@vurb/swarm 3.8.2

package/dist/SwarmGateway.d.ts

@@ -0,0 +1,146 @@
+import type { HandoffPayload, HandoffStateStore, ToolResponse } from '@vurb/core';
+import type { Tool as McpTool } from '@modelcontextprotocol/sdk/types.js';
+export interface SwarmGatewayConfig {
+    /**
+     * Domain → upstream URI registry.
+     * @example `{ finance: 'http://finance-agent:8081', devops: 'http://devops-agent:8082' }`
+     */
+    registry: Record<string, string>;
+    /** HMAC secret shared with all upstream micro-servers. */
+    delegationSecret: string;
+    /** Store for Claim-Check pattern (state > 2 KB). Defaults to InMemory. */
+    stateStore?: HandoffStateStore;
+    /** Upstream connection timeout in ms (default: 5 000). */
+    connectTimeoutMs?: number;
+    /** Tunnel idle timeout in ms (default: 300 000 = 5 min). */
+    idleTimeoutMs?: number;
+    /** Delegation token TTL in seconds (default: 60). */
+    tokenTtlSeconds?: number;
+    /**
+     * Upstream transport selection.
+     * - `'auto'` (default): SSE on Node.js, HTTP on edge runtimes
+     * - `'sse'`: Always use SSE (persistent connection)
+     * - `'http'`: Always use Streamable HTTP (stateless, edge-compatible)
+     */
+    upstreamTransport?: 'auto' | 'sse' | 'http';
+    /**
+     * Name used for the return-trip tool.
+     * Default: `'gateway'` → tool name `'gateway.return_to_triage'`
+     */
+    gatewayName?: string;
+    /**
+     * Maximum number of concurrent active handoff sessions.
+     * Excess activations are rejected with `REGISTRY_SESSION_LIMIT_EXCEEDED`.
+     * Default: 100.
+     */
+    maxSessions?: number;
+}
+/**
+ * SwarmGateway — B2BUA for multi-agent MCP orchestration.
+ *
+ * @example
+ * ```typescript
+ * import { SwarmGateway } from '@vurb/swarm';
+ *
+ * const gateway = new SwarmGateway({
+ *     registry: {
+ *         finance: 'http://finance-agent:8081',
+ *         devops:  'http://devops-agent:8082',
+ *     },
+ *     delegationSecret: process.env.VURB_DELEGATION_SECRET!,
+ * });
+ *
+ * // Pass to attachToServer:
+ * registry.attachToServer(server, { swarmGateway: gateway });
+ * ```
+ */
+export declare class SwarmGateway {
+    private readonly _config;
+    private readonly _sessions;
+    private readonly _rewriter;
+    private readonly _closingSessions;
+    constructor(config: SwarmGatewayConfig);
+    /**
+     * Activate a handoff tunnel to the upstream server described by `payload`.
+     *
+     * Called by `ServerAttachment` after detecting a `HandoffResponse` from a
+     * tool handler. Connects asynchronously — does not block the ACK to the LLM.
+     *
+     * **Concurrent safety**: If an activation is already in progress or active
+     * for `sessionId`, the previous session is disposed before the new one starts.
+     *
+     * @param payload    - Handoff payload produced by `f.handoff()`
+     * @param sessionId  - MCP session ID (used to key the active tunnel)
+     * @param signal     - AbortSignal tied to the parent MCP connection
+     * @throws If the target is not found in the registry
+     * @throws If the session limit is exceeded
+     */
+    activateHandoff(payload: HandoffPayload, sessionId: string, signal: AbortSignal): Promise<void>;
+    /**
+     * Proxy the tools/list for an active session.
+     *
+     * Returns `null` for non-existent sessions.
+     * Returns only the return-trip escape tool if the upstream is unreachable.
+     * Returns an empty list while the session is still connecting.
+     */
+    proxyToolsList(sessionId: string): Promise<McpTool[] | null>;
+    /**
+     * Proxy a tools/call for an active session.
+     *
+     * Strips the namespace prefix before forwarding to the upstream.
+     *
+     * @returns The upstream's ToolResponse, or `null` if no active tunnel.
+     */
+    proxyToolsCall(sessionId: string, name: string, args: Record<string, unknown>, signal: AbortSignal): Promise<ToolResponse | null>;
+    /**
+     * Close the tunnel for `sessionId` and restore the gateway's tool list.
+     *
+     * Called when the LLM invokes the `gateway.return_to_triage` tool.
+     * `ServerAttachment` emits `notifications/tools/list_changed` after this.
+     */
+    returnToGateway(sessionId: string): Promise<void>;
+    /**
+     * `true` if there is a tracked tunnel (connecting or active) for the given session.
+     *
+     * Returning `true` during `'connecting'` ensures `ServerAttachment` routes
+     * tools/call through `proxyToolsCall`, which already returns the correct
+     * `HANDOFF_CONNECTING` error for in-progress tunnels — preventing gateway-local
+     * execution from silently bypassing the handoff.
+     */
+    hasActiveHandoff(sessionId: string): boolean;
+    /** `true` if an activation is in progress for the given session. */
+    isConnecting(sessionId: string): boolean;
+    /**
+     * Total number of tracked sessions (connecting + active).
+     *
+     * exposed for integration testing and observability.
+     * Allows tests to assert session lifecycle transitions deterministically
+     * without accessing private state via casting.
+     */
+    get sessionCount(): number;
+    /**
+     * Number of sessions currently in the `'connecting'` state.
+     *
+     * useful for load-shedding checks and integration tests.
+     */
+    get connectingCount(): number;
+    /**
+     * Dispose all active sessions and release all resources.
+     *
+     * Call this when shutting down the gateway to cleanly close
+     * all upstream connections, idle timers, and AbortController listeners.
+     */
+    dispose(): Promise<void>;
+    private _closeSession;
+    /**
+     * Extract the domain key from a target URI.
+     *
+     * `'mcp://finance-agent.internal:8080'` → `'finance'` (registry lookup)
+     * `'finance'`                            → `'finance'` (direct key)
+     *
+     * @throws If the target does not resolve to any entry in the registry.
+     *         Configure all targets explicitly in `SwarmGatewayConfig.registry`.
+     */
+    private _resolveDomain;
+}
+//# sourceMappingURL=SwarmGateway.d.ts.map

package/dist/SwarmGateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SwarmGateway.d.ts","sourceRoot":"","sources":["../src/SwarmGateway.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAIlF,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAM1E,MAAM,WAAW,kBAAkB;IAC/B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IAErD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;gBAE1C,MAAM,EAAE,kBAAkB;IAiCtC;;;;;;;;;;;;;;OAcG;IACG,eAAe,CACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GACpB,OAAO,CAAC,IAAI,CAAC;IAiEhB;;;;;;OAMG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;IAsBlE;;;;;;OAMG;IACG,cAAc,CAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA6C/B;;;;;OAKG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI5C,oEAAoE;IACpE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIxC;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;OAIG;IACH,IAAI,eAAe,IAAI,MAAM,CAM5B;IAED;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAOhB,aAAa;IAsB3B;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;CAsCzB"}

package/dist/SwarmGateway.js

@@ -0,0 +1,347 @@
+/**
+ * Federated Handoff Protocol — SwarmGateway (B2BUA)
+ *
+ * The central orchestrator implementing the Back-to-Back User Agent pattern:
+ *
+ * - **External face (UAS)**: MCP server for the LLM client (Claude/Cursor)
+ * - **Internal face (UAC)**: MCP client for upstream micro-servers
+ *
+ * Lifecycle per session:
+ * 1. `activateHandoff()` — opens tunnel to upstream, mints delegation token
+ * 2. `proxyToolsList()`  — returns prefixed upstream tools + return-trip tool
+ * 3. `proxyToolsCall()`  — strips prefix, forwards to upstream
+ * 4. `returnToGateway()` — closes tunnel, session returns to gateway tools
+ *
+ * @module
+ */
+import { randomUUID } from 'node:crypto';
+import { mintDelegationToken, InMemoryHandoffStateStore, toolError, } from '@vurb/core';
+import { UpstreamMcpClient } from './UpstreamMcpClient.js';
+import { NamespaceRewriter, NamespaceError } from './NamespaceRewriter.js';
+import { injectReturnTripTool } from './ReturnTripInjector.js';
+// ============================================================================
+// SwarmGateway
+// ============================================================================
+/**
+ * SwarmGateway — B2BUA for multi-agent MCP orchestration.
+ *
+ * @example
+ * ```typescript
+ * import { SwarmGateway } from '@vurb/swarm';
+ *
+ * const gateway = new SwarmGateway({
+ *     registry: {
+ *         finance: 'http://finance-agent:8081',
+ *         devops:  'http://devops-agent:8082',
+ *     },
+ *     delegationSecret: process.env.VURB_DELEGATION_SECRET!,
+ * });
+ *
+ * // Pass to attachToServer:
+ * registry.attachToServer(server, { swarmGateway: gateway });
+ * ```
+ */
+export class SwarmGateway {
+    _config;
+    _sessions = new Map();
+    _rewriter = new NamespaceRewriter();
+    // tracks sessions currently being closed to prevent concurrent double-dispose
+    _closingSessions = new Set();
+    constructor(config) {
+        // validate registry — reject entries with empty URIs before they
+        // cause a silent `TypeError: Invalid URL` deep in _resolveTransport at runtime.
+        // An empty-string URI is always a configuration error, not a runtime edge case.
+        const emptyUriKeys = Object.entries(config.registry)
+            .filter(([, uri]) => !uri)
+            .map(([key]) => JSON.stringify(key));
+        if (emptyUriKeys.length > 0) {
+            throw Object.assign(new Error(`[vurb/swarm] Registry entries with empty URIs: ${emptyUriKeys.join(', ')}. ` +
+                'All registry values must be non-empty URI strings.'), { code: 'REGISTRY_INVALID_URI' });
+        }
+        this._config = {
+            stateStore: config.stateStore ?? new InMemoryHandoffStateStore(),
+            connectTimeoutMs: config.connectTimeoutMs ?? 5_000,
+            idleTimeoutMs: config.idleTimeoutMs ?? 300_000,
+            tokenTtlSeconds: config.tokenTtlSeconds ?? 60,
+            upstreamTransport: config.upstreamTransport ?? 'auto',
+            gatewayName: config.gatewayName ?? 'gateway',
+            // enforce a default session limit to prevent unbounded growth
+            maxSessions: config.maxSessions ?? 100,
+            registry: config.registry,
+            delegationSecret: config.delegationSecret,
+        };
+    }
+    // ── Public API ───────────────────────────────────────────
+    /**
+     * Activate a handoff tunnel to the upstream server described by `payload`.
+     *
+     * Called by `ServerAttachment` after detecting a `HandoffResponse` from a
+     * tool handler. Connects asynchronously — does not block the ACK to the LLM.
+     *
+     * **Concurrent safety**: If an activation is already in progress or active
+     * for `sessionId`, the previous session is disposed before the new one starts.
+     *
+     * @param payload    - Handoff payload produced by `f.handoff()`
+     * @param sessionId  - MCP session ID (used to key the active tunnel)
+     * @param signal     - AbortSignal tied to the parent MCP connection
+     * @throws If the target is not found in the registry
+     * @throws If the session limit is exceeded
+     */
+    async activateHandoff(payload, sessionId, signal) {
+        // dispose any pre-existing session for this ID before starting
+        await this._closeSession(sessionId);
+        // count ALL sessions (connecting + active) to prevent bypass attacks
+        // where an attacker opens maxSessions 'connecting' tunnels and then opens more.
+        if (this._sessions.size >= this._config.maxSessions) {
+            throw Object.assign(new Error(`[vurb/swarm] Session limit of ${this._config.maxSessions} reached. ` +
+                'Close existing sessions before activating more.'), { code: 'SESSION_LIMIT_EXCEEDED' });
+        }
+        // Mark the slot as 'connecting' immediately to prevent double-activation
+        this._sessions.set(sessionId, { status: 'connecting' });
+        // track the client so dispose() can be called if connect() fails
+        let client;
+        try {
+            // _resolveDomain throws on unknown targets
+            const domain = this._resolveDomain(payload.target);
+            const upstreamUri = this._config.registry[domain];
+            const traceparent = generateTraceparent();
+            const token = await mintDelegationToken(domain, this._config.tokenTtlSeconds, this._config.delegationSecret, 
+            // use the configured gateway name as the token issuer (iss claim)
+            // so that tokens from different gateway instances are distinguishable in audit logs.
+            this._config.gatewayName, payload.carryOverState, this._config.stateStore, traceparent);
+            client = new UpstreamMcpClient(upstreamUri, {
+                connectTimeoutMs: this._config.connectTimeoutMs,
+                idleTimeoutMs: this._config.idleTimeoutMs,
+                delegationToken: token,
+                traceparent,
+                transport: this._config.upstreamTransport,
+            }, signal);
+            // update session with client reference BEFORE awaiting connect().
+            // This lets _closeSession dispose the client even during the in-flight connect,
+            // preventing dispose() called on the gateway from leaving zombie connections.
+            this._sessions.set(sessionId, { status: 'connecting', client });
+            await client.connect();
+            this._sessions.set(sessionId, { status: 'active', client, domain, traceparent });
+        }
+        catch (err) {
+            this._sessions.delete(sessionId);
+            // Dispose the client if it was created, even if _closeSession already did so
+            // concurrently (e.g. parentSignal abort racing with the in-flight connect).
+            // UpstreamMcpClient.dispose() is fully idempotent — safe to call multiple times.
+            await client?.dispose();
+            throw err;
+        }
+    }
+    /**
+     * Proxy the tools/list for an active session.
+     *
+     * Returns `null` for non-existent sessions.
+     * Returns only the return-trip escape tool if the upstream is unreachable.
+     * Returns an empty list while the session is still connecting.
+     */
+    async proxyToolsList(sessionId) {
+        const session = this._sessions.get(sessionId);
+        // distinguish 'no session' from 'still connecting'
+        if (!session)
+            return null;
+        // While connecting, report no tools yet (caller should retry)
+        if (session.status !== 'active')
+            return [];
+        // only wrap the network call in try/catch — not the pure transform
+        // functions. `rewriteList` and `injectReturnTripTool` are pure and should never
+        // throw. Catching them silently would hide programming errors as degraded UX.
+        let raw;
+        try {
+            raw = await session.client.listTools();
+        }
+        catch {
+            // upstream went away — return only the escape hatch
+            return injectReturnTripTool([], this._config.gatewayName);
+        }
+        const prefixed = this._rewriter.rewriteList(raw, session.domain);
+        return injectReturnTripTool(prefixed, this._config.gatewayName);
+    }
+    /**
+     * Proxy a tools/call for an active session.
+     *
+     * Strips the namespace prefix before forwarding to the upstream.
+     *
+     * @returns The upstream's ToolResponse, or `null` if no active tunnel.
+     */
+    async proxyToolsCall(sessionId, name, args, signal) {
+        const session = this._sessions.get(sessionId);
+        // No session at all — caller serves gateway-level tools
+        if (!session)
+            return null;
+        // when session is still connecting, return a descriptive error
+        // instead of null. Returning null causes ServerAttachment to look up the
+        // tool in the gateway's own list, which fails with a generic 'tool not found'.
+        if (session.status !== 'active') {
+            return toolError('HANDOFF_CONNECTING', {
+                message: 'The upstream specialist is still connecting. Please retry in a moment.',
+                suggestion: 'Wait 1-2 seconds and retry the same tool call.',
+                retryAfter: 2,
+                severity: 'warning',
+            });
+        }
+        try {
+            const strippedName = this._rewriter.stripPrefix(name, session.domain);
+            return await session.client.callTool(strippedName, args, signal);
+        }
+        catch (err) {
+            // instanceof instead of duck-typing .name
+            if (err instanceof NamespaceError) {
+                return toolError('HANDOFF_NAMESPACE_MISMATCH', {
+                    message: `Tool "${name}" does not match the active upstream domain "${session.domain}".`,
+                    suggestion: 'Re-fetch the tools/list and retry with a valid tool name.',
+                    severity: 'error',
+                });
+            }
+            // log non-NamespaceError errors for observability before masking them.
+            // The LLM must not see internal error details (security + UX), but errors must
+            // surface somewhere so bugs are diagnosable in production.
+            console.warn(`[vurb/swarm] proxyToolsCall unexpected error for tool "${name}" in domain "${session.domain}":`, err);
+            return toolError('HANDOFF_UPSTREAM_UNAVAILABLE', {
+                message: `The upstream specialist "${session.domain}" is temporarily unavailable.`,
+                suggestion: 'Inform the user and retry in 30 seconds, or call gateway.return_to_triage.',
+                retryAfter: 30,
+                severity: 'error',
+            });
+        }
+    }
+    /**
+     * Close the tunnel for `sessionId` and restore the gateway's tool list.
+     *
+     * Called when the LLM invokes the `gateway.return_to_triage` tool.
+     * `ServerAttachment` emits `notifications/tools/list_changed` after this.
+     */
+    async returnToGateway(sessionId) {
+        await this._closeSession(sessionId);
+    }
+    /**
+     * `true` if there is a tracked tunnel (connecting or active) for the given session.
+     *
+     * Returning `true` during `'connecting'` ensures `ServerAttachment` routes
+     * tools/call through `proxyToolsCall`, which already returns the correct
+     * `HANDOFF_CONNECTING` error for in-progress tunnels — preventing gateway-local
+     * execution from silently bypassing the handoff.
+     */
+    hasActiveHandoff(sessionId) {
+        return this._sessions.has(sessionId);
+    }
+    /** `true` if an activation is in progress for the given session. */
+    isConnecting(sessionId) {
+        return this._sessions.get(sessionId)?.status === 'connecting';
+    }
+    /**
+     * Total number of tracked sessions (connecting + active).
+     *
+     * exposed for integration testing and observability.
+     * Allows tests to assert session lifecycle transitions deterministically
+     * without accessing private state via casting.
+     */
+    get sessionCount() {
+        return this._sessions.size;
+    }
+    /**
+     * Number of sessions currently in the `'connecting'` state.
+     *
+     * useful for load-shedding checks and integration tests.
+     */
+    get connectingCount() {
+        let count = 0;
+        for (const s of this._sessions.values()) {
+            if (s.status === 'connecting')
+                count++;
+        }
+        return count;
+    }
+    /**
+     * Dispose all active sessions and release all resources.
+     *
+     * Call this when shutting down the gateway to cleanly close
+     * all upstream connections, idle timers, and AbortController listeners.
+     */
+    async dispose() {
+        const sessionIds = [...this._sessions.keys()];
+        await Promise.allSettled(sessionIds.map(id => this._closeSession(id)));
+    }
+    // ── Private ─────────────────────────────────────────────
+    async _closeSession(sessionId) {
+        // prevent concurrent double-dispose (e.g. abort signal + returnToGateway racing).
+        // If already closing, bail out immediately — dispose() is idempotent in UpstreamMcpClient
+        // but calling it concurrently can cause duplicate timers and listener leaks.
+        if (this._closingSessions.has(sessionId))
+            return;
+        const session = this._sessions.get(sessionId);
+        if (!session)
+            return;
+        this._closingSessions.add(sessionId);
+        this._sessions.delete(sessionId);
+        try {
+            // also dispose 'connecting' sessions if client was already created.
+            // This aborts the in-flight connect() and cleans up the parentSignal listener.
+            // Sessions where client hasn't been set yet (first ~few ms of activateHandoff)
+            // will simply be deleted from the map — activateHandoff's catch handles cleanup.
+            if (session.status === 'active' || (session.status === 'connecting' && session.client)) {
+                await session.client.dispose();
+            }
+        }
+        finally {
+            this._closingSessions.delete(sessionId);
+        }
+    }
+    /**
+     * Extract the domain key from a target URI.
+     *
+     * `'mcp://finance-agent.internal:8080'` → `'finance'` (registry lookup)
+     * `'finance'`                            → `'finance'` (direct key)
+     *
+     * @throws If the target does not resolve to any entry in the registry.
+     *         Configure all targets explicitly in `SwarmGatewayConfig.registry`.
+     */
+    _resolveDomain(target) {
+        // reject empty-string targets before the registry lookup.
+        // An empty target is always a caller error; if the registry happened to
+        // contain a '' key, we would silently accept it and produce confusing logs.
+        if (!target) {
+            throw Object.assign(new Error('[vurb/swarm] Handoff target must not be an empty string.'), { code: 'REGISTRY_LOOKUP_FAILED' });
+        }
+        // use Object.hasOwn instead of truthiness — an empty string value
+        // is a config error, not a valid reason to skip the lookup and throw a confusing error
+        if (Object.hasOwn(this._config.registry, target))
+            return target;
+        // Try to extract subdomain from mcp:// or mcps:// URI hostname
+        try {
+            const url = new URL(target
+                .replace(/^mcps:\/\//, 'https://') // handle secure mcp scheme
+                .replace(/^mcp:\/\//, 'http://'));
+            const subdomain = url.hostname.split('.')[0] ?? '';
+            if (subdomain && Object.hasOwn(this._config.registry, subdomain))
+                return subdomain;
+        }
+        catch {
+            // ignore URL parse error
+        }
+        // sanitize the target before including it in the error message.
+        // A verbatim target can contain control characters, ANSI escapes, or adversarial
+        // payloads that pollute logs or trip structured error parsers.
+        const safeTarget = String(target).replace(/[\x00-\x1f\x7f]/g, '').slice(0, 200);
+        throw Object.assign(new Error(`[vurb/swarm] Unknown handoff target "${safeTarget}". ` +
+            'All targets must be registered in SwarmGatewayConfig.registry.'), { code: 'REGISTRY_LOOKUP_FAILED' });
+    }
+}
+// ============================================================================
+// W3C traceparent
+// ============================================================================
+/**
+ * Generate a W3C Trace Context `traceparent` header value.
+ * Format: `00-{32 hex}-{16 hex}-01`
+ * Uses `crypto.randomUUID()` — no external dependencies.
+ */
+function generateTraceparent() {
+    const traceId = randomUUID().replace(/-/g, '');
+    const spanId = randomUUID().replace(/-/g, '').slice(0, 16);
+    return `00-${traceId}-${spanId}-01`;
+}
+//# sourceMappingURL=SwarmGateway.js.map

package/dist/SwarmGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SwarmGateway.js","sourceRoot":"","sources":["../src/SwarmGateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,SAAS,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAuD/D,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,YAAY;IACJ,OAAO,CAA+B;IACtC,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACrD,8EAA8E;IAC7D,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtD,YAAY,MAA0B;QAClC,iEAAiE;QACjE,gFAAgF;QAChF,gFAAgF;QAChF,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,MAAM,CACf,IAAI,KAAK,CACL,kDAAkD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7E,oDAAoD,CACvD,EACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,CACnC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,OAAO,GAAG;YACX,UAAU,EAAS,MAAM,CAAC,UAAU,IAAI,IAAI,yBAAyB,EAAE;YACvE,gBAAgB,EAAG,MAAM,CAAC,gBAAgB,IAAK,KAAK;YACpD,aAAa,EAAM,MAAM,CAAC,aAAa,IAAQ,OAAO;YACtD,eAAe,EAAI,MAAM,CAAC,eAAe,IAAM,EAAE;YACjD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM;YACrD,WAAW,EAAQ,MAAM,CAAC,WAAW,IAAU,SAAS;YACxD,8DAA8D;YAC9D,WAAW,EAAQ,MAAM,CAAC,WAAW,IAAU,GAAG;YAClD,QAAQ,EAAW,MAAM,CAAC,QAAQ;YAClC,gBAAgB,EAAG,MAAM,CAAC,gBAAgB;SAC7C,CAAC;IACN,CAAC;IAED,4DAA4D;IAE5D;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,eAAe,CACjB,OAAuB,EACvB,SAAiB,EACjB,MAAmB;QAEnB,+DAA+D;QAC/D,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEpC,qEAAqE;QACrE,gFAAgF;QAChF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,MAAM,CAAC,MAAM,CACf,IAAI,KAAK,CACL,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,YAAY;gBACrE,iDAAiD,CACpD,EACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACrC,CAAC;QACN,CAAC;QAED,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAExD,iEAAiE;QACjE,IAAI,MAAqC,CAAC;QAE1C,IAAI,CAAC;YACD,2CAA2C;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC;YACnD,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;YAE1C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACnC,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAC7B,kEAAkE;YAClE,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,WAAW,EACxB,OAAO,CAAC,cAAc,EACtB,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,WAAW,CACd,CAAC;YAEF,MAAM,GAAG,IAAI,iBAAiB,CAAC,WAAW,EAAE;gBACxC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;gBAC/C,aAAa,EAAK,IAAI,CAAC,OAAO,CAAC,aAAa;gBAC5C,eAAe,EAAG,KAAK;gBACvB,WAAW;gBACX,SAAS,EAAS,IAAI,CAAC,OAAO,CAAC,iBAAiB;aACnD,EAAE,MAAM,CAAC,CAAC;YAEX,kEAAkE;YAClE,gFAAgF;YAChF,8EAA8E;YAC9E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YAEhE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,6EAA6E;YAC7E,4EAA4E;YAC5E,iFAAiF;YACjF,MAAM,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9C,mDAAmD;QACnD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,8DAA8D;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAE3C,mEAAmE;QACnE,gFAAgF;QAChF,8EAA8E;QAC9E,IAAI,GAAc,CAAC;QACnB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACL,oDAAoD;YACpD,OAAO,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAChB,SAAiB,EACjB,IAAY,EACZ,IAA6B,EAC7B,MAAmB;QAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,wDAAwD;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,+DAA+D;QAC/D,yEAAyE;QACzE,+EAA+E;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,oBAAoB,EAAE;gBACnC,OAAO,EAAE,wEAAwE;gBACjF,UAAU,EAAE,gDAAgD;gBAC5D,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,SAAS;aACtB,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACtE,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,0CAA0C;YAC1C,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC,4BAA4B,EAAE;oBAC3C,OAAO,EAAE,SAAS,IAAI,gDAAgD,OAAO,CAAC,MAAM,IAAI;oBACxF,UAAU,EAAE,2DAA2D;oBACvE,QAAQ,EAAE,OAAO;iBACpB,CAAC,CAAC;YACP,CAAC;YACD,uEAAuE;YACvE,+EAA+E;YAC/E,2DAA2D;YAC3D,OAAO,CAAC,IAAI,CACR,0DAA0D,IAAI,gBAAgB,OAAO,CAAC,MAAM,IAAI,EAChG,GAAG,CACN,CAAC;YACF,OAAO,SAAS,CAAC,8BAA8B,EAAE;gBAC7C,OAAO,EAAE,4BAA4B,OAAO,CAAC,MAAM,+BAA+B;gBAClF,UAAU,EAAE,4EAA4E;gBACxF,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,OAAO;aACpB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,YAAY,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,YAAY,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI,eAAe;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY;gBAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACT,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,2DAA2D;IAEnD,KAAK,CAAC,aAAa,CAAC,SAAiB;QACzC,kFAAkF;QAClF,0FAA0F;QAC1F,6EAA6E;QAC7E,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC;YACD,oEAAoE;YACpE,+EAA+E;YAC/E,+EAA+E;YAC/E,iFAAiF;YACjF,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrF,MAAM,OAAO,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;YACpC,CAAC;QACL,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,cAAc,CAAC,MAAc;QACjC,0DAA0D;QAC1D,wEAAwE;QACxE,4EAA4E;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,MAAM,CACf,IAAI,KAAK,CAAC,0DAA0D,CAAC,EACrE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACrC,CAAC;QACN,CAAC;QAED,kEAAkE;QAClE,uFAAuF;QACvF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAEhE,+DAA+D;QAC/D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM;iBACrB,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAG,2BAA2B;iBAC/D,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACL,yBAAyB;QAC7B,CAAC;QAED,gEAAgE;QAChE,iFAAiF;QACjF,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,MAAM,CACf,IAAI,KAAK,CACL,wCAAwC,UAAU,KAAK;YACvD,gEAAgE,CACnE,EACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACrC,CAAC;IACN,CAAC;CACJ;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,mBAAmB;IACxB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAI,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,OAAO,IAAI,MAAM,KAAK,CAAC;AACxC,CAAC"}

package/dist/UpstreamMcpClient.d.ts

@@ -0,0 +1,85 @@
+import type { Tool as McpTool } from '@modelcontextprotocol/sdk/types.js';
+import type { ToolResponse } from '@vurb/core';
+/** Progress notification forwarded from the upstream to the gateway client. */
+export interface ProgressNotification {
+    method: string;
+    params: Record<string, unknown>;
+}
+/** Callback used by SwarmGateway to relay progress upstream → LLM client. */
+export type ProgressForwarder = (notification: ProgressNotification) => void;
+export interface UpstreamMcpClientConfig {
+    /** Milliseconds to wait for the initial connection (default: 5 000). */
+    connectTimeoutMs: number;
+    /** Milliseconds of inactivity before the tunnel is closed (default: 300 000). */
+    idleTimeoutMs: number;
+    /** Delegation token to send via `x-vurb-delegation` header. */
+    delegationToken: string;
+    /** W3C traceparent to propagate (optional). */
+    traceparent?: string;
+    /**
+     * Transport override.
+     * - `'auto'` (default): SSE on Node.js, HTTP on edge runtimes
+     * - `'sse'`: always SSE (persistent)
+     * - `'http'`: always Streamable HTTP (stateless, edge-compatible)
+     */
+    transport?: 'auto' | 'sse' | 'http';
+}
+/**
+ * Outbound MCP client for the SwarmGateway B2BUA face.
+ *
+ * One instance per active handoff session. Closed via `dispose()` or
+ * automatically when the idle timeout or AbortSignal fires.
+ */
+export declare class UpstreamMcpClient {
+    private readonly _targetUri;
+    private readonly _config;
+    private readonly _abortController;
+    private readonly _onParentAbort;
+    private readonly _parentSignal;
+    private _client;
+    private _idleTimer;
+    private _progressForwarder;
+    private _activeCalls;
+    private _disposed;
+    constructor(_targetUri: string, _config: UpstreamMcpClientConfig, parentSignal: AbortSignal);
+    /** Register a forwarder for upstream progress/logging notifications. */
+    setProgressForwarder(forwarder: ProgressForwarder): void;
+    /**
+     * Connect to the upstream server.
+     *
+     * @throws `Error` with `code: 'UPSTREAM_CONNECT_TIMEOUT'` if unreachable within `connectTimeoutMs`
+     */
+    connect(): Promise<void>;
+    /** List all tools exposed by the upstream server. */
+    listTools(): Promise<McpTool[]>;
+    /**
+     * Call a tool on the upstream server.
+     * @param name   - Tool name (without namespace prefix)
+     * @param args   - Tool arguments
+     * @param signal - AbortSignal from the parent tools/call request
+     */
+    callTool(name: string, args: Record<string, unknown>, signal: AbortSignal): Promise<ToolResponse>;
+    /** Close the connection and clear all timers. */
+    dispose(): Promise<void>;
+    private _assertConnected;
+    /**
+     * Build the MCP transport for the given headers and connect-phase abort signal.
+     *
+     * The `connectSignal` is only used for the initial TCP/SSE handshake.
+     * It is NOT the same as the session lifetime signal (`_abortController`).
+     *
+     * `mcps://` (secure MCP) is mapped to `https://`.
+     */
+    private _resolveTransport;
+    /**
+     * Register notification handlers with correctly typed wrappers.
+     *
+     * The MCP SDK's `setNotificationHandler` expects a Zod schema as the first argument.
+     * We create a minimal compliant object that satisfies the runtime duck-type without
+     * importing Zod directly (the SDK validates at transport level, not via our schema).
+     * The `as never` cast is retained on the schema only — all handler types are explicit.
+     */
+    private _wireNotifications;
+    private _resetIdleTimer;
+}
+//# sourceMappingURL=UpstreamMcpClient.d.ts.map

package/dist/UpstreamMcpClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpstreamMcpClient.d.ts","sourceRoot":"","sources":["../src/UpstreamMcpClient.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAM7E,MAAM,WAAW,uBAAuB;IACpC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAetB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IAGnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,UAAU,CAA4C;IAC9D,OAAO,CAAC,kBAAkB,CAAgC;IAE1D,OAAO,CAAC,YAAY,CAAK;IAEzB,OAAO,CAAC,SAAS,CAAS;gBAGL,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,uBAAuB,EACjD,YAAY,EAAE,WAAW;IAY7B,wEAAwE;IACxE,oBAAoB,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI;IAIxD;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA2D9B,qDAAqD;IAC/C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAuBrC;;;;;OAKG;IACG,QAAQ,CACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC;IAwDxB,iDAAiD;IAC3C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAmBzB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAkC1B,OAAO,CAAC,eAAe;CAS1B"}