@wrongstack/mcp 0.284.1 → 0.286.0

package/dist/authorization-manager.d.ts

@@ -0,0 +1,65 @@
+import { type MCPAuthorizationDiscoveryOptions, type MCPAuthorizationDiscoveryResult, type MCPTokenExchangeOptions, type MCPTokenSet } from './authorization.js';
+import type { MCPAuthorizationStateEvent, MCPVaultTokenStore } from './token-store.js';
+type DiscoverAuthorization = (resource: string, options?: MCPAuthorizationDiscoveryOptions) => Promise<MCPAuthorizationDiscoveryResult>;
+type ExchangeAuthorizationCode = (options: MCPTokenExchangeOptions) => Promise<MCPTokenSet>;
+export interface MCPAuthorizationManagerOptions {
+    store: MCPVaultTokenStore;
+    pendingTtlMs?: number | undefined;
+    discover?: DiscoverAuthorization | undefined;
+    exchange?: ExchangeAuthorizationCode | undefined;
+    now?: (() => number) | undefined;
+    onStateChange?: ((event: MCPAuthorizationStateEvent) => void) | undefined;
+}
+export interface MCPAuthorizationStartInput {
+    serverName: string;
+    resource: string;
+    clientId: string;
+    redirectUri: string;
+    scopes?: readonly string[] | undefined;
+    challengeHeader?: string | null | undefined;
+    signal?: AbortSignal | undefined;
+}
+export interface MCPAuthorizationStartResult {
+    serverName: string;
+    resource: string;
+    authorizationUrl: string;
+    redirectUri: string;
+    scopes: string[];
+    expiresAt: number;
+}
+export interface MCPAuthorizationCompleteInput {
+    serverName: string;
+    resource: string;
+    callbackUrl: string;
+    signal?: AbortSignal | undefined;
+}
+export interface MCPAuthorizationStatus {
+    serverName: string;
+    resource: string;
+    state: 'not_authorized' | 'pending' | 'authorized' | 'expired';
+    expiresAt?: number | undefined;
+    scopes: string[];
+    canRefresh: boolean;
+}
+/**
+ * Surface-neutral manual OAuth coordinator. PKCE verifier/state stay only in
+ * this bounded, expiring in-memory map; completed credentials are handed to
+ * the host-owned vault store.
+ */
+export declare class MCPAuthorizationManager {
+    private readonly options;
+    private readonly pending;
+    private readonly pendingTtlMs;
+    private readonly discover;
+    private readonly exchange;
+    private readonly now;
+    constructor(options: MCPAuthorizationManagerOptions);
+    begin(input: MCPAuthorizationStartInput): Promise<MCPAuthorizationStartResult>;
+    complete(input: MCPAuthorizationCompleteInput): Promise<MCPAuthorizationStatus>;
+    status(serverName: string, resource: string): Promise<MCPAuthorizationStatus>;
+    disconnect(serverName: string, resource: string): Promise<boolean>;
+    private pruneExpired;
+    private emit;
+}
+export {};
+//# sourceMappingURL=authorization-manager.d.ts.map

package/dist/authorization-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-manager.d.ts","sourceRoot":"","sources":["../src/authorization-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EAEpC,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,0BAA0B,EAE1B,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAK1B,KAAK,qBAAqB,GAAG,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,gCAAgC,KACvC,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAE9C,KAAK,yBAAyB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE5F,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,kBAAkB,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACjD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IACjC,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC3E;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;CACrB;AASD;;;;GAIG;AACH,qBAAa,uBAAuB;IAOtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IACnE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,YAA6B,OAAO,EAAE,8BAA8B,EAQnE;IAEK,KAAK,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAgCnF;IAEK,QAAQ,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiCpF;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyBlF;IAEK,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAavE;IAED,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,IAAI;CASb"}

package/dist/authorization.d.ts

@@ -0,0 +1,128 @@
+export interface MCPAccessToken {
+    accessToken: string;
+    tokenType?: string | undefined;
+    /** Exact canonical MCP resource URI this token was minted for. */
+    resource: string;
+    expiresAt?: number | undefined;
+    scopes?: string[] | undefined;
+}
+export interface MCPAuthorizationContext {
+    serverName: string;
+    resource: string;
+    signal?: AbortSignal | undefined;
+}
+export interface MCPAuthorizationChallenge {
+    status: 401;
+    resource: string;
+    resourceMetadataUrl?: string | undefined;
+    scopes: string[];
+    rawScheme: 'Bearer';
+}
+export interface MCPProtectedResourceMetadata {
+    resource: string;
+    authorizationServers: string[];
+    scopesSupported: string[];
+}
+export interface MCPAuthorizationServerMetadata {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint?: string | undefined;
+    scopesSupported: string[];
+}
+export interface MCPAuthorizationDiscoveryResult {
+    resourceMetadataUrl: string;
+    authorizationServerMetadataUrl: string;
+    protectedResource: MCPProtectedResourceMetadata;
+    authorizationServer: MCPAuthorizationServerMetadata;
+}
+export type MCPAuthorizationJsonFetcher = (url: string, signal?: AbortSignal | undefined) => Promise<unknown | undefined>;
+export interface MCPAuthorizationDiscoveryOptions {
+    challengeHeader?: string | null | undefined;
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number | undefined;
+    maxResponseBytes?: number | undefined;
+    lookup?: BrowserCompatibleDnsLookup | undefined;
+    /** Test/host override. Production callers should use the pinned default. */
+    fetchJson?: MCPAuthorizationJsonFetcher | undefined;
+}
+export interface MCPAuthorizationSession {
+    authorizationUrl: string;
+    state: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+    resource: string;
+}
+export interface MCPTokenSet extends MCPAccessToken {
+    refreshToken?: string | undefined;
+}
+export interface MCPAuthorizationRequestOptions {
+    authorizationServer: MCPAuthorizationServerMetadata;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scopes?: readonly string[] | undefined;
+}
+export interface MCPTokenExchangeOptions {
+    authorizationServer: MCPAuthorizationServerMetadata;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    code: string;
+    codeVerifier: string;
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number | undefined;
+    maxResponseBytes?: number | undefined;
+    lookup?: BrowserCompatibleDnsLookup | undefined;
+}
+export interface MCPTokenRefreshOptions {
+    authorizationServer: MCPAuthorizationServerMetadata;
+    clientId: string;
+    resource: string;
+    refreshToken: string;
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number | undefined;
+    maxResponseBytes?: number | undefined;
+    lookup?: BrowserCompatibleDnsLookup | undefined;
+}
+type BrowserCompatibleDnsLookup = (hostname: string) => Promise<readonly {
+    address: string;
+    family: number;
+}[]>;
+/**
+ * Host-owned bridge to vault-backed OAuth state. The MCP package never stores
+ * access or refresh tokens itself and never exposes them through config.
+ */
+export interface MCPAuthorizationProvider {
+    getAccessToken(context: MCPAuthorizationContext): Promise<MCPAccessToken | undefined>;
+    /** Refresh/discover/reauthorize. Return true to retry the HTTP request once. */
+    handleUnauthorized?(challenge: MCPAuthorizationChallenge, context: MCPAuthorizationContext): Promise<boolean>;
+}
+export declare function canonicalMcpResource(rawUrl: string): string;
+export declare function authorizationHeaderForToken(token: MCPAccessToken, expectedResource: string, now?: number): string;
+export declare function parseMcpBearerChallenge(header: string | null, resource: string): MCPAuthorizationChallenge;
+/** RFC 9728 fallback order for an MCP endpoint when no challenge URL exists. */
+export declare function protectedResourceMetadataUrls(resource: string): string[];
+/** RFC 8414 + OIDC discovery order required by the MCP authorization spec. */
+export declare function authorizationServerMetadataUrls(issuer: string): string[];
+export declare function parseProtectedResourceMetadata(value: unknown, expectedResource: string): MCPProtectedResourceMetadata;
+export declare function parseAuthorizationServerMetadata(value: unknown, expectedIssuer: string): MCPAuthorizationServerMetadata;
+/**
+ * Re-validate the normalized authorization-server shape before it is accepted
+ * from host-owned persistence. PKCE support is established during discovery;
+ * this guard protects the persisted endpoints and bounded fields themselves.
+ */
+export declare function validateMcpAuthorizationServerMetadata(value: unknown): MCPAuthorizationServerMetadata;
+/**
+ * Discover and validate MCP OAuth metadata without following redirects. The
+ * default fetcher resolves once and opens the socket to that exact IP, making
+ * discovery resistant to DNS rebinding.
+ */
+export declare function discoverMcpAuthorization(resource: string, options?: MCPAuthorizationDiscoveryOptions): Promise<MCPAuthorizationDiscoveryResult>;
+export declare function createMcpAuthorizationRequest(options: MCPAuthorizationRequestOptions): MCPAuthorizationSession;
+export declare function parseMcpAuthorizationCallback(callbackUrl: string, session: Pick<MCPAuthorizationSession, 'redirectUri' | 'state'>): string;
+export declare function exchangeMcpAuthorizationCode(options: MCPTokenExchangeOptions): Promise<MCPTokenSet>;
+export declare function refreshMcpAccessToken(options: MCPTokenRefreshOptions): Promise<MCPTokenSet>;
+export {};
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B;IAC9C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8BAA8B,EAAE,MAAM,CAAC;IACvC,iBAAiB,EAAE,4BAA4B,CAAC;IAChD,mBAAmB,EAAE,8BAA8B,CAAC;CACrD;AAED,MAAM,MAAM,2BAA2B,GAAG,CACxC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,KAC7B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;AAElC,MAAM,WAAW,gCAAgC;IAC/C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAChD,4EAA4E;IAC5E,SAAS,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,cAAc;IACjD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,8BAA8B;IAC7C,mBAAmB,EAAE,8BAA8B,CAAC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,8BAA8B,CAAC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD;AAED,MAAM,WAAW,sBAAsB;IACrC,mBAAmB,EAAE,8BAA8B,CAAC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD;AAED,KAAK,0BAA0B,GAAG,CAChC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtF,gFAAgF;IAChF,kBAAkB,CAAC,CACjB,SAAS,EAAE,yBAAyB,EACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAe3D;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,cAAc,EACrB,gBAAgB,EAAE,MAAM,EACxB,GAAG,SAAa,GACf,MAAM,CAeR;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,MAAM,GACf,yBAAyB,CAqB3B;AAED,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxE;AAED,8EAA8E;AAC9E,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxE;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,gBAAgB,EAAE,MAAM,GACvB,4BAA4B,CAmB9B;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,MAAM,GACrB,8BAA8B,CA8BhC;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,OAAO,GACb,8BAA8B,CAkBhC;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CA0C1C;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,uBAAuB,CA4BzB;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,OAAO,CAAC,GAC9D,MAAM,CAwBR;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CAsBtB;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBjG"}

package/dist/client.d.ts

@@ -0,0 +1,165 @@
+import type { MCPAuthorizationProvider } from './authorization.js';
+import { type MCPGetPromptResult, type MCPListPromptsResult, type MCPListResourcesResult, type MCPListResourceTemplatesResult, type MCPReadResourceResult, type MCPServerMetadata } from './protocol.js';
+export type Transport = 'stdio' | 'sse' | 'streamable-http';
+export interface MCPClientOptions {
+    name: string;
+    transport: Transport;
+    command?: string | undefined;
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    url?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    startupTimeoutMs?: number | undefined;
+    requestTimeoutMs?: number | undefined;
+    /** Host-owned, vault-backed authorization for HTTP transports. */
+    authorizationProvider?: MCPAuthorizationProvider | undefined;
+    /**
+     * Allowlist of env var names to forward from the parent process (process.env)
+     * to the child. Values are resolved at spawn time and merged into `env`
+     * via the `extra` path of `buildChildEnv` (unfiltered). This is how built-in
+     * MCP server presets (GitHub, Slack, Brave Search, …) get their API tokens
+     * without storing them in config.json or being scrubbed by the secret filter.
+     */
+    passthroughEnv?: string[] | undefined;
+}
+export type ConnectionState = 'idle' | 'connecting' | 'connected' | 'disconnected' | 'reconnecting' | 'failed'
+/** Lazy server: registered from a cached manifest, process not spawned. */
+ | 'dormant';
+export interface MCPTool {
+    name: string;
+    description?: string | undefined;
+    inputSchema: Record<string, unknown>;
+}
+export interface ToolCallResult {
+    content: unknown;
+    isError: boolean;
+}
+export interface MCPRequestOptions {
+    signal?: AbortSignal | undefined;
+}
+export interface MCPPageOptions extends MCPRequestOptions {
+    cursor?: string | undefined;
+}
+export interface JsonRpcResponse {
+    jsonrpc: '2.0';
+    id: number;
+    result?: unknown | undefined;
+    error?: {
+        code: number | undefined;
+        message: string;
+        data?: unknown | undefined;
+    } | undefined;
+}
+type ExitListener = (name: string, code: number | null, signal: string | null) => void;
+/**
+ * Fired when the server sends `notifications/tools/list_changed`. The
+ * client refreshes its cached tool list before invoking listeners, so
+ * subscribers can call `listTools()` for the fresh set.
+ */
+type ToolsChangedListener = (name: string, tools: MCPTool[]) => void;
+export type MCPListChangedListener = (name: string) => void;
+/**
+ * Lightweight MCP client supporting three transport types:
+ * - stdio: spawns a child process and communicates over pipes
+ * - sse: connects to an HTTP SSE endpoint for server events, POST for requests
+ * - streamable-http: session-based HTTP transport with NDJSON responses
+ */
+export declare class MCPClient {
+    readonly opts: MCPClientOptions;
+    private state;
+    private child?;
+    private nextId;
+    /**
+     * In-flight JSON-RPC calls keyed by id. `resolve` settles the call; `reject`
+     * is invoked from {@link failPending} when the underlying transport dies
+     * (stdio child exit, `close()`) so callers don't hang forever.
+     */
+    private readonly pending;
+    private rxBuffer;
+    private _tools;
+    /** Server-declared handshake metadata. Populated for stdio in the first protocol slice. */
+    private _serverMetadata?;
+    /** Cached tool list — survives reconnects so the registry can re-register without re-discovering. */
+    private _toolsCache?;
+    private _drainPending;
+    private _lastNotifySkipped;
+    private sseTransport?;
+    private httpTransport?;
+    /** Notified when the stdio child process exits so the registry can attempt reconnect. */
+    private readonly exitListeners;
+    /** Notified when the server announces a tools/list_changed notification. */
+    private readonly toolsChangedListeners;
+    private readonly resourcesChangedListeners;
+    private readonly promptsChangedListeners;
+    /** Notified when an HTTP transport (SSE or streamable-http) disconnects. */
+    private readonly disconnectListeners;
+    constructor(opts: MCPClientOptions);
+    getState(): ConnectionState;
+    getServerMetadata(): MCPServerMetadata | undefined;
+    listTools(): MCPTool[];
+    /** Returns true if a prior notify() call was skipped due to backpressure. */
+    hadNotifySkipped(): boolean;
+    /**
+     * Register a listener for child-process exit events.
+     * The registry uses this to trigger reconnection.
+     */
+    addExitListener(listener: ExitListener): void;
+    removeExitListener(listener: ExitListener): void;
+    /**
+     * Register a listener for transport disconnect events (SSE / streamable-http).
+     * Used by the registry to trigger reconnection for HTTP-based servers.
+     */
+    addDisconnectListener(listener: () => void): void;
+    removeDisconnectListener(listener: () => void): void;
+    connect(): Promise<void>;
+    private connectStdio;
+    private connectSSE;
+    private connectStreamableHTTP;
+    callTool(name: string, input: unknown, opts?: {
+        signal?: AbortSignal | undefined;
+    }): Promise<ToolCallResult>;
+    listResources(opts?: MCPPageOptions): Promise<MCPListResourcesResult>;
+    listResourceTemplates(opts?: MCPPageOptions): Promise<MCPListResourceTemplatesResult>;
+    readResource(uri: string, opts?: MCPRequestOptions): Promise<MCPReadResourceResult>;
+    subscribeResource(uri: string, opts?: MCPRequestOptions): Promise<void>;
+    unsubscribeResource(uri: string, opts?: MCPRequestOptions): Promise<void>;
+    listPrompts(opts?: MCPPageOptions): Promise<MCPListPromptsResult>;
+    getPrompt(name: string, args?: Record<string, string> | undefined, opts?: MCPRequestOptions): Promise<MCPGetPromptResult>;
+    close(): Promise<void>;
+    private request;
+    private requestCapability;
+    private requireResourceSubscriptions;
+    /**
+     * Reject every in-flight {@link request} call. Used when the underlying
+     * transport dies — without this, callers awaiting `tools/call` over a
+     * killed stdio child or a closed transport would hang indefinitely.
+     */
+    private failPending;
+    private notify;
+    private onData;
+    private onLine;
+    private handleServerRequest;
+    /**
+     * L2-C: refresh the cached tool list when the server announces a
+     * `tools/list_changed`. Listeners (the registry) re-wrap and
+     * re-register. Failures are swallowed — a stale cache is preferable
+     * to a hard crash on a transient notification glitch.
+     */
+    private handleToolsListChanged;
+    addToolsChangedListener(listener: ToolsChangedListener): void;
+    removeToolsChangedListener(listener: ToolsChangedListener): void;
+    addResourcesChangedListener(listener: MCPListChangedListener): void;
+    removeResourcesChangedListener(listener: MCPListChangedListener): void;
+    addPromptsChangedListener(listener: MCPListChangedListener): void;
+    removePromptsChangedListener(listener: MCPListChangedListener): void;
+    private emitCapabilityChanged;
+}
+/**
+ * Quote a single argument for `cmd.exe` when spawning with `shell: true` on
+ * Windows. Only args containing whitespace or quotes need wrapping; inside
+ * double quotes cmd.exe escapes a literal `"` as `""`. Backslashes are literal
+ * inside cmd quotes, so paths like `C:\Program Files\x` pass through unharmed.
+ */
+export declare function quoteWindowsArg(arg: string): string;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAOvB,MAAM,eAAe,CAAC;AAIvB,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,YAAY,GACZ,WAAW,GACX,cAAc,GACd,cAAc,GACd,QAAQ;AACV,2EAA2E;GACzE,SAAS,CAAC;AAEd,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AASD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/F;AA6BD,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACvF;;;;GAIG;AACH,KAAK,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE5D;;;;;GAKG;AACH,qBAAa,SAAS;aAiCQ,IAAI,EAAE,gBAAgB;IAhClD,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,KAAK,CAAC,CAA2B;IACzC,OAAO,CAAC,MAAM,CAAK;IACnB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGpB;IACJ,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,MAAM,CAAiB;IAC/B,2FAA2F;IAC3F,OAAO,CAAC,eAAe,CAAC,CAAgC;IACxD,qGAAqG;IACrG,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,kBAAkB,CAAS;IAEnC,OAAO,CAAC,YAAY,CAAC,CAA2B;IAChD,OAAO,CAAC,aAAa,CAAC,CAAsC;IAC5D,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAmC;IACzE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqC;IAC7E,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyB;IAE7D,YAA4B,IAAI,EAAE,gBAAgB,EAAI;IAEtD,QAAQ,IAAI,eAAe,CAE1B;IAED,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAQjD;IAED,SAAS,IAAI,OAAO,EAAE,CAMrB;IAED,6EAA6E;IAC7E,gBAAgB,IAAI,OAAO,CAE1B;IAED;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAE5C;IAED,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAE/C;IAED;;;OAGG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAEhD;IAED,wBAAwB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAEnD;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAc7B;YAEa,YAAY;YAyHZ,UAAU;YAgEV,qBAAqB;IA6D7B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,GAC1C,OAAO,CAAC,cAAc,CAAC,CAuBzB;IAEK,aAAa,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAS9E;IAEK,qBAAqB,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAS9F;IAEK,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAS5F;IAEK,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF;IAEK,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlF;IAEK,WAAW,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAG1E;IAEK,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACzC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAsD3B;IAED,OAAO,CAAC,OAAO;YA0FD,iBAAiB;IA4B/B,OAAO,CAAC,4BAA4B;IAWpC;;;;OAIG;IACH,OAAO,CAAC,WAAW;YAcL,MAAM;IAsDpB,OAAO,CAAC,MAAM;IAWd,OAAO,CAAC,MAAM;IAgDd,OAAO,CAAC,mBAAmB;IAmB3B;;;;;OAKG;YACW,sBAAsB;IAoBpC,uBAAuB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE5D;IAED,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE/D;IAED,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAElE;IAED,8BAA8B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAErE;IAED,yBAAyB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAEhE;IAED,4BAA4B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAEnE;IAED,OAAO,CAAC,qBAAqB;CAW9B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD"}

package/dist/constants.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Shared constants for the MCP package.
+ *
+ * Centralizing these values means:
+ * - Protocol version and client identity are updated in one place
+ * - Reconnect parameters can be overridden via config in the future
+ * - No scattered magic values across multiple files
+ */
+export declare const MCP_CONSTANTS: Readonly<{
+    /** MCP protocol version advertised during handshake. */
+    readonly PROTOCOL_VERSION: '2024-11-05';
+    /** Identity announced to MCP servers during `initialize`. */
+    readonly CLIENT_INFO: Readonly<{
+        name: "wrongstack";
+        version: "0.1.10";
+    }>;
+    /** Reconnection behaviour when a transport disconnects. */
+    readonly RECONNECT: Readonly<{
+        /** Max full reconnect cycles before the slot is marked `failed`. */
+        MAX_CYCLES: 5;
+        /** Base delay between cycles (exponential backoff applied on top). */
+        BASE_DELAY_MS: 1000;
+        /** Jitter factor applied to the backoff (0 = no jitter, 1 = full). */
+        JITTER_FACTOR: 0.2;
+        /** Max connection attempts within a single cycle. */
+        MAX_ATTEMPTS: 3;
+        /** Base multiplier for the exponential backoff formula (`delay = BASE * multiplier^attempt`). */
+        BACKOFF_MULTIPLIER: 2;
+    }>;
+    /** Timing for graceful / forced disconnect. */
+    readonly DISCONNECT: Readonly<{
+        /** Ms to wait for in-flight requests to complete before force-closing. */
+        GRACEFUL_MS: 800;
+        /** Ms after which the force disconnect is triggered. */
+        FORCE_TIMEOUT_MS: 1200;
+    }>;
+    /** Lazy-connect idle lifecycle. */
+    readonly IDLE: Readonly<{
+        /** Default ms a lazy server stays connected with no tool calls before auto-sleep. */
+        DEFAULT_TIMEOUT_MS: 300000;
+        /** How often the idle sweep runs (kept well below the timeout). */
+        SWEEP_INTERVAL_MS: 30000;
+    }>;
+    /** JSON-RPC response timeout for outstanding requests. */
+    readonly RESPONSE_TIMEOUT_MS: 500;
+    /** Max buffer size for the SSE reader. */
+    readonly SSE_READER_MAX_BUFFER: number;
+    /** Max characters logged from a request body. */
+    readonly REQUEST_LOG_CAP: 1024;
+}>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;IACxB,wDAAwD;+BACtC,YAAY;IAE9B,6DAA6D;;;;;IAM7D,2DAA2D;;QAEzD,oEAAoE;;QAEpE,sEAAsE;;QAEtE,sEAAsE;;QAEtE,qDAAqD;;QAErD,iGAAiG;;;IAInG,+CAA+C;;QAE7C,0EAA0E;;QAE1E,wDAAwD;;;IAI1D,mCAAmC;;QAEjC,qFAAqF;;QAErF,mEAAmE;;;IAIrE,0DAA0D;kCACrC,GAAG;IAExB,0CAA0C;;IAG1C,iDAAiD;8BAChC,IAAI;EACZ,CAAC"}

package/dist/content-selection.d.ts

@@ -0,0 +1,33 @@
+import type { MCPGetPromptResult, MCPPromptMessage, MCPReadResourceResult, MCPResourceContents } from './protocol.js';
+export declare const DEFAULT_MCP_INSERTION_MAX_BYTES: number;
+export declare const DEFAULT_MCP_RESOURCE_SCHEMES: readonly ['file', 'git', 'http', 'https', 'mcp', 'mem', 'repo', 'resource'];
+export interface MCPInsertionPolicy {
+    maxBytes?: number | undefined;
+    allowedUriSchemes?: readonly string[] | undefined;
+}
+export interface MCPContentProvenance {
+    origin: 'mcp';
+    serverName: string;
+    capability: 'resource' | 'prompt';
+    resourceUri?: string | undefined;
+    promptName?: string | undefined;
+    promptArgumentNames?: string[] | undefined;
+}
+export interface MCPResourceInsertion {
+    kind: 'resource';
+    untrusted: true;
+    byteSize: number;
+    provenance: MCPContentProvenance;
+    contents: MCPResourceContents[];
+}
+export interface MCPPromptInsertion {
+    kind: 'prompt';
+    untrusted: true;
+    byteSize: number;
+    provenance: MCPContentProvenance;
+    description?: string | undefined;
+    messages: MCPPromptMessage[];
+}
+export declare function prepareResourceInsertion(serverName: string, requestedUri: string, result: MCPReadResourceResult, policy?: MCPInsertionPolicy): MCPResourceInsertion;
+export declare function preparePromptInsertion(serverName: string, promptName: string, args: Record<string, string> | undefined, result: MCPGetPromptResult, policy?: MCPInsertionPolicy): MCPPromptInsertion;
+//# sourceMappingURL=content-selection.d.ts.map

package/dist/content-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-selection.d.ts","sourceRoot":"","sources":["../src/content-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAC1D,eAAO,MAAM,4BAA4B,YACvC,MAAM,EACN,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,KAAK,EACL,MAAM,EACN,UAAU,CACF,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,oBAAoB,CAAC;IACjC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,oBAAoB,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,GAAE,kBAAuB,GAC9B,oBAAoB,CAyBtB;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACxC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,GAAE,kBAAuB,GAC9B,kBAAkB,CA6BpB"}