;AAAA,IAC1D,gBAAgB,UAAU,QAAQ,IAAI,sBAAsB;AAAA,IAC5D;AAAA,EACF,CAAC;AACD,QAAM,cAAc,cAAc,GAAG;AACrC,QAAM,SAAS,aAAa,WAAW;AACvC,QAAM,OAAO,QAAQ,IAAI,QAAQ;AACjC,QAAM,OAAO,gBAAgB,QAAQ,IAAI,MAAM,GAAI;AACnD,SAAO,OAAO,MAAM,MAAM,MAAM;AAC9B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AACD,QAAM,WAAW,MAAM;AACrB,WAAO,MAAM,MAAM,KAAK,IAAI,MAAM,CAAC;AAAA,EACrC;AACA,UAAQ,KAAK,UAAU,QAAQ;AAC/B,UAAQ,KAAK,WAAW,QAAQ;AAClC;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,QAAQ,QAAQ,IAAI,IAAI,GAAG,KAAK;AACtC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,IAAI,eAAe;AAClD,SAAO;AACT;AAEA,SAAS,YAAY,MAAmB;AACtC,QAAM,MAAM,IAAI,IAAI,eAAe,IAAI,CAAC;AACxC,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,eAAe,IAAI,aAAa,aAAa;AAC7F,UAAM,IAAI,MAAM,GAAG,IAAI,oCAAoC;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAsB;AAClD,QAAM,QAAQ,eAAe,IAAI;AACjC,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,4BAA4B;AAC3E,SAAO,QAAQ,KAAK;AACtB;AAEA,SAAS,gBAAgB,OAA2B,UAA0B;AAC5E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,EAAG,OAAM,IAAI,MAAM,gDAAgD;AAC9G,SAAO;AACT;AAEA,SAAS,UAAU,OAAiD;AAClE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO;AACrE;AAEA,KAAK,KAAK,EAAE,MAAM,MAAM;AACtB,UAAQ,OAAO,MAAM,wCAAwC;AAC7D,UAAQ,WAAW;AACrB,CAAC;","names":["McpServer","fromJsonSchema","join","invokeOperation","join","invokeOperation","authInfo","McpServer","originFailure","fromJsonSchema"]}

package/dist/http.cjs CHANGED Viewed

@@ -829,7 +829,7 @@ function registerTinyCloudTools(server, selection, validator) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.3.4-beta.4",
+  version: "0.3.4-beta.5",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -900,9 +900,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.4",
     "@modelcontextprotocol/server": "2.0.0-beta.4",
-    "@tinycloud/node-sdk": "3.1.0-beta.2",
+    "@tinycloud/node-sdk": "3.1.0-beta.3",
     "@tinycloud/node-sdk-wasm": "1.7.6",
-    "@tinycloud/operations": "0.3.4-beta.4",
+    "@tinycloud/operations": "0.3.4-beta.5",
     jose: "6.1.3"
   },
   devDependencies: {