@zackbart/connecta 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,149 @@
 
 All notable changes to this package are documented here.
 
+## 0.4.1 — 2026-07-25
+
+A security-hardening release from a full audit of the codebase. Every change is
+backward-compatible: new safety that could alter behavior is opt-in or a
+generous default, and existing well-behaved deployments are unaffected. No
+sandbox-escape, RCE, or XSS was found; the items below are the real gaps.
+
+### Security
+
+- **QuickJS sandbox log memory is now bounded.** `execute_code`'s `console.log`
+  capped only the *number* of retained entries (200), not their size, so
+  untrusted guest code — the sandbox's explicit threat model — could
+  `console.log("x".repeat(25_000_000))` two hundred times and retain multiple
+  GB of host memory, OOMing the Node process. Each entry is now truncated to 8k
+  chars and the cumulative buffer to 256k, both at capture time. Small logs are
+  byte-for-byte unchanged.
+
+- **The `fileStorage` state file is now owner-only.** It holds downstream OAuth
+  access/refresh tokens in cleartext on the Node backend and was written with
+  no mode (world-readable `0644`), so any local user could read long-lived
+  tokens. The directory is now `0700`, the temp file `0600` (the atomic rename
+  preserves it), and an existing loose-mode file is repaired to `0600` on load.
+  Repair is best-effort so a non-POSIX filesystem can't block startup.
+
+- **Cleartext-credential and destination guard on `remoteMcp`.** Static
+  `headers` credentials were attached with no scheme check, so an `http://`
+  `url` sent bearer tokens / API keys in cleartext. `remoteMcp` now warns at
+  construction when headers-auth targets a non-https, non-loopback URL, and a
+  new opt-in `requireHttps` makes that a hard error. A `NOTE` documents the
+  residual redirect-following SSRF in the SDK's fetch transport (a malicious
+  downstream could 3xx-redirect to an internal address); a full guard needs
+  manual redirect handling in the SDK and is deferred to a non-patch release.
+
+- **Construction-time warnings for insecure deployment shapes.**
+  `createConnecta` now emits a one-time `logger.warn` when: no inbound `auth`
+  is configured while credential/OAuth connectors are present (any caller
+  reaches the credential vault — connecta's trust model is single-domain, so an
+  open or open-signup deployment grants every caller full access); `publicUrl`
+  is unset while OAuth connectors exist (the downstream `redirect_uri` is
+  derived from the attacker-influenced inbound `Host` header — set `publicUrl`
+  to a fixed https origin); or a connector exposes `finishAuth` but not
+  `verifyState` (its `/oauth/callback` would exchange any delivered `code`).
+  The shipped `remoteMcp` implements `verifyState`, so the last fires only for
+  hand-rolled connectors. Full per-actor authorization remains an architectural
+  change for a future release.
+
+- **The discovery meta-tools no longer hang on a stuck downstream.**
+  `list_connectors`, `search_tools`, and `describe_tools` fanned out live
+  probes to every connector with no deadline, so one hung downstream stalled
+  the whole call. Bounded by the new `probeTimeoutMs` (below); a timed-out
+  connector degrades to an unavailable/errored entry. The bound is
+  caller-facing — the registry takes no `AbortSignal` yet, so the underlying
+  fetch is not cancelled; real cancellation is a documented follow-up.
+
+- **`/ui` now ships a nonce-based script CSP.** The operator page carried no
+  script-restricting CSP, so any future escaping regression would be directly
+  exploitable. It now sends a per-request `script-src 'nonce-…' 'strict-dynamic'
+  https: 'unsafe-inline'; object-src 'none'; base-uri 'none'; frame-ancestors
+  'none'`. `'strict-dynamic'` keeps Clerk's runtime-injected scripts working;
+  the `https:`/`'unsafe-inline'` fallbacks are ignored by modern browsers and
+  only cover legacy ones; and no `default-src` is set so Clerk's network/fonts
+  and the inline styles stay unrestricted. Operator `branding` `productUrl`/
+  `ownerUrl` values are now scheme-gated (a `javascript:` URL is dropped rather
+  than rendered as a link), and credential metadata omits `lastFour` for values
+  shorter than 12 chars so a short secret doesn't leak half of itself.
+
+### Added
+
+- `RemoteMcpOptions.requireHttps` (default `false`) — reject a non-`https://`
+  (non-loopback) `url` at construction, and `RemoteMcpOptions.logger` for the
+  cleartext-credential warning.
+- `ApiOptions.strictValidation` (default `false`) and
+  `ValidateToolInputOptions.failClosed` (default `false`) — reject a call whose
+  `inputSchema` the validator cannot evaluate instead of passing the raw
+  arguments through. The default remains fail-open (a broken schema does not
+  break an otherwise working tool); `api()` also now eagerly compiles each tool
+  schema at construction so a bad one warns once at startup rather than
+  silently on first use.
+- `ConnectaConfig.probeTimeoutMs` (default `30_000`) — per-connector deadline
+  for the `list_connectors`/`search_tools`/`describe_tools` fan-out. Generous
+  by default so it trips only on a pathological hang; does not apply to
+  `call_tool`/`batch_call`, which carry `defaultToolTimeoutMs`.
+
+## 0.4.0 — 2026-07-25
+
+### Added
+
+- `ConnectorCallError` accepts `retryAfterMs` — the wait window a connector
+  already knows (a `Retry-After` header, say) and until now had no way to
+  report. It round-trips into the value-mode error envelope as
+  `error.retryAfterMs` (and `errorDetails.retryAfterMs` in `batch_call`), so an
+  agent that receives the failure can schedule a re-issue instead of guessing,
+  and the engine's retry loop waits that long in place of its exponential
+  guess. A reported window is honoured exactly or not at all: up to 10 s the
+  engine waits it in full; beyond that it declines the retry and returns the
+  failure immediately rather than retrying inside a rate-limit window it was
+  told about. The reported value is never capped.
+- `ConnectaConfig.defaultToolTimeoutMs` — a deadline for `call_tool`/
+  `batch_call` calls that pass no `timeoutMs`, giving the connector both a
+  budget (`ctx.timeoutMs`) and a cancellation signal (`ctx.signal`) on the
+  common path, as `execute_code` host calls have always had. **Opt-in and unset
+  by default**: switching it on globally would put a deadline on every call in
+  every existing deployment, and the failure mode is a working long-running
+  call starting to time out. An explicit per-call `timeoutMs` always wins.
+- `validateToolInput(schema, args, { address, logger? })` — the argument
+  validation `api()` performs, extracted to `src/validate.ts` and exported so
+  connectors that implement the `Connector` interface directly can use it too.
+  Previously enforcement lived inside `api()`, so a hand-rolled connector whose
+  manifest declared `additionalProperties: false` had nothing enforcing it: an
+  unknown argument key was silently dropped, an empty body went upstream, and a
+  200 was reported back as a successful write. It **returns** the non-retryable
+  `invalid_args` `ConnectorCallError` (or `null`) instead of throwing, so the
+  connector owns the decision — its own error prose, or stripping a
+  connector-wide convention argument the tool schema doesn't declare. `api()`
+  now calls it; behaviour is unchanged (`test/api-connector.test.ts` is
+  untouched).
+- `@zackbart/connecta/json-schema` — re-exports `Validator` from
+  `@cfworker/json-schema`. It was already a direct dependency but not public,
+  so downstream build-time validation (a manifest generator asserting its own
+  output) resolved it only through npm hoisting.
+
+### Fixed
+
+- `compactSchema` — the rendering behind `search_tools` and `describe_tools`,
+  and for most models the only description of a tool they ever read — dropped
+  `const` and did not handle `allOf`. A discriminated union, the standard shape
+  for "one of these request bodies", therefore rendered as several textually
+  identical branches with the field that selects them erased
+  (`{ type: string, emoji: string } | { type: string, external: {…} }`), and a
+  schema using `allOf` fell through to raw `JSON.stringify` — on a real
+  connector that measured *longer* than the schema it was meant to compact.
+  `const` now renders as a literal, so unions are self-documenting again, and
+  `allOf` composes with the schema's own shape joined by `&` rather than
+  replacing it: a sibling `properties`, `$ref`, `enum`, `const`, or `items` is
+  no longer silently dropped, and an empty `allOf` beside real properties no
+  longer erases the whole schema.
+- An aborted call — including one the engine itself cancelled at its deadline —
+  was classified `connector_call_failed`/`retryable: false`. An aborted `fetch`
+  rejects with a `DOMException` named `AbortError` whose message matches
+  neither classification regex. `classifyCallError` now checks the name before
+  the message text and classifies it as a retryable `timeout`, so connectors
+  that pass `ctx.signal` through no longer have to special-case it.
+
 ## 0.3.0 — 2026-07-24
 
 ### Added

package/README.md

@@ -65,9 +65,7 @@ connector configuration, auth policy, domain, bindings, migrations, and secrets.
 
 ```ts
 import { DynamicWorkerExecutor } from "@cloudflare/codemode";
-import {
-  api, bearerToken, createConnecta, remoteMcp,
-} from "@zackbart/connecta";
+import { bearerToken, createConnecta, remoteMcp } from "@zackbart/connecta";
 import { clerkAuth } from "@zackbart/connecta/auth/clerk";
 import { cloudflareKvStorage } from "./cloudflare-kv.js";
 
@@ -202,9 +200,11 @@ api("example", {
 ```
 
 Set `credentialEncryptionKey` on `createConnecta` to a base64-encoded 32-byte
-key held in the runtime's secret store (`openssl rand -base64 32`). Credential
-mutation routes require the configured Clerk provider and a same-origin browser
-request; the static inbound bearer cannot administer the vault.
+key held in the runtime's secret store (`openssl rand -base64 32`) — a connector
+that declares a credential without one fails at construction rather than booting
+with an unusable vault. Credential mutation routes require the configured Clerk
+provider and a same-origin browser request; the static inbound bearer cannot
+administer the vault.
 
 Connecta does not bundle service-specific HTTP API connectors. Package consumers
 define them with `api()` (or implement `Connector` directly), keeping endpoint,
@@ -233,17 +233,37 @@ const connecta = createConnecta({
 ```
 
 One final event is emitted for each resolved connector call made through
-`call_tool`, `batch_call`, or `execute_code`; retries remain one event with an
-`attempts` count. Implementing `list` enables the authenticated Activity tab in
-`/ui`; `activityReadGate` can narrow reads further. Writes are best-effort and
-never change a tool result. Clerk calls carry the Clerk user ID; shared bearer
-calls are honestly labeled as bearer unless
-`bearerToken(secret, { subjectId })` assigns that credential a stable subject.
+`call_tool`, `call_destructive_tool`, `batch_call`, or `execute_code`; retries
+remain one event with an `attempts` count. Implementing `list` enables the
+authenticated Activity tab in `/ui`; `activityReadGate` can narrow reads
+further. Writes are best-effort and never change a tool result. Clerk calls
+carry the Clerk user ID; shared bearer calls are honestly labeled as bearer
+unless `bearerToken(secret, { subjectId })` assigns that credential a stable
+subject. On Workers, pass `ctx` through to `connecta.fetch(request, env, ctx)`
+so async writes settle on `waitUntil`.
+[`examples/worker/src/d1-activity.ts`](./examples/worker/src/d1-activity.ts) is
+a complete D1 implementation with keyset paging and a retention pass.
+
+## Operator dashboard
+
+`GET /ui` is a read-only dashboard with no build step: connector health, tool
+counts and descriptions with a client-side filter, downstream authorization
+links, the credential controls above, and an Activity tab when an activity store
+is configured. The shell is open because it carries no data; everything it shows
+comes from `/ui/data`, behind the same auth gate as `/mcp`. With Clerk
+configured it signs operators in through Clerk's hosted portal; a bearer-only
+deployment falls back to a pasted token.
+
+Every deployment-facing label and mark on `/ui` and the OAuth result pages comes
+from `ConnectaConfig.branding` — `productName`, `ownerName`, their URLs,
+`description`, `pageTitle`, `themeColor`, and `favicon` — each falling back to a
+neutral Connecta default. Nothing about the operator is baked into the package.
 
 ## Learn more
 
 - **[`docs/documentation.md`](./docs/documentation.md)** — how everything works: architecture,
   the meta-tools, connectors, inbound auth, downstream OAuth, storage, running it
-  (Node / Workers / Docker), Clerk setup, testing, troubleshooting.
+  (Node / Workers / Docker), Clerk setup, testing, troubleshooting, code mode,
+  the status UI, and activity history.
 - **[`docs/design.md`](./docs/design.md)** — why it's built this way, and the non-goals.
-- **Status UI** — a read-only operator dashboard at `GET /ui` (open shell; data from the bearer/Clerk-gated `/ui/data`). See [§14](./docs/documentation.md#14-status-ui).
+- **[`CHANGELOG.md`](./CHANGELOG.md)** — what changed in each release.

package/SECURITY.md

@@ -16,7 +16,7 @@ CI blocks high and critical production dependency advisories. Moderate findings
 are reviewed for reachability and recorded when an upstream package has not yet
 released a compatible fix.
 
-The initial release has one such upstream finding:
+As of 0.4.0, one such finding remains open:
 `@modelcontextprotocol/sdk@1.29.0` declares `@hono/node-server` 1.x, which is
 covered by `GHSA-frvp-7c67-39w9`. The advisory affects Hono's Windows
 `serve-static` implementation. Connecta does not import that adapter or serve

package/dist/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAItD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,OAAO,GACZ,MAAM,GAAG,SAAS,CAMpB;AAiDD,8EAA8E;AAC9E,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,KAAK,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CASxD;AA0ED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAexD"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAItD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,OAAO,GACZ,MAAM,GAAG,SAAS,CAMpB;AAiDD,8EAA8E;AAC9E,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,KAAK,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CASxD;AAuID,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAexD"}

package/dist/catalog.js

@@ -65,6 +65,40 @@ export function rankTools(tools, query) {
 function refName(ref) {
     return ref.split("/").pop() ?? ref;
 }
+/**
+ * Whether a schema declares anything renderSchema knows how to render on its
+ * own. Used to decide if the non-allOf half of a schema is worth rendering:
+ * without this, a plain `{ allOf: [...] }` would render its (empty) local half
+ * through the raw-JSON fallback and emit `{} & …`.
+ */
+function declaresShape(s) {
+    return (typeof s.$ref === "string" ||
+        Array.isArray(s.oneOf) ||
+        Array.isArray(s.anyOf) ||
+        Array.isArray(s.enum) ||
+        s.const !== undefined ||
+        s.items !== undefined ||
+        s.properties !== undefined ||
+        s.type !== undefined);
+}
+/**
+ * Parenthesize a top-level union so it doesn't read as part of a surrounding
+ * `&`. Only separators outside braces count, so a nested union or a property
+ * description containing a pipe doesn't trigger stray parentheses.
+ */
+function grouped(part) {
+    let nesting = 0;
+    for (let i = 0; i < part.length; i += 1) {
+        const char = part[i];
+        if (char === "{" || char === "(" || char === "[")
+            nesting += 1;
+        else if (char === "}" || char === ")" || char === "]")
+            nesting -= 1;
+        else if (nesting === 0 && part.startsWith(" | ", i))
+            return `(${part})`;
+    }
+    return part;
+}
 function renderSchema(schema, defs, seen, depth) {
     if (depth > 4)
         return "…";
@@ -72,6 +106,28 @@ function renderSchema(schema, defs, seen, depth) {
         return JSON.stringify(schema);
     }
     const s = schema;
+    // allOf composes rather than replaces: it is checked before every other
+    // keyword, and renders the schema's own shape alongside its members instead
+    // of returning early. A schema carrying both allOf and properties (the usual
+    // OpenAPI-derived "extend this base" shape, and equally legal with $ref,
+    // enum, const, or items) would otherwise silently drop whichever half lost
+    // the branch race. The schema's own shape comes first, being the more
+    // specific half, and is rendered at the current depth because its members
+    // sit at this nesting level, not one below.
+    if (Array.isArray(s.allOf)) {
+        const { allOf: _members, ...own } = s;
+        const parts = declaresShape(own)
+            ? [renderSchema(own, defs, seen, depth)]
+            : [];
+        for (const member of s.allOf) {
+            parts.push(renderSchema(member, defs, seen, depth + 1));
+        }
+        if (parts.length === 0)
+            return "unknown";
+        if (parts.length === 1)
+            return parts[0];
+        return parts.map(grouped).join(" & ");
+    }
     if (typeof s.$ref === "string") {
         const name = refName(s.$ref);
         if (seen.has(name))
@@ -92,6 +148,12 @@ function renderSchema(schema, defs, seen, depth) {
     if (Array.isArray(s.enum)) {
         return s.enum.map((value) => JSON.stringify(value)).join(" | ");
     }
+    // Checked before type/properties so a discriminator like
+    // { type: "string", const: "emoji" } renders as "emoji" rather than string.
+    // JSON.stringify(undefined) returns undefined (not a string), so an explicit
+    // `const: undefined` must fall through to the regular type rendering.
+    if (s.const !== undefined)
+        return JSON.stringify(s.const);
     const type = s.type;
     if (type === "array" || s.items) {
         const items = s.items

package/dist/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAEA,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,IAAa;IAEb,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAQD,MAAM,eAAe,GAAG,IAAI,OAAO,EAA+B,CAAC;AAEnE,SAAS,YAAY,CAAC,KAAgB;IACpC,IAAI,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI;YACJ,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;SAChD,CAAC,CAAC,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,GAAmB,EACnB,MAAc,EACd,KAAe;IAEf,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,KAAK,IAAI,KAAK,CAAC;SACnC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,KAAK,IAAI,GAAG,CAAC;SAC9C,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,KAAK,IAAI,GAAG,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;YAAE,KAAK,IAAI,GAAG,CAAC;aAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,GAAG,CAAC;aAC5C,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CACvB,KAAgB,EAChB,KAAa;IAEb,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAA2D,EAAE,CAAC;IAC1E,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CACnB,MAAe,EACf,IAA6B,EAC7B,IAAiB,EACjB,KAAa;IAEb,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAE5C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAA0B,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpE,SAAS,CACV,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;YACnB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,GAAG,KAAK,IAAI,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAa,CAC1D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,KAAK,IAAI;aACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,WAAW,GACf,KAAK,CAAC,GAAG,CACV,EAAE,WAAW,CAAC;YACf,MAAM,OAAO,GACX,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,GAAG,GAAG,GAAG,QAAQ,KAAK,QAAQ,GAAG,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,OAAO,EAAsB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG;QACX,GAAG,CAAE,MAAM,CAAC,KAAiC,IAAI,EAAE,CAAC;QACpD,GAAG,CAAE,MAAM,CAAC,WAAuC,IAAI,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAEA,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,IAAa;IAEb,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAQD,MAAM,eAAe,GAAG,IAAI,OAAO,EAA+B,CAAC;AAEnE,SAAS,YAAY,CAAC,KAAgB;IACpC,IAAI,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI;YACJ,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;SAChD,CAAC,CAAC,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,GAAmB,EACnB,MAAc,EACd,KAAe;IAEf,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,KAAK,IAAI,KAAK,CAAC;SACnC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,KAAK,IAAI,GAAG,CAAC;SAC9C,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,KAAK,IAAI,GAAG,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;YAAE,KAAK,IAAI,GAAG,CAAC;aAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,GAAG,CAAC;aAC5C,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CACvB,KAAgB,EAChB,KAAa;IAEb,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAA2D,EAAE,CAAC;IAC1E,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,CAA0B;IAC/C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACtB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACtB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,KAAK,KAAK,SAAS;QACrB,CAAC,CAAC,KAAK,KAAK,SAAS;QACrB,CAAC,CAAC,UAAU,KAAK,SAAS;QAC1B,CAAC,CAAC,IAAI,KAAK,SAAS,CACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC;aAC1D,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC;aAC/D,IAAI,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,IAAI,GAAG,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CACnB,MAAe,EACf,IAA6B,EAC7B,IAAiB,EACjB,KAAa;IAEb,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAE5C,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC;YAC9B,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAW,CAAC;QAClD,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAA0B,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpE,SAAS,CACV,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,yDAAyD;IACzD,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;YACnB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,GAAG,KAAK,IAAI,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAa,CAC1D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,KAAK,IAAI;aACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,WAAW,GACf,KAAK,CAAC,GAAG,CACV,EAAE,WAAW,CAAC;YACf,MAAM,OAAO,GACX,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,GAAG,GAAG,GAAG,QAAQ,KAAK,QAAQ,GAAG,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,OAAO,EAAsB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG;QACX,GAAG,CAAE,MAAM,CAAC,KAAiC,IAAI,EAAE,CAAC;QACpD,GAAG,CAAE,MAAM,CAAC,WAAuC,IAAI,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/connectors/api.d.ts

@@ -31,6 +31,16 @@ export interface ApiOptions {
      * on loose coercion.
      */
     validateArgs?: boolean;
+    /**
+     * Fail-closed on a tool whose `inputSchema` the validator cannot evaluate
+     * (default false). The default surfaces such a schema as a one-time warning
+     * and then passes the raw arguments through, so a broken schema never breaks
+     * an otherwise working tool. Set true to instead reject those calls with a
+     * non-retryable `invalid_args` ConnectorCallError, so a schema that cannot be
+     * enforced never silently admits unvalidated input. Only consulted when
+     * `validateArgs` is not false.
+     */
+    strictValidation?: boolean;
     tools: ApiTool[];
 }
 /**

package/dist/connectors/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3E;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,oDAAoD;IACpD,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAkF3D"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3E;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,oDAAoD;IACpD,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAgD3D"}

package/dist/connectors/api.js

@@ -1,5 +1,4 @@
-import { Validator } from "@cfworker/json-schema";
-import { ConnectorCallError } from "../errors.js";
+import { precompileValidator, validateToolInput } from "../validate.js";
 /**
  * A connector defined entirely in code: static tool defs + fetch handlers.
  * Tool inputs are plain JSON Schema objects (bring your own zod-to-json-schema
@@ -21,27 +20,15 @@ export function api(id, opts) {
     }));
     const byName = new Map(opts.tools.map((t) => [t.name, t]));
     const validateArgs = opts.validateArgs ?? true;
-    // Lazy per-tool validator cache; null marks a schema the validator rejected
-    // (warned once, then passed through rather than breaking a working tool).
-    const validators = new Map();
-    const disableValidation = (tool, ctx, err) => {
-        validators.set(tool.name, null);
-        ctx.logger.warn(`[connecta] tool "${id}.${tool.name}" has an inputSchema the validator cannot use (${err instanceof Error ? err.message : String(err)}) — arguments are not validated`);
-    };
-    const validatorFor = (tool, ctx) => {
-        let validator = validators.get(tool.name);
-        if (validator === undefined) {
-            try {
-                validator = new Validator(tool.inputSchema, "2020-12", false);
-                validators.set(tool.name, validator);
-            }
-            catch (err) {
-                disableValidation(tool, ctx, err);
-                validator = null;
-            }
+    const strictValidation = opts.strictValidation ?? false;
+    if (validateArgs) {
+        // Compile each schema now so a validator-hostile inputSchema surfaces once
+        // here rather than silently on its first call. Warning-only; never throws.
+        for (const t of opts.tools) {
+            if (t.inputSchema)
+                precompileValidator(t.inputSchema, { address: `${id}.${t.name}` });
         }
-        return validator;
-    };
+    }
     return {
         id,
         title: opts.title,
@@ -61,23 +48,13 @@ export function api(id, opts) {
             }
             const input = args ?? {};
             if (validateArgs && tool.inputSchema) {
-                const validator = validatorFor(tool, ctx);
-                let result;
-                try {
-                    result = validator?.validate(input);
-                }
-                catch (err) {
-                    // e.g. an unresolvable $ref — surfaces on first validate, not compile.
-                    disableValidation(tool, ctx, err);
-                }
-                if (result && !result.valid) {
-                    const units = result.errors.filter((u) => u.instanceLocation !== "#");
-                    const detail = (units.length > 0 ? units : result.errors)
-                        .slice(0, 3)
-                        .map((u) => `${u.instanceLocation}: ${u.error}`)
-                        .join("; ");
-                    throw new ConnectorCallError("invalid_args", `Invalid arguments for "${id}.${name}": ${detail || "input does not match the tool's inputSchema"}`);
-                }
+                const invalid = validateToolInput(tool.inputSchema, input, {
+                    address: `${id}.${name}`,
+                    logger: ctx.logger,
+                    failClosed: strictValidation,
+                });
+                if (invalid)
+                    throw invalid;
             }
             return tool.handler(input, ctx);
         },

package/dist/connectors/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAsDlD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,IAAgB;IAC9C,MAAM,IAAI,GAAc,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvD,MAAM,iBAAiB,GAAG,CACxB,IAAa,EACb,GAAqB,EACrB,GAAY,EACZ,EAAE;QACF,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,oBAAoB,EAAE,IAAI,IAAI,CAAC,IAAI,kDACjC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,iCAAiC,CAClC,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,IAAa,EAAE,GAAqB,EAAE,EAAE;QAC5D,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,WAAoB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACvE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClC,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO;QACL,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,WAAW,EAAE,IAAI;QACjB,KAAK,CAAC,SAAS;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;gBACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAClC,CAAC;oBACF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;yBACtD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;yBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;yBAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,MAAM,IAAI,kBAAkB,CAC1B,cAAc,EACd,0BAA0B,EAAE,IAAI,IAAI,MAAM,MAAM,IAAI,6CAA6C,EAAE,CACpG,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgExE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,IAAgB;IAC9C,MAAM,IAAI,GAAc,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,2EAA2E;QAC3E,2EAA2E;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,WAAW;gBACf,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,WAAW,EAAE,IAAI;QACjB,KAAK,CAAC,SAAS;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE;oBACzD,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,UAAU,EAAE,gBAAgB;iBAC7B,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/remote-mcp.d.ts

@@ -1,5 +1,5 @@
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-import type { Connector, ConnectorContext } from "../types.js";
+import type { Connector, ConnectorContext, Logger } from "../types.js";
 export type RemoteMcpAuth = {
     type: "headers";
     headers: Record<string, string>;
@@ -12,6 +12,19 @@ export interface RemoteMcpOptions {
     title?: string;
     description?: string;
     auth?: RemoteMcpAuth;
+    /**
+     * Refuse to connect to a non-`https://` `url` at construction (default
+     * false). Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are always
+     * allowed for local development. Off by default, static `headers` credentials
+     * over a cleartext connection are warned about but permitted; set this true
+     * to make that misconfiguration a hard error instead.
+     */
+    requireHttps?: boolean;
+    /**
+     * Destination for the cleartext-credential warning emitted at construction.
+     * Default console.
+     */
+    logger?: Logger;
     /**
      * @internal Testing seam. When set, this transport is used instead of the
      * HTTP transport, letting tests point the connector at an in-process MCP

package/dist/connectors/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAGjB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAeD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA+RvE"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA4TvE"}

package/dist/connectors/remote-mcp.js

@@ -8,6 +8,12 @@ import { CONNECTA_VERSION } from "../version.js";
 function msg(err) {
     return err instanceof Error ? err.message : String(err);
 }
+function isLoopbackHost(hostname) {
+    return (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "[::1]" ||
+        hostname === "::1");
+}
 /**
  * Proxy a downstream remote MCP server. SDK clients and transports are scoped
  * to one inbound request: reused by calls within a batch/execute_code run, but
@@ -24,6 +30,21 @@ export function remoteMcp(id, opts) {
     // from the isolate singleton. Those are request-bound in Cloudflare Workers.
     const states = new WeakMap();
     const isOauth = opts.auth?.type === "oauth";
+    const logger = opts.logger ?? console;
+    // Check the destination scheme once at construction: buildTransport (and the
+    // SDK's fetch) attach any static credentials to every request, so an http://
+    // endpoint sends bearer tokens / API keys in cleartext. Loopback is exempt
+    // for local development.
+    const destination = new URL(opts.url);
+    const insecureDestination = destination.protocol !== "https:" && !isLoopbackHost(destination.hostname);
+    if (insecureDestination) {
+        if (opts.requireHttps) {
+            throw new Error(`[connecta] connector "${id}" url ${opts.url} is not https:// (and not loopback) — refusing to connect (requireHttps).`);
+        }
+        if (opts.auth?.type === "headers") {
+            logger.warn(`[connecta] connector "${id}" sends static credentials to ${opts.url} over a non-https:// connection — those tokens will be transmitted in cleartext.`);
+        }
+    }
     /** Typed per-call auth signal; the SDK's UnauthorizedError stays as cause. */
     const authRequiredError = (cause) => new ConnectorCallError("auth_required", `Connector "${id}" requires authorization — call authorize_connector({ connector: "${id}" }) and open the returned URL.`, { cause });
     const stateFor = (ctx) => {
@@ -46,6 +67,14 @@ export function remoteMcp(id, opts) {
         state.provider ??= new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`);
         return state.provider;
     };
+    // NOTE: StreamableHTTPClientTransport speaks over fetch, which transparently
+    // follows 3xx redirects. A malicious or compromised downstream MCP could
+    // redirect to an internal address (e.g. http://169.254.169.254/…) and fetch
+    // would re-issue the request — potentially carrying static auth headers. The
+    // scheme check above only guards the first hop; a fully robust guard (manual
+    // redirect handling + per-hop re-validation + stripping auth headers cross-
+    // origin) lives in the SDK transport and is deferred to a future non-patch
+    // release rather than reimplemented here.
     const buildTransport = (ctx, state) => {
         if (opts._transportFactory)
             return opts._transportFactory(ctx);

package/dist/connectors/remote-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA0BjD,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAsB;IAC1D,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2B,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;IAE5C,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC3C,IAAI,kBAAkB,CACpB,eAAe,EACf,cAAc,EAAE,qEAAqE,EAAE,iCAAiC,EACxH,EAAE,KAAK,EAAE,CACV,CAAC;IAEJ,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAmB,EAAE;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC;QACtC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE,IAAI;aAC1B,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAsB,EACL,EAAE;QACnB,KAAK,CAAC,QAAQ,KAAK,IAAI,eAAe,CACpC,EAAE,EACF,GAAG,CAAC,OAAO,EACX,GAAG,GAAG,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACtC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,GAAqB,EACrB,KAAsB,EACX,EAAE;QACb,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,OAAO,IAAI,6BAA6B,CACtC,GAAG,EACH,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAsB,EAAE,EAAE;QACvC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,GAAqB,EACrB,KAAsB,EACP,EAAE;QACjB,4EAA4E;QAC5E,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAClE,IACE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC5C,KAAK,CAAC,mBAAmB,EACzB,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,2EAA2E;YAC3E,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACxC,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,CAAC,GAAG,IAAI,MAAM,CAClB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC/C,EAAE,mBAAmB,EAAE,IAAI,2BAA2B,EAAE,EAAE,CAC3D,CAAC;YACF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACnB,uEAAuE;gBACvE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,kBAAkB;gBAClB,IAAI,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,KAAK,CAAC,mBAAmB,GAAG,UAAU,CAAC;gBACvC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,mEAAmE;gBACnE,mBAAmB;gBACnB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAc;QAC3B,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAE7B,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAClB,CAAC,CAAC,EAAW,EAAE,CAAC,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAqC;gBACpD,YAAY,EAAE,CAAC,CAAC,YAAuC;gBACvD,WAAW,EAAE,CAAC,CAAC,WAAqC;aACrD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,MAAO,CAAC,QAAQ,CACjC;oBACE,IAAI;oBACJ,SAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACnD,EACD,SAAS,EACT,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM;oBACzB,CAAC,CAAC;wBACE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9C;oBACH,CAAC,CAAC,SAAS,CACd,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;oBACpE,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,GAAG;wBACrB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS;gBACxB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAkC,CAAC;YAC/D,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9B,mEAAmE;YACnE,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,SAAS,CAAC,WAAW,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,SAAS,CAAC,SAAS,GAAG,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,0BAA0B;gBAC1B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,mEAAmE;gBACnE,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;gBACzB,wEAAwE;gBACxE,yCAAyC;gBACzC,MAAM,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;gBACvB,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC;gBAClD,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,OAAO;wBACzB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,MAAM,CAAC,CAAC,uBAAuB,EAAE;wBACnD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAwCjD,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAsB;IAC1D,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2B,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IAEtC,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,mBAAmB,GACvB,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,SAAS,IAAI,CAAC,GAAG,2EAA2E,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,yBAAyB,EAAE,iCAAiC,IAAI,CAAC,GAAG,kFAAkF,CACvJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC3C,IAAI,kBAAkB,CACpB,eAAe,EACf,cAAc,EAAE,qEAAqE,EAAE,iCAAiC,EACxH,EAAE,KAAK,EAAE,CACV,CAAC;IAEJ,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAmB,EAAE;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC;QACtC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE,IAAI;aAC1B,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAsB,EACL,EAAE;QACnB,KAAK,CAAC,QAAQ,KAAK,IAAI,eAAe,CACpC,EAAE,EACF,GAAG,CAAC,OAAO,EACX,GAAG,GAAG,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACtC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,CACrB,GAAqB,EACrB,KAAsB,EACX,EAAE;QACb,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,OAAO,IAAI,6BAA6B,CACtC,GAAG,EACH,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAsB,EAAE,EAAE;QACvC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,GAAqB,EACrB,KAAsB,EACP,EAAE;QACjB,4EAA4E;QAC5E,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAClE,IACE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC5C,KAAK,CAAC,mBAAmB,EACzB,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,2EAA2E;YAC3E,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACxC,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,CAAC,GAAG,IAAI,MAAM,CAClB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC/C,EAAE,mBAAmB,EAAE,IAAI,2BAA2B,EAAE,EAAE,CAC3D,CAAC;YACF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACnB,uEAAuE;gBACvE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,kBAAkB;gBAClB,IAAI,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,KAAK,CAAC,mBAAmB,GAAG,UAAU,CAAC;gBACvC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,mEAAmE;gBACnE,mBAAmB;gBACnB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAc;QAC3B,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAE7B,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAClB,CAAC,CAAC,EAAW,EAAE,CAAC,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAqC;gBACpD,YAAY,EAAE,CAAC,CAAC,YAAuC;gBACvD,WAAW,EAAE,CAAC,CAAC,WAAqC;aACrD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,MAAO,CAAC,QAAQ,CACjC;oBACE,IAAI;oBACJ,SAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACnD,EACD,SAAS,EACT,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM;oBACzB,CAAC,CAAC;wBACE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9C;oBACH,CAAC,CAAC,SAAS,CACd,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;oBACpE,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,GAAG;wBACrB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS;gBACxB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAkC,CAAC;YAC/D,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9B,mEAAmE;YACnE,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,SAAS,CAAC,WAAW,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,SAAS,CAAC,SAAS,GAAG,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,0BAA0B;gBAC1B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,mEAAmE;gBACnE,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;gBACzB,wEAAwE;gBACxE,yCAAyC;gBACzC,MAAM,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;gBACvB,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC;gBAClD,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,OAAO;wBACzB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,MAAM,CAAC,CAAC,uBAAuB,EAAE;wBACnD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/credentials.d.ts

@@ -1,7 +1,8 @@
 import type { ConnectorCredentialValues, KVStorage } from "./types.js";
 export interface CredentialFieldMetadata {
     configured: true;
-    lastFour: string;
+    /** Only emitted when the value is long enough that four chars don't leak much. */
+    lastFour?: string;
     updatedAt: string;
 }
 export interface CredentialMetadata {

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAqBvE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CAClD;AAkGD;;;;GAIG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;gBAGtB,OAAO,EAAE,SAAS,EACnC,aAAa,EAAE,MAAM;IAiBvB,OAAO,CAAC,cAAc;YAIR,IAAI;IAoBZ,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE,MAAM,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsBjE,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IA2BxB,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAqBvE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CAClD;AAkGD;;;;GAIG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;gBAGtB,OAAO,EAAE,SAAS,EACnC,aAAa,EAAE,MAAM;IAiBvB,OAAO,CAAC,cAAc;YAIR,IAAI;IAoBZ,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE,MAAM,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwBjE,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IA2BxB,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}